Searching for associated events in log data
First Claim
Patent Images
1. A computer-implemented method, comprising:
- receiving, by a processor, a query searching for associated events in log data, the associated events being multiple events that are related to one another by a common component;
parsing the received query, including;
locating a reserved term from the received query;
identifying an intermediate component of the received query, the intermediate component including a portion of the received query that is located after the reserved term; and
identifying a final component of the received query, the final component including a portion of the received query preceding the reserved term, wherein the reserved term comprises a term indicating that the intermediate component constrains a variable in the final component;
forming an intermediate query for the intermediate component, including constructing a first search term for the intermediate component, the first search term explicitly indicating one or more first keywords that appeared in the intermediate component of the received query;
performing the intermediate query, including determining, using the intermediate query, one or more second keywords, each second keyword satisfying the search term in the intermediate query;
forming a final query for the final component, including constructing a second search term for the final component, the second search term explicitly indicates the one or more second keywords resulted from performing the intermediate query;
merging a result of performing the intermediate query and a result of performing the final query; and
designating the merged results as the associated events in response to the received query,wherein the method is performed by one or more computers.
15 Assignments
0 Petitions
Accused Products
Abstract
To retrieve a sequence of associated events in log data, a request expression is parsed to retrieve types of dependencies between events which are searched, and the constraints (e.g., keywords) which characterize each event. Based on the parsing results, query components can be formed, expressing the constraints for individual events and interrelations (e.g., time spans) between events. A resultant span query comprising the query components can then be run against an index of events, which encodes a mutual location of associated events in storage.
-
Citations
18 Claims
-
1. A computer-implemented method, comprising:
-
receiving, by a processor, a query searching for associated events in log data, the associated events being multiple events that are related to one another by a common component; parsing the received query, including; locating a reserved term from the received query; identifying an intermediate component of the received query, the intermediate component including a portion of the received query that is located after the reserved term; and identifying a final component of the received query, the final component including a portion of the received query preceding the reserved term, wherein the reserved term comprises a term indicating that the intermediate component constrains a variable in the final component; forming an intermediate query for the intermediate component, including constructing a first search term for the intermediate component, the first search term explicitly indicating one or more first keywords that appeared in the intermediate component of the received query; performing the intermediate query, including determining, using the intermediate query, one or more second keywords, each second keyword satisfying the search term in the intermediate query; forming a final query for the final component, including constructing a second search term for the final component, the second search term explicitly indicates the one or more second keywords resulted from performing the intermediate query; merging a result of performing the intermediate query and a result of performing the final query; and designating the merged results as the associated events in response to the received query, wherein the method is performed by one or more computers. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A system comprising:
-
a storage device operable for storing one or more events as log messages; and a processor coupled to the storage device and configured to perform operations comprising; receiving a query searching for associated events in log data, the associated events being multiple events that are related to one another by a common component; parsing the received query, including; locating a reserved term from the received query; identifying an intermediate component of the received query, the intermediate component including a portion of the received query that is located after the reserved term; and identifying a final component of the received query, the final component including a portion of the received query preceding the reserved term, wherein the reserved term comprises a term indicating that the intermediate component constrains a variable in the final component; forming an intermediate query for the intermediate component, including constructing a first search term for the intermediate component, the first search term explicitly indicating one or more first keywords that appeared in the intermediate component of the received query; performing the intermediate query, including determining, using the intermediate query, one or more second keywords, each second keyword satisfying the first search term in the intermediate query; forming a final query for the final component, including constructing a second search term for the final component, the second search term explicitly indicates the one or more second keywords resulted from performing the intermediate query; merging a result of performing the intermediate query and a result of performing the final query; and designating the merged results as the associated events in response to the received query. - View Dependent Claims (8, 9, 10, 11, 12)
-
-
13. A non-transitory storage device storing instructions operable to cause one or more computers to perform operations comprising:
receiving a query searching for associated events in log data, the associated events being multiple events that are related to one another by a common component; parsing the received query, including; locating a reserved term from the received query; identifying a portion of the received query that is located after the reserved term; identifying a final component of the received query, the final component including a portion of the received query preceding the reserved term, wherein the reserved term comprises a term indicating that the intermediate component constrains a variable in the final component; forming an intermediate query for the intermediate component, including constructing a first search term for the intermediate component, the first search term explicitly indicating one or more first keywords that appeared in the intermediate component of the received query; performing the intermediate query, including determining, using the intermediate query, one or more second keywords, each second keyword satisfying the first search term in the intermediate query; forming a final query for the final component, including constructing a second search term for the final component, the second search term explicitly indicates the one or more second keywords resulted from performing the intermediate query; merging a result of performing the intermediate query and a result of performing the final query; and designating the merged results as the associated events in response to the received query. - View Dependent Claims (14, 15, 16, 17, 18)
Specification