How to filter “select” queries from a log file that contains over 30000 lines
this is my log file
"15:49:05,479 DEBUG [org.hibernate.stat.internal.ConcurrentStatisticsImpl] (default task-43) HHH000117: HQL: select T from translator_MenuTranslator T where (T.codeMessage = ?1 and (T.language = ?2 and (T.label = ?3 and T.label = ?4))), time: 2ms, rows: 0
"
filter{
grok { match => [ "message", "%{TIME:timestamp}\s%{LOGLEVEL:level} [%{JAVACLASS:class}]\s(%{GREEDYDATA:thread}) HHH000117: HQL: %{GREEDYDATA:text}" ]}
if [type] == "logs" {
dissect { mapping => [ "message", '%{[@metadata][ts]} [%{}] [%{}] %{[@metadata][text]}' ]}}
mutate { add_field => { "[@metadata][static]" => "1" } }
if [@metadata][text] =~ /^select/ {
grok { match => [ "[@metadata][text]", %{GREEDYDATA:query}" ]}
}