tag lookups are as fast as all the others in a filter except the search field

good quality key/value stores maintain sort order in the blocks of the data once it has done a compaction pass, so it really is just finding the start point and simple iteration

i haven't thought about the implications of the tree structure of these 30040/1 events though, you should maybe read up a little on filesystem architecture theory to help evaluate what ways you can do things... filesystems are not quite the same as key/value stores, similar, but a filesystem can be highly branched where a key value store is like a (mostly) sorted index