To get you part of the way there I would set up a rule that filters on message text matching "user account is locked out" and write it to a specific log file. Then you can open the file or files and do a simple text search. Alternatively, you could log the messages to a full SQL or MySQL instance and use thier query capabilities.
Adding more search, either a larger database or something like wingrep, falls, in my opinion, outside of the role of the syslog server and more into the area of the Solarwinds Log and Event Manager or similar products.