May be possible with splunk, I have the advantage of being able to have this converaation with a Splunk pro services engineer on Tuesday