Not very complex event concatenation by unique key.

Originally by https://github.com/timukas

Hi,

It would be nice to have a graylog2 feature, which could group/join different events by some unique key. Time window could be also configurable - 5 seconds or 2 minutes.

Here's some example logs:
2014.02.28 10:02:10,215 +0200 [192.168.14.112] [86dkl389] action:"something"
2014.02.28 10:02:10,415 +0200 [192.168.14.112] [GdhNalvZ] action:"request"
2014.02.28 10:02:11,526 +0200 [192.168.14.112] [GdhNalvZ] params1:"data 1"
2014.02.28 10:02:11,637 +0200 [192.168.14.112] [GdhNalvZ] params2:"data 2"
2014.02.28 10:02:12,748 +0200 [192.168.14.112] [GdhNalvZ] params3:"data 3"
2014.02.28 10:02:13,115 +0200 [192.168.14.112] [A89023JK] action:"another"
2014.02.28 10:02:13,148 +0200 [192.168.14.112] [GdhNalvZ] params4:"data 4"
…

First you extract unique keys for events, in this example it goes after ip address.
Then you set some timeframe - 10 seconds (could be any number, but be aware of high memory consumption)
Finally you set an action. I'm thinking of joining all matched lines to single full_message. But actions could be different - remove all messages except the first one, etc etc.

Basically this example configuration would put all messages with [GdhNalvZ] key into on single event.

Or may be some drools guru is reading this message and can give a hand in writting rule which does something similar :)

p.s. Since i'm not sure whether it should be under web or server trees, i put it here :)