Method and system for implementing target model configuration metadata for a log analytics system

One or more machine readable media storing instructions which, when executed by one or more processors, cause:

• receiving, via a log configuration interface of a log analytics system configured to perform log analytics for a plurality of targets in a network, (a) first user input indicating a target type, and (b) second user input indicating a log source;
• wherein the log source represents a location of log data and comprises a file pattern including a fixed part and a variable part;
• generating, by the log analytics system based on the first user input and the second user input, a log collection configuration that indicates the target type and the log source;
• responsive to determining that a first target, of the plurality of targets, is associated with the target type:
• associating the log collection configuration with the first target;
• responsive to associating the log collection configuration with the first target:
• replacing the variable part of the file pattern, associated with the log collection configuration, with first metadata associated with a first target property of the first target to generate a first file path indicating a first location of first log data associated with the first target;
• generating first target-side configuration content comprising the first file path;
• responsive to determining that a second target, of the plurality of targets, is associated with the target type:
• associating the log collection configuration with the second target;
• responsive to associating the log collection configuration with the second target:
• replacing the variable part of the file pattern, associated with the log collection configuration, with second metadata associated with a second target property of the second target to generate a second file path indicating a second location of second log data associated with the second target;
• generating second target-side configuration content comprising the second file path;
• distributing, by the log analytics system, the first target-side configuration content to a first agent associated with the first target and the second target-side configuration content to a second agent associated with the second target;
• receiving, by the log analytics system from the first agent, the first log data captured for the first target at the first location indicated by the first file path;
• receiving, by the log analytics system from the second agent, the second log data captured for the second target at the second location indicated by the second file path;
• and
• storing, by the log analytics system, the first log data and the second log data.

A system comprising:

• at least one device including a hardware processor;
• the system being configured to perform operations comprising:
• receiving, via a log configuration interface of a log analytics system configured to perform log analytics for a plurality of targets in a network, (a) first user input indicating a target type, and (b) second user input indicating a log source;
• wherein the log source represents a location of log data and comprises a file pattern including a fixed part and a variable part;
• generating, by the log analytics system based on the first user input and the second user input, a log collection configuration that indicates the target type and the log source;
• responsive to determining that a first target, of the plurality of targets, is associated with the target type:
• associating the log collection configuration with the first target;
• responsive to associating the log collection configuration with the first target:
• replacing the variable part of the file pattern, associated with the log collection configuration, with first metadata associated with a first target property of the first target to generate a first file path indicating a first location of first log data associated with the first target;
• generating first target-side configuration content comprising the first file path;
• responsive to determining that a second target, of the plurality of targets, is associated with the target type:
• associating the log collection configuration with the second target;
• responsive to associating the log collection configuration with the second target:
• replacing the variable part of the file pattern, associated with the log collection configuration, with second metadata associated with a second target property of the second target to generate a second file path indicating a second location of second log data associated with the second target;
• generating second target-side configuration content comprising the second file path;
• distributing, by the log analytics system, the first target-side configuration content to a first agent associated with the first target and the second target-side configuration content to a second agent associated with the second target;
• receiving, by the log analytics system from the first agent, the first log data captured for the first target at the first location indicated by the first file path;
• receiving, by the log analytics system from the second agent, the second log data captured for the second target at the second location indicated by the second file path;
• and
• storing, by the log analytics system, the first log data and the second log data.