Storing log data as events and performing a search on the log data and data obtained from a real-time monitoring environment
First Claim
Patent Images
1. A computer-implemented method, comprising:
- obtaining log data generated by at least one component in an information processing environment and reflecting activity in the information processing environment;
obtaining data that is not log data from a real-time monitoring environment;
storing at least a subset of the log data in a searchable time series data store as a plurality of events, wherein each event includes at least a portion of the log data and is associated with a time stamp extracted from the log data;
storing the data that is not log data obtained from the real-time monitoring environment in the searchable time series data store;
receiving a search query that includes search criteria identifying a relationship between the log data and the data that is not log data obtained from the real-time monitoring environment; and
executing the search query to identify the log data and the data that is not log data obtained from the real-time monitoring environment that meet the search criteria.
1 Assignment
0 Petitions
Accused Products
Abstract
Methods and apparatus consistent with the invention provide the ability to organize, index, search, and present time series data based on searches. Time series data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity. In one embodiment, time series data is stored as discrete events time stamps. A search is received and relevant event information is retrieved based in whole or in part on the time stamp, a keyword indexing mechanism, or statistical indices calculated at the time of the search.
-
Citations
30 Claims
-
1. A computer-implemented method, comprising:
-
obtaining log data generated by at least one component in an information processing environment and reflecting activity in the information processing environment; obtaining data that is not log data from a real-time monitoring environment; storing at least a subset of the log data in a searchable time series data store as a plurality of events, wherein each event includes at least a portion of the log data and is associated with a time stamp extracted from the log data; storing the data that is not log data obtained from the real-time monitoring environment in the searchable time series data store; receiving a search query that includes search criteria identifying a relationship between the log data and the data that is not log data obtained from the real-time monitoring environment; and executing the search query to identify the log data and the data that is not log data obtained from the real-time monitoring environment that meet the search criteria. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28)
-
-
29. A system comprising:
-
a memory; and a processing device coupled with the memory to; obtain log data generated by at least one component in an information processing environment and reflecting activity in the information processing environment, obtain data that is not log data from a real-time monitoring environment, store at least a subset of the log data in a searchable time series data store as a plurality of events, wherein each event includes at least a portion of the log data and is associated with a time stamp extracted from the log data, store the data that is not log data obtained from the real-time monitoring environment in the searchable time series data store, receive a search query that includes search criteria identifying a relationship between the log data and the data that is not log data obtained from the real-time monitoring environment, and execute the search query to identify the log data and the data that is not log data obtained from the real-time monitoring environment that meet the search criteria.
-
-
30. A non-transitory computer-readable medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to:
-
obtain log data generated by at least one component in an information processing environment and reflecting activity in the information processing environment; obtain data that is not log data from a real-time monitoring environment; store at least a subset of the log data in a searchable time series data store as a plurality of events;
wherein each event includes at least a portion of the log data and is associated with a time stamp extracted from the log data;store the data that is not log data obtained from the real-time monitoring environment in the searchable time series data store; receive a search query that includes search criteria identifying a relationship between the log data and the data that is not log data obtained from the real-time monitoring environment; and execute the search query to identify the log data and the data that is not log data obtained from the real-time monitoring environment that meet the search criteria.
-
Specification