journald uses hash tables, I think it update it on every new log line, although I didn't debug it in depth yet.

https://github.com/systemd/systemd/blob/199f75205b9c0625bf56...