Is it possible to run a regex replace on a field being imported and create a new field with the result? My log has SQL statements in them, I can extract them but I’d also like to create a collapsed or generic version in order to aggregate the statement i.e. I want to replace quoted strings and numbers/dates in the string to identify a statement that appears repeatedly but with different query values.
SELECT * FROM EMP WHERE EMPLOYEE=‘CHRIS’ AND STATUS=1
SELECT * FROM EMP WHERE EMPLOYEE=‘FRED’ AND STATUS=2
Would both be captured but also a n additional “collapsed” version would be created such as:
SELECT * FROM EMP WHERE EMPLOYEE=’’ AND STATUS=
I have a regex to do the replace, I’m just not sure how to put this in to graylog, my aim is that I know that the equivalent statement was found twice in my log files.