Id like it in multiple processes due to size of logs. As each preprocesser is processing GBs of logs having each executing in its own process space would be important to take advantage of multiple cores.
It uses hashs so as multiple preprocessers write, the processer can execute in order of datetime.
Each preprocesser would write to the same hash and the engine would process that hash.