Can it be both? recent logs in mem, then shelved off to storage

Yeah, you could do that! You’d have to manage that data shuffling yourself though, Typesense is optimized only for RAM-based search