I've done some POC around an async approach and my specific recommendation is to drive it as a background process from a server logs search rather than doing real-time logging