Pattern Matching Framework for Log Analysis

• US 20120143893A1
• Filed: 12/01/2010
• Published: 06/07/2012
• Est. Priority Date: 12/01/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Abraham, Robin
• Granted Patent: US 9,400,733 B2
• Time in Patent Office: Days
• US Class Current: 707/769
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 16/2428 Query predicate definition using graphical user interfaces, including menus and forms G06F16/2423 takes precedence
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

A pattern matching framework for log analysis is described. In one or more implementations, one or more inputs are received via a user interface of a computing device that describe a filter pattern that specifies data that is to be matched and extracted from a log and a projection pattern that specifies how at least a portion of the data extracted using the filter pattern is to be output. A query is formed from the filter pattern and the projection pattern by the computing device that is configured to analyze the log.

Claims

1. A method comprising:

receiving one or more inputs via a user interface of a computing device describing a filter pattern that specifies data that is to be matched and extracted from a log and a projection pattern that specifies how at least a portion of the data extracted using the filter pattern is to be output; and

forming a query from the filter pattern and the projection pattern by the computing device that is configured to analyze the log.

2. A method as described in claim 1, wherein the user interface is configured as a graphical user interface that is configured to output one or more shapes via which a user may arrange to provide the inputs.

3. A method as described in claim 2, wherein:

the one or more shapes are configured to specify particular data for respective said blocks that is to be matched from the log; and

the arrangement of the shapes, one to another, is configured to specify an arrangement of the data in the log that is to be considered as a match of the filter pattern.

4. A method as described in claim 2, wherein:

the one or more shapes are configured to specify particular data for respective said blocks that is to be output from the data extracted from the log by the filter pattern; and

the arrangement of the shapes, one to another, is configured to specify an arrangement of the data in the data extracted from the log that is to be considered as a match of the projection pattern.

5. A method as described in claim 2, wherein the user interface is configured specify that values are to be bound to corresponding variables that are represented by respective said shapes.

6. A method as described in claim 1, wherein the specification by the projection pattern of how at least a portion of the data extracted using the filter pattern is to be output includes specification of whether the portion of the data is to be output.

7. A method as described in claim 1, wherein the user interface is configured to specify a number of occurrences of a match in the log of at least a portion of a respective said filter pattern or projection pattern for finding a match for the respective said filter pattern or projection pattern.

8. A method as described in claim 1, wherein the user interface is configured to specify separation of a number of lines in the log of respective portions of a respective said filter pattern or projection pattern for finding a match for the respective said filter pattern or projection pattern.

9. A method as described in claim 1, wherein the user interface is configured to define portions of a respective said filter pattern or projection pattern as separated by an undefined number of lines in the log for finding a match for the respective said filter pattern or projection pattern.

10. A method comprising:

outputting a user interface by a computing device that is configured to include a plurality of shapes, one or more of which are configurable to specify data to be represented by the shape and arranged in the user interface, one to another, to define a pattern of the data; and

forming a query by the computing device for one or more of the patterns defined by the arrangement of the plurality of shapes, one to another, and the data represented by the shapes, the query to be used to analyze a log.

11. A method as described in claim 10, wherein the one or more patterns include a filter pattern that specifies data that is to be matched and extracted from the log.

12. A method as described in claim 11, wherein the one or more patterns include a projection pattern that specifies how at least a portion of the data extracted using the filter pattern is to be output.

13. A method as described in claim 11, wherein the one or more patterns include a projection pattern that specifies whether at least a portion of the data extracted using the filter pattern is to be output.

14. A method as described in claim 10, wherein the user interface is configured to specify a number of occurrences of a match in the log of at least a portion of the pattern for finding a match for the pattern.

15. A method as described in claim 10, wherein the user interface is configured to specify separation of a number of lines in the log of portions of the pattern for finding a match for the pattern.

16. A method as described in claim 10, wherein the user interface is configured to define portions of the pattern as separated by an undefined number of lines in the log for finding a match for the pattern.

17. A method comprising:

receiving a query at a computing device, the query including a filter pattern and a projection pattern, each of the filter pattern and the projection pattern defined by;

data represented by a plurality of shapes; and

arrangement of one or more of the plurality of shapes in a user interface, one to another; and

analyzing a log by the computing device using the query, the analyzing including;

extracting data from the log that matches the filter pattern; and

outputting the extracted data that matches the projection pattern.

18. A method as described in claim 17, wherein the filter pattern or the projection pattern is configured to specify a number of occurrences of a match in the log of at least a portion of a respective said filter pattern or projection pattern for finding a match for the respective said filter pattern or projection pattern.

19. A method as described in claim 17, wherein the filter pattern or the projection pattern is configured to specify separation of a number of lines in the log of respective portions of a respective said filter pattern or projection pattern for finding a match for the respective said filter pattern or projection pattern.

20. A method as described in claim 17, wherein the filter pattern or the projection pattern is configured to define portions of a respective said filter pattern or projection pattern as separated by an undefined number of lines in the log for finding a match for the respective said filter pattern or projection pattern.