4. The method of claim 1 , further comprising: receiving, by a computer, a security log stream generated by a computing device; scanning, by the computer, each record of the security log stream; comparing, by the computer, the scan of each record with the stored scan data contained within the database to identify tokens and the positional information corresponding to the identified token; and in response to the identified tokens matching the tokens contained within the database, extracting, by the computer, data contained within the security log stream based on the identified tokens and the positional information corresponding to the identified tokens.
5. The method of claim 4 , wherein scanning, by the computer, each record of the security log stream comprises: wherein the scan is an n-gram scan that scans the each line starting at one end and advancing it way to the other end of the symbol string one symbol at a time; and wherein n is an integer that represents the number of characters that are being scan at one time.