Back to results
US 11,113,317 B2Granted
Generating parsing rules for log messages
AssigneeMicro Focus LLC
InventorsFernando Vizer, Ofra Pavlovitz, Eran Bentziony
Life of this patent
Estimating the term…
Abstract
A plurality of log messages may be clustered into a plurality of clusters. For each of the plurality of log messages, the log message may be partitioned into a series of substrings. At least two of the plurality of clusters may be selected. For each one of the at least two selected clusters, a parsing rule may be generated corresponding to a plurality of substrings each of which are at a given location of a respective one of the log messages of the plurality of log messages in the one of the selected cluster.
Claims21
A non-transitory computer-readable storage medium that stores instructions that, when executed by a processor, cause the processor to:
- cluster a plurality of log messages into a plurality of clusters, wherein the plurality of clusters includes a given cluster, and the given cluster includes a set of log messages of the plurality of log messages;
- partition the log messages of the set of log messages into a plurality of substrings;
- select the given cluster;
- select a subset of substrings from the plurality of substrings, wherein the selection of the subset of substrings comprises:
- for the given cluster, providing data to represent a recommendation of the subset of substrings for selection on a display, the recommendation being based on one or more of the substring being capable of being parsed if selected, an identity of one or more variables in the subset of substrings, the substring corresponding to a particular substring index, and the substring having at least a threshold length;
- and
- selecting the subset of substrings from the plurality of substrings based on a first user input;
- and
- based on the selected subset of substrings, generate a parsing rule for the plurality of substrings.
6 more elements
A system comprising:
- a processor;
- and
- a memory comprising instructions executable by the processor to:
- identify a plurality of log messages in a log message stream received from at least one device in a computer network;
- place the plurality of log messages into clusters, wherein the clusters include a given cluster, and the given cluster includes a set of log messages of the plurality of log messages;
- partition the log messages of the set of log messages into a plurality of substrings;
- select, in response to a first user input, the given cluster;
- select a subset of substrings of the plurality of substrings, each of the substrings in the log messages having a substring index representing a location of the respective substring in the log message stream, wherein the selection of the subset of substrings comprises:
- for the given cluster, comparing each subset of substrings corresponding to different substring indexes against a selected set of criteria to determine a given subset of substrings for recommendation to a user;
- for the given cluster, providing data to represent a recommendation of the given subset of substrings for selection on a display;
- and
- selecting the subset of substrings based on the first user input;
- and
- generate a parsing rule comprising a regular expression corresponding to the given cluster based on the selected subset of substrings.
11 more elements
A method comprising:
- by a processor:
- receiving a first set of log messages in a log message stream comprising a plurality of log messages;
- adding the first set of log messages to a plurality of clusters;
- for each log message of the first set of log messages, identifying substrings in the log message based on detection of at least one delimiter in the log message;
- for each cluster of the plurality of clusters, generating a parsing rule based on a plurality of substrings, wherein each substring of the plurality of substrings is at a selected location of a respective log message of the log messages in the cluster and has a substring index representing the selected location;
- determining a recommendation of the plurality of substrings for the each cluster based on a first user input, wherein, for each cluster, comparing each subset of substrings corresponding to different substring indexes against a selected set of criteria to determine a given subset of substrings for the recommendation;
- providing data to represent the recommendation for the each cluster for selection on a display;
- receiving a second set of log messages in the log message stream, the second set of log messages formatted in multiple formats;
- and
- parsing each log message of the second set of log messages according to the parsing rules.
7 more elements
Dependencies are inferred from the claim text.