I can only assume most people do this post-downloading, but it would be awfully convenient to ingest with a filter to shave cycles.
Consider:
Introduce a filter directive in enterprise log share. Basically provide the option to match specific fields in the output.
Example: ?filter=CacheCacheStatus:miss,OriginResponseTime>1000,ClientCountry=CN
This would only return cache misses that took more than 1s to fetch from origin from clients originating in China.