i like to use logstash to add fingerprints to my logs, then I use the

new_term

rules to really trivially see things like novel netflows