A method by a computer includes receiving a search query from a user equipment, where the search query defines a logical combination of terms to be searched within a defined interval of records of a log stream. An estimate is generated for the number of occurrences of the logical combination of terms in the defined interval of records. A message containing the estimate for the number of occurrences of the logical combination of terms in the defined interval of records is communicated toward the user equipment.