Method and system for implementing a log parser in a log analytics system
First Claim
Patent Images
1. A method comprising:
- generating a mapping structure that maps a first plurality of elements of a first entry in a log to corresponding element types;
analyzing a second plurality of elements of a second entry in the log, relative to the mapping structure, to identify at least;
a common element that is identical in the first plurality of elements and the second plurality of elements, anda first variable element that varies between the first plurality of elements and the second plurality of elements;
generating a regular expression comprising at least;
the common element, anda first matching pattern that (a) restricts the first variable element to a first data type, from a plurality of possible data types, and (b) matches the first variable element in both the first plurality of elements and the second plurality of elements; and
generating a log parser configured to parse logs based on the regular expression, wherein the method is performed by at least one device comprising a processor.
1 Assignment
0 Petitions
Accused Products
Abstract
Disclosed is a system, method, and computer program product for implementing a log analytics method and system that can configure, collect, and analyze log records in an efficient manner. An improved approach has been described to automatically generate a log parser by analysis of the line content of a log. In addition, an efficient approach has been described to extract key-value content from the log content.
-
Citations
20 Claims
-
1. A method comprising:
-
generating a mapping structure that maps a first plurality of elements of a first entry in a log to corresponding element types; analyzing a second plurality of elements of a second entry in the log, relative to the mapping structure, to identify at least; a common element that is identical in the first plurality of elements and the second plurality of elements, and a first variable element that varies between the first plurality of elements and the second plurality of elements; generating a regular expression comprising at least; the common element, and a first matching pattern that (a) restricts the first variable element to a first data type, from a plurality of possible data types, and (b) matches the first variable element in both the first plurality of elements and the second plurality of elements; and generating a log parser configured to parse logs based on the regular expression, wherein the method is performed by at least one device comprising a processor. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A non-transitory computer readable medium having stored thereon instructions which, when executed by one or more hardware processors, cause performance of operations comprising:
-
generating a mapping structure that maps a first plurality of elements of a first entry in a log to corresponding element types; analyzing a second plurality of elements of a second entry in the log, relative to the mapping structure, to identify at least; a common element that is identical in the first plurality of elements and the second plurality of elements, and a first variable element that varies between the first plurality of elements and the second plurality of elements; generating a regular expression comprising at least; the common element, and a first matching pattern that (a) restricts the first variable element to a first data type, from a plurality of possible data types, and (b) matches the first variable element in both the first plurality of elements and the second plurality of elements; and generating a log parser configured to parse logs based on the regular expression, wherein the method is performed by at least one device comprising a processor. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
-
15. A system, comprising:
-
at least one device including a hardware processor; the system being configured to perform operations comprising; generating a mapping structure that maps a first plurality of elements of a first entry in a log to corresponding element types; analyzing a second plurality of elements of a second entry in the log, relative to the mapping structure, to identify at least; a common element that is identical in the first plurality of elements and the second plurality of elements, and a first variable element that varies between the first plurality of elements and the second plurality of elements; generating a regular expression comprising at least; the common element, and a first matching pattern that (a) restricts the first variable element to a first data type, from a plurality of possible data types, and (b) matches the first variable element in both the first plurality of elements and the second plurality of elements; and generating a log parser configured to parse logs based on the regular expression, wherein the method is performed by at least one device comprising a processor. - View Dependent Claims (16, 17, 18, 19, 20)
-
Specification