Log query user interface
AssigneeNew Relic, Inc.
InventorJulian V. Giuca
Life of this patent
Estimating the term…
Abstract
A series of graphical user interfaces allows a user to define rules for parsing unstructured and structured log data and generate an aggregate rule to identify events across multiple lines of one or more log files. A first graphical user interface allows a user to select a line from a log file under analysis, search for matching lines in the log file, define rules for parsing the log file, and tokenize attributes of the selected lines. A second user interface allows the user to aggregate defined rules so that messages may be correlated to identify events that occur across multiple lines.
Claims20
A method, comprising:
- displaying, in a user interface for querying a log file, a plurality of lines of one or more log files;
- receiving, at the user interface, a selection of at least a first and a second of the plurality of displayed lines;
- for each of the selected lines:
- receiving, at a name input field, an input specifying a rule name associated with the selected line,
- receiving, at a selection field, a selection of one or more attributes of the selected line,
- responsive to the selection of each of the one or more attributes of the selected line:
- displaying an attribute name input field in the user interface, the attribute name input field associated with the selected attribute, and
- receiving an attribute name for each of the displayed attribute name input fields;
- selecting, in a rules column of the user interface, a first rule and a second rule for parsing the log file, the first rule indicated by a first rule name associated with the first selected line and the second rule indicated by a second rule name associated with the second selected line;
- linking, in an aggregated column of the user interface, the first rule and second rule by associating at least one attribute name associated with first rule with the second rule name;
- creating an aggregate rule from the linked first rule and the second rule;
- and
- executing a query of the log file using the aggregated rule.
A non-transitory computer readable storage medium storing executable computer program instructions, the instructions when executed by a processor causing the processor to:
- display, in a user interface for querying a log file, a plurality of lines of one or more log files;
- receive, at the user interface, a selection of at least a first and a second of the plurality of displayed lines;
- for each of the selected lines:
- receive, at the user interface, an input specifying a rule name associated with the selected line,
- receive, at a name input field, a selection of one or more attributes of the selected line,
- responsive to the selection of each of the one or more attributes of the selected line:
- display an attribute name input field in the user interface, the attribute name input field associated with the selected attribute, and
- receive an attribute name for each of the displayed attribute name input fields;
- select, in a rules column of the user interface, a first rule and a second rule for parsing the log file, the first rule indicated by a first rule name associated with the first selected line and the second rule indicated by a second rule name associated with the second selected line;
- link, in an aggregated column of the user interface, the first rule and second rule by associating at least one attribute name associated with first rule with the second rule name;
- create an aggregate rule from the linked first rule and the second rule;
- and
- execute a query of the log file using the aggregated rule.
Dependencies are inferred from the claim text.