Systems and method for event parsing
First Claim
Patent Images
1. A system, comprising:
- a non-transitory memory; and
one or more hardware processors configured to read instructions from the non-transitory memory to perform operations comprising;
receiving a plurality of events from one or more network monitoring systems, wherein each event of the plurality of events comprises a message output by a network monitoring system of the one or more network monitoring systems that communicates a status of a network resource connected to a network;
normalizing the plurality of events comprising removing punctuation, unnecessary words or characters, or both, from the plurality of events to generate a plurality of normalized events;
clustering similar events of the plurality of normalized events into one or more normalized event clusters;
after clustering the similar events into the one or more normalized event clusters;
extracting an event template for each of the one or more normalized event clusters, wherein the event template comprises boiler plate language included in the message of one or more of the similar events and a placeholder for a character string; and
extracting a regular expression (regex) for each of the one or more normalized event clusters that, when searched, returns the character string;
automatically grouping the plurality of events into one or more groups of events, wherein each group of events comprises one or more events of the plurality of events having identical extracted regexes or similar extracted regexes; and
outputting the one or more groups of events.
1 Assignment
0 Petitions
Accused Products
Abstract
A system includes a non-transitory memory and a hardware processors configured to perform operations including receiving a plurality of events from one or more network monitoring systems, wherein each event includes a message output by a network monitoring system communicating a status of a network resource connected to a network, clustering similar events into one or more event clusters, extracting an event template for each event cluster, extracting a regular expression (regex) for each event cluster, grouping the events into one or more groups of events having the same or similar extracted regexes, and outputting the one or more groups of events.
-
Citations
20 Claims
-
1. A system, comprising:
-
a non-transitory memory; and one or more hardware processors configured to read instructions from the non-transitory memory to perform operations comprising; receiving a plurality of events from one or more network monitoring systems, wherein each event of the plurality of events comprises a message output by a network monitoring system of the one or more network monitoring systems that communicates a status of a network resource connected to a network; normalizing the plurality of events comprising removing punctuation, unnecessary words or characters, or both, from the plurality of events to generate a plurality of normalized events; clustering similar events of the plurality of normalized events into one or more normalized event clusters; after clustering the similar events into the one or more normalized event clusters; extracting an event template for each of the one or more normalized event clusters, wherein the event template comprises boiler plate language included in the message of one or more of the similar events and a placeholder for a character string; and extracting a regular expression (regex) for each of the one or more normalized event clusters that, when searched, returns the character string; automatically grouping the plurality of events into one or more groups of events, wherein each group of events comprises one or more events of the plurality of events having identical extracted regexes or similar extracted regexes; and outputting the one or more groups of events. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A system, comprising:
-
a plurality of external network monitors, each configured to monitor and to output event data corresponding to performance of one or more resources connected to a network; an application server having a memory and a processor configured to execute instructions stored within the memory; and an application instance that executes on the application server, wherein the application instance is configured to receive the event data via a web service API, store the event data in an events database, and process the event data stored in the events database, wherein the application instance comprises an events processor configured to; retrieve a plurality of events from the event data stored in the events database; normalize the plurality of events comprising removing punctuation, unnecessary words or characters, or both, from the plurality of events to generate a plurality of normalized events; cluster similar events of the plurality of normalized events into one or more normalized event clusters; after clustering the similar events into the one or more normalized event clusters; extract an event template for each of the one or more normalized event clusters, wherein the event template comprises boiler plate language included in the event data of one or more of the similar events and a placeholder for a character string; and extract a regular expression (regex) for each of the one or more normalized event clusters that, when searched, returns the character string; automatically group the plurality of events into one or more groups of events, wherein each group of events comprises one or more events of the plurality of events having identical extracted regexes or similar extracted regexes; and output the one or more groups of events to an alerts database. - View Dependent Claims (9, 10, 11, 12, 13, 14, 15)
-
-
16. A method, comprising:
-
receiving a plurality of events from one or more network monitoring systems, wherein each event of the plurality of events comprises a message output by a network monitoring system of the one or more network monitoring systems that communicates a status of a network resource connected to a network; normalizing the plurality of events comprising removing punctuation, unnecessary words or characters, or both, from the plurality of events to generate a plurality of normalized events; clustering similar events of the plurality of normalized events into one or more normalized event clusters; after clustering the similar events into the one or more normalized event clusters; extracting an event template for each of the one or more normalized event clusters, wherein the event template comprises boiler plate language included in the message of one or more of the similar events and a placeholder for a character string; and extracting a regular expression (regex) for each of the one or more normalized event clusters that, when searched, returns the character string; automatically grouping the plurality of events into one or more groups of events, wherein each group of events comprises one or more events of the plurality of events having identical extracted regexes or similar extracted regexes; and outputting the one or more groups of events to an alerts database. - View Dependent Claims (17, 18, 19, 20)
-
Specification