Hi Mindis,
This does actually sound like a good use case for Flink. Without knowing more details it's a bit hard to say which of the options you mention would be most efficient but my gut feeling is that the "one big dataset" approach would be the way to go.
I think there probably is a simplified workflow here where you could unify both the historical and realtime processing into a single Flink job.
-Jamie