So, that's definitely something osquery can help out with. If you build out the tooling for parsing the logs into osquery, osquery can handle the dedup of extraneous data for you