# US 10,311,043 B2 · Log query user interface

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,311,043 B2
- Document ID: US10311043B2
- Status: Granted
- Kind: B2
- Application number: 15/228,908
- Filed: 2016-08-04
- Published: 2018-02-08
- Granted: 2019-06-04
- Earliest claimed: 2016-08-04
- Assignees: New Relic, Inc.
- Applicants: New Relic, Inc.
- Inventors: Julian V. Giuca
- Web page: https://patentgrep.com/patent/US10311043B2

## CPC

- G06F 16/2365: {Ensuring data consistency and integrity}
- G06F 16/245: Query processing
- G06F 16/33: Querying
- G06F 16/332: Query formulation
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A series of graphical user interfaces allows a user to define rules for parsing unstructured and structured log data and generate an aggregate rule to identify events across multiple lines of one or more log files. A first graphical user interface allows a user to select a line from a log file under analysis, search for matching lines in the log file, define rules for parsing the log file, and tokenize attributes of the selected lines. A second user interface allows the user to aggregate defined rules so that messages may be correlated to identify events that occur across multiple lines.

## Claims

### Claim 1

A method, comprising:
displaying, in a user interface for querying a log file, a plurality of lines of one or more log files;
receiving, at the user interface, a selection of at least a first and a second of the plurality of displayed lines;
for each of the selected lines:
receiving, at a name input field, an input specifying a rule name associated with the selected line,
receiving, at a selection field, a selection of one or more attributes of the selected line,
responsive to the selection of each of the one or more attributes of the selected line:
displaying an attribute name input field in the user interface, the attribute name input field associated with the selected attribute, and
receiving an attribute name for each of the displayed attribute name input fields;
selecting, in a rules column of the user interface, a first rule and a second rule for parsing the log file, the first rule indicated by a first rule name associated with the first selected line and the second rule indicated by a second rule name associated with the second selected line;
linking, in an aggregated column of the user interface, the first rule and second rule by associating at least one attribute name associated with first rule with the second rule name;
creating an aggregate rule from the linked first rule and the second rule; and
executing a query of the log file using the aggregated rule.

### Claim 2 (depends on 1)

The method of claim 1, wherein the log file includes one or more lines from different applications.

### Claim 3 (depends on 1)

The method of claim 1, wherein the log file is generated from a rails application.

### Claim 4 (depends on 1)

The method of claim 1, wherein the log file includes one or more lines generated prior to defining the rules.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
displaying a search interface;
receiving, in a search field included in the search interface, an input specifying one or more regular expressions included in the selected line; and
displaying, in the search interface, one or more lines that include the one or more specified regular expressions.

### Claim 6 (depends on 1)

The method of claim 1, wherein the selected line includes structured data.

### Claim 7 (depends on 1)

The method of claim 1, further comprising displaying in each attribute name input field a token corresponding to each attribute of the selected line that includes structured data.

### Claim 8 (depends on 1)

The method of claim 1, further comprising associating a different visual indicator with each selected attribute.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
displaying one or more lines that include one or more of the selected attributes; and
associating the different visual indicators with each attribute of the displayed one or more lines that include the one or more selected attributes.

### Claim 10 (depends on 1)

The method of claim 1, wherein linking the first rule and the second rule comprises:
receiving a selection of one or more attributes of the first rule; and
linking the selected attributed of the first rule to the second rule.

### Claim 11

A non-transitory computer readable storage medium storing executable computer program instructions, the instructions when executed by a processor causing the processor to:
display, in a user interface for querying a log file, a plurality of lines of one or more log files;
receive, at the user interface, a selection of at least a first and a second of the plurality of displayed lines;
for each of the selected lines:
receive, at the user interface, an input specifying a rule name associated with the selected line,
receive, at a name input field, a selection of one or more attributes of the selected line,
responsive to the selection of each of the one or more attributes of the selected line:
display an attribute name input field in the user interface, the attribute name input field associated with the selected attribute, and
receive an attribute name for each of the displayed attribute name input fields;
select, in a rules column of the user interface, a first rule and a second rule for parsing the log file, the first rule indicated by a first rule name associated with the first selected line and the second rule indicated by a second rule name associated with the second selected line;
link, in an aggregated column of the user interface, the first rule and second rule by associating at least one attribute name associated with first rule with the second rule name;
create an aggregate rule from the linked first rule and the second rule; and
execute a query of the log file using the aggregated rule.

### Claim 12 (depends on 11)

The non-transitory computer readable storage medium of claim 11, wherein the log file includes one or more lines from different applications.

### Claim 13 (depends on 11)

The non-transitory computer readable storage medium of claim 11, wherein the log file is generated from a rails application.

### Claim 14 (depends on 11)

The non-transitory computer readable storage medium of claim 11, wherein the log file includes one or more lines generated prior to defining the rules.

### Claim 15 (depends on 11)

The non-transitory computer readable storage medium of claim 11, further comprising, the instructions when executed by the processor cause the processor to:
display a search interface;
receive, in a search field included in the search interface, an input specifying one or more regular expressions included in the selected line; and
display, in the search interface, one or more lines that include the one or more specified regular expressions.

### Claim 16 (depends on 11)

The non-transitory computer readable storage medium of claim 11, wherein the selected line includes structured data.

### Claim 17 (depends on 11)

The non-transitory computer readable storage medium of claim 11, further comprising, the instructions when executed by the processor cause the processor to display in each attribute name input field a token corresponding to each attribute of the selected line that includes structured data.

### Claim 18 (depends on 11)

The non-transitory computer readable storage medium of claim 11, further comprising, the instructions when executed by the processor cause the processor to associate a different visual indicator with each selected attribute.

### Claim 19 (depends on 18)

The non-transitory computer readable storage medium of claim 18, further comprising, the instructions when executed by the processor cause the processor to:
display one or more lines that include one or more of the selected attributes; and
associate the different visual indicators with each attribute of the displayed one or more lines that include the one or more selected attributes.

### Claim 20 (depends on 11)

The non-transitory computer readable storage medium of claim 11, wherein the instructions when executed by the processor cause the processor to link the first rule and the second rule comprises:
receiving a selection of one or more attributes of the first rule; and
linking the selected attributed of the first rule to the second rule.