Log wildcarding works similar to network wildcarding, but rather than splitting on “/”, we split on spaces, and then we look for common prefixes.
So for example: "this is a log message" would get split into "this", "is", etc. If we see the log "that is a log message", then we have a prefix of “this” and one of "that", and we permit up to 100 unique values
If there is no split in the message, the full message gets replaced with a single <<wildcard>> if it gets to more than 100.
For log messages that are split using "?", "&", etc. We recommend splitting the log message on the app side.