I can see why you'd want to keep it non-Java and simple. I will admit that I am biased since I work with Spark all day, but I think you'll eventually want to write a query where you wish you had Spark SQL or could manipulate it as a Spark RDD.

Spark actually isn't too painful for this because you can run it locally in a single process. It is not exactly as elegant as the UNIX way you outline in your second example, but it isn't as horrifying as submitting a YARN job or spinning up a cluster.

In spark-shell:

    // Skip this conversion if you're just running one query. Do it if you're running many.
    spark.read.json(input paths).write.parquet("/target/path")  
    spark.read.parquet("/target/path").createOrReplaceTempView("logs")
    spark.sql("select count(distinct src) from logs where dport = 23").show()

The incremental conversion of your JSON data set to Parquet will be a little bit more annoying to write in Scala than the above example, but is very much doable. There is also a small amount of overhead with the first spark.read.parquet, but it's faster on a local data source than it is against something like S3.