A computer-implemented method comprising: creating a flow log object (120; 340; 503) that includes a plurality of log entries (202, 212, 213, 214) at a plurality of log entry locations, wherein the log entries (202, 212, 213, 214) are records of a plurality of network traffic flows processed by the network appliances; creating an index object (150; 302) that includes a plurality of shards (152; 319) and a flow table (151; 330) that indicate the log entry locations; and storing the flow log object (120; 340; 503) and the index object (150; 302) in at least one nonvolatile memory, wherein each of the log entries (202, 212, 213, 214) includes a plurality of indexed field values for a plurality of indexed fields that include a first indexed field and a second indexed field, the flow table includes a plurality of flow entries (331, 335) that include a plurality of log entry indicators, the log entries (202, 212, 213, 214) include a log entry stored at an entry location, a first shard entry is stored in a first one of the shards indicated by a first shard identifier determined using the first indexed field, the first indexed field is used to determine a first flow key, the first shard entry stores a first flow entry indicator in association with the first flow key, the first flow entry indicator indicates a first log entry indicator that indicates the entry location, a second shard entry is stored in a second one of the shards indicated by a second shard identifier determined using the second indexed field, the second indexed field is used to determine a second flow key, the second shard entry stores a second flow entry indicator in association with the second flow key, and the second flow entry indicator indicates a second log entry indicator that indicates the entry location. creating a flow log object (120; 340; 503) that includes a plurality of log entries (202, 212, 213, 214) at a plurality of log entry locations, wherein the log entries (202, 212, 213, 214) are records of a plurality of network traffic flows processed by the network appliances; creating an index object (150; 302) that includes a plurality of shards (152; 319) and a flow table (151; 330) that indicate the log entry locations; and storing the flow log object (120; 340; 503) and the index object (150; 302) in at least one nonvolatile memory, wherein each of the log entries (202, 212, 213, 214) includes a plurality of indexed field values for a plurality of indexed fields that include a first indexed field and a second indexed field, the flow table includes a plurality of flow entries (331, 335) that include a plurality of log entry indicators, the log entries (202, 212, 213, 214) include a log entry stored at an entry location, a first shard entry is stored in a first one of the shards indicated by a first shard identifier determined using the first indexed field, the first indexed field is used to determine a first flow key, the first shard entry stores a first flow entry indicator in association with the first flow key, the first flow entry indicator indicates a first log entry indicator that indicates the entry location, a second shard entry is stored in a second one of the shards indicated by a second shard identifier determined using the second indexed field, the second indexed field is used to determine a second flow key, the second shard entry stores a second flow entry indicator in association with the second flow key, and the second flow entry indicator indicates a second log entry indicator that indicates the entry location. each of the log entries (202, 212, 213, 214) includes a plurality of indexed field values for a plurality of indexed fields that include a first indexed field and a second indexed field, the flow table includes a plurality of flow entries (331, 335) that include a plurality of log entry indicators, the log entries (202, 212, 213, 214) include a log entry stored at an entry location, a first shard entry is stored in a first one of the shards indicated by a first shard identifier determined using the first indexed field, the first indexed field is used to determine a first flow key, the first shard entry stores a first flow entry indicator in association with the first flow key, the first flow entry indicator indicates a first log entry indicator that indicates the entry location, a second shard entry is stored in a second one of the shards indicated by a second shard identifier determined using the second indexed field, the second indexed field is used to determine a second flow key, the second shard entry stores a second flow entry indicator in association with the second flow key, and the second flow entry indicator indicates a second log entry indicator that indicates the entry location.