I have mysql slowlogs in logstash and I'm wondering if anyone has had any luck parsing the query section to try and categorize statements. I'm stuck right now trying to split up the query by words in capital letters. I'm thinking that I can at least separate the initial statement. The specific question is this: how can I filter a message like this one so that I can at least deal with each section of the query split by words in capital letters?
SELECT column_one, column_two, COUNT(DISTINCT IF(column_three > 0, CONCAT('m_', column_three), CONCAT('r_', column_one))) AS tally FROM column_four WHERE ...
Does anyone know how I could filter this into:
field1: SELECT column_one, column_two,
field2: COUNT(DISTINCT IF(column_three > 0,
field3: CONCAT('m_', column_three),
field4: AS tally
... etc