# US 10,769,152 B2 · Automated log analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,152 B2 - Document ID: US10769152B2 - Status: Granted - Kind: B2 - Application number: 15/368,373 - Filed: 2016-12-02 - Published: 2018-06-07 - Granted: 2020-09-08 - Earliest claimed: 2016-12-02 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Xinyuan Huang; Manoj Sharma; Debojyoti Dutta - Web page: https://patentgrep.com/patent/US10769152B2 ## CPC - G06F 16/24568: {Data stream processing; Continuous queries} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract There is disclosed in an example a computer-implemented method of providing automated log analysis, including: receiving a log stream comprising a plurality of transaction log entries, the log entries comprising a time stamp, a component identification (ID), and a name value pair identifying a transaction; creating an index comprising mapping a key ID to a name value pair of a log entry; and selecting from the index a key ID having a relatively large number of repetitions. There is also disclosed an apparatus and computer-readable medium for performing the method. ## Claims ### Claim 1 A computer-implemented method of providing automated log analysis, the method comprising the steps of: receiving a log stream with a plurality of transaction log entries; pre-processing, by parsing and structuring, the plurality of transaction log entries to a name-value format, each of the plurality of transaction log entries including a time stamp, a component identification, and a name-value pair identifying a transaction, the name-value pair including a name field paired with a value field; before creating an index, filtering the plurality of transaction log entries to eliminate any false positives; when the plurality of transaction log entries include the name-value format per the pre-processing: creating the index of the plurality of transaction log entries, with a key identification (ID) mapped to the component identification of each of the plurality of transaction log entries, selecting, from the index, the key ID based on a number of repetitions of the key ID; and based on the selection of the key ID, building without a priori knowledge, a transaction model; and when the plurality of transaction log entries do not include the name-value format per the pre-processing, diverting or rejecting the plurality of transaction log entries. ### Claim 2 (depends on 1) The method of claim 1, wherein the filtering is performed if a same field value reappears with a same {component, field} pair after a time threshold. ### Claim 3 (depends on 1) The method of claim 1, wherein the filtering is performed if a value appearing with a {component, field} pair is shared among multiple components within a time threshold. ### Claim 4 (depends on 1) The method of claim 1, wherein, the pre-processing includes eliminating a field unlikely to be a meaningful transaction identifier, and the format is a set of {field name: field value} pairs. ### Claim 5 (depends on 4) The method of claim 4, wherein the field unlikely to be the transaction identifier is selected from the group consisting of a uniform resource locator (URL), media access control (MAC) address, a floating point value, a common English word, and an integer value below a threshold. ### Claim 6 (depends on 5) The method of claim 5, wherein the threshold is contextual. ### Claim 7 (depends on 1) The method of claim 1, further comprising: defining, via the transaction model, transaction tracking rules configured to track the plurality of transaction log entries based on key ID. ### Claim 8 A computing apparatus comprising: a log analysis engine comprising at least a processor and a memory, the log analysis engine configured to: receive a log stream with a plurality of transaction log entries; pre-process, by parsing and structuring, the plurality of transaction log entries to a name-value format, each of the plurality of transaction log entries including a time stamp, a component identification, and a name-value pair identifying a transaction, the name-value pair including a name field paired with a value field; before creation of an index, filter the plurality of transaction log entries to eliminate any false positives; when the plurality of transaction log entries include the name-value format per the pre-process: create the index of the plurality of transaction log entries, with a key identification (ID) mapped to the component identification of each of the plurality of transaction log entries, select, from the index, the key ID based on a number of repetitions; and based on the selection of the key ID, build without a priori knowledge, a transaction model; and when the plurality of transaction log entries do not include the name-value format per the pre-process, divert or reject the plurality of transaction log entries. ### Claim 9 (depends on 8) The apparatus of claim 8, wherein filtering of the plurality of transaction log entries is performed by the log analysis engine if a same field value reappears with a same {component, field} pair after a time threshold. ### Claim 10 (depends on 8) The apparatus of claim 8, wherein filtering of the plurality of transaction log entries is performed by the log analysis engine if a value appearing with a {component, field} pair is shared among multiple components within a time threshold. ### Claim 11 (depends on 8) The apparatus of claim 8, wherein, pre-processing of the plurality of transaction log entries includes eliminating a field unlikely to be a transaction identifier, and the format is a set of {field name: field value} pairs. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the field unlikely to be the transaction identifier is selected from the group consisting of a uniform resource locator (URL), media access control (MAC) address, a floating point value, a common English word, and an integer value below a threshold. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the threshold is contextual. ### Claim 14 (depends on 8) The apparatus of claim 8, wherein the log analysis engine is further configured to: define, via the transaction model, transaction tracking rules configured to track the plurality of transaction log entries based on key ID. ### Claim 15 One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions for instructing a processor to provide a log analysis engine configured to: receive a log stream with a plurality of transaction log entries; pre-process, by parsing and structuring, the plurality of transaction log entries to a name-value format, each of the plurality of transaction log entries including a time stamp, a component identification, and a name-value pair identifying a transaction, the name-value pair including a name field paired with a value field; before creation of an index, filter the plurality of transaction log entries to eliminate any false positives; when the plurality of transaction log entries include the name-value format per the pre-process: create the index of the plurality of transaction log entries, with a key identification (ID) mapped to the component identification of each of the plurality of transaction log entries, select, from the index, the key ID based on a number of repetitions; and based on the selection of the key ID, build without a priori knowledge, a transaction model; and when the plurality of transaction log entries do not include the name-value format per the pre-process, divert or reject the plurality of transaction log entries. ### Claim 16 (depends on 15) The one or more tangible, non-transitory computer-readable mediums of claim 15, wherein filtering of foe plurality of transaction log entries is performed by the log analysis engine if a same field value reappears with a same {component field} pair alter a time threshold. ### Claim 17 (depends on 15) The one or more tangible, non-transitory computer-readable mediums of claim 15, wherein filtering of foe plurality of transaction log entries is performed by the log analysis engine if a value appearing with a {component, field} pair is shared among multiple components within a time threshold. ### Claim 18 (depends on 15) The one or more tangible, non-transitory computer-readable mediums of claim 15, wherein, pre-processing of the plurality of transaction log entries includes eliminating a field unlikely to be a transaction identifier, and the format is a set of {field name: field value} pairs. ### Claim 19 (depends on 18) The one or more tangible, non-transitory computer-readable mediums of claim 18, wherein the field unlikely to be the transaction identifier is selected from the group consisting of a uniform resource locator (URL), media access control (MAC) address, a floating point value, a common English word, and an integer value below a threshold. ### Claim 20 (depends on 15) The one or more tangible, non-transitory computer-readable mediums of claim 15, further comprising instructions for instructing a processor to: define, via the transaction model, transaction tracking rules configured to track the plurality of transaction log entries based on key ID.