I doubt it can be helped here, but I wish the osquery status log was more structured.

{
  "s": 0,
  "f": "scheduler.cpp",
  "i": 75,
  "m": "Executing scheduled query foobar: SELECT * from os_version",
  "h": "dev",
  "c": "Mon Dec 18 00:47:37 2017 UTC",
  "u": 1513558057
}

because the message field is just a blob of text, it's hard to index it and filter for specific keys/components. Unlike the rest of the osquery result logs, status logs require a pile of custom regex to effectively take advantage of