Can't you simply store the "OR" statements as actual 'or' regex strings? For each set of rows with matching fgid's, create a hash keyed by slot values. First check if the slot value is defined in the hash. If not, just add it, otherwise append |value to the existing value for that slot key. Then, when an event comes in, use =~ to match slots instead of eq

Does that make sense?