# US 12,117,967 B2 · Method and apparatus for parsing log data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,117,967 B2
- Document ID: US12117967B2
- Status: Granted
- Kind: B2
- Application number: 17/836,059
- Filed: 2022-06-09
- Published: 2023-02-09
- Granted: 2024-10-15
- Earliest claimed: 2021-08-06
- Assignees: Samsung Sds Co., Ltd.
- Applicants: Samsung Sds Co., Ltd.
- Inventors: Hee Suk Lee; Kyong Hyon Park; Young Do Kim
- Web page: https://patentgrep.com/patent/US12117967B2

## CPC

- G06F 16/1734: {Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs}
- G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method for parsing log data according to an embodiment of the present disclosure includes loading a plurality of unit logs identified by first parsing log data into a memory in a two-dimensional matrix, wherein the unit log includes a plurality of items and constitutes one row, determining a target item to be second parsed among the items loaded into the memory, dividing data of the target item into a plurality of sub-items by second parsing the data of the target item, among the items loaded into the memory in the two-dimensional matrix and storing a second parsing result including the plurality of sub-items.

## Claims

### Claim 1

A method for parsing log data performed by a computing device, the method comprising:
loading a plurality of unit logs identified by first-parsing log data in a two-dimensional matrix into a memory, wherein the log data comprises a plurality of raw unit logs, and each of the plurality of unit logs constitutes one row and comprises items that are parsed from a plurality of items of each of the plurality of raw unit logs;
determining a target item to be second-parsed among the items loaded into the memory;
dividing data of the target item into a plurality of sub-items by second-parsing the data of the target item, among the items loaded in the two-dimensional matrix into the memory; and
storing a second-parsing result including the plurality of sub-items,
wherein the loading of the plurality of unit logs in the two-dimensional matrix into the memory comprises:
identifying a log format that corresponds to a type of the log data, among pre-stored log formats that are different for each type of log data, wherein the log format provides an order and a definition of each item in a raw unit log of the log data;
determining at least one item that are indexed in the identified log format, the at least one item being a subset of a plurality of items included the raw unit log; and
first-parsing a unit log, including the indexed at least one item, and loading the unit log into the memory.

### Claim 2 (depends on 1)

The method for parsing log data of claim 1, wherein the dividing comprises:
identifying a range of columns to be second-parsed in the two-dimensional matrix; and
second-parsing the data of the target item included in the identified range of columns, in succession, from a first row to a last row of the two-dimensional matrix, wherein the second-parsing is performed using the data of the target item loaded into the memory.

### Claim 3 (depends on 1)

The method for parsing log data of claim 1, wherein the storing of the second-parsing result comprises merging and storing the plurality of sub-items and items that are not target items, in column units.

### Claim 4 (depends on 3)

The method for parsing log data of claim 3, wherein the storing of the second-parsing result comprises generating a separate file and recording the merged result in the separate file.

### Claim 5 (depends on 1)

The method for parsing log data of claim 1, further comprising:
determining whether Internet Protocol (IP) logging information including IP addresses of routing hops is included in the log data; and
in response to a determination that the IP logging information is included in the log data, removing a distinguisher for distinguishing the IP addresses from the IP logging information.

### Claim 6 (depends on 1)

The method for parsing log data of claim 1, wherein the target item is an item in which year, month, day and hour are recorded; and
the dividing of the data of the target item into the plurality of sub-items comprises dividing the item of the year, month, day and hour into two or more sub-items among a first sub-item for recording the year, a second sub-item for recording the month, a third sub-item for recording the day and a fourth sub-item for recording the hour.

### Claim 7 (depends on 1)

The method for parsing log data of claim 1, wherein the determining of the target item to be second-parsed comprises:
providing a user with one or more items capable of being second-parsed, among the items first-parsed and loaded into the memory; and
determining an item selected by the user from the provided one or more items, as the target item to be second-parsed.

### Claim 8

A computing device, comprising:
one or more processors;
a memory configured to load a computer program executed by the one or more processors; and
a storage configured to store the computer program,
wherein the computer program comprises instructions for performing operations of:
loading a plurality of unit logs identified by first-parsing log data in a two-dimensional matrix into the memory, wherein the log data comprises a plurality of raw unit logs, and each of the plurality of unit logs constitutes one row and comprises items that are parsed from a plurality of items of each of the plurality of raw unit logs;
determining a target item to be second-parsed among the items loaded into the memory;
dividing data of the target item into a plurality of sub-items by second-parsing the data of the target item, among the items loaded in the two-dimensional matrix into the memory; and
storing a second-parsing result including the plurality of sub-items,
wherein the loading of the plurality of unit logs in the two-dimensional matrix into the memory comprises:
identifying a log format that corresponds to a type of the log data, among pre-stored log formats that are different for each type of log data, wherein the log format provides an order and a definition of each item in a raw unit log of the log data;
determining at least one item that are indexed in the identified log format, the at least one item being a subset of a plurality of items included the raw unit log; and
first-parsing a unit log, including the indexed at least one item, and loading the unit log into the memory.

### Claim 9 (depends on 8)

The computing device of claim 8, wherein the operation of dividing comprises operations of:
identifying a range of columns to be second-parsed in the two-dimensional matrix; and
sequentially second-parsing data of the target item included in the identified range of columns from a first row to a last row of the two-dimensional matrix, wherein the second-parsing is performed using data of the target item loaded into the memory.

### Claim 10 (depends on 8)

The computing device of claim 8, wherein the operation of storing the second-parsing result comprises an operation of merging and storing the plurality of sub-items and items that are not target items, in column units.

### Claim 11 (depends on 10)

The computing device of claim 10, wherein the operation of storing the second-parsing result comprises an operation of generating a separate file and recording the merged result in the separate file.

### Claim 12 (depends on 8)

The computing device of claim 8, further comprising operations of:
determining whether Internet Protocol (IP) logging information including IP addresses of routing hops is included in the log data; and
in response to a determination that the IP logging information is included in the log data, removing a distinguisher for distinguishing the IP addresses from the IP logging information.

### Claim 13 (depends on 8)

The computing device of claim 8, wherein the target item is an item in which year, month, day and hour are recorded; and
an operation of dividing the data of the target item into the plurality of sub-items comprises an operation of dividing the item of the year, month, day and hour into two or more sub-items, among a first sub-item for recording the year, a second sub-item for recording the month, a third sub-item for recording the day and a fourth sub-item for recording the hour.

### Claim 14 (depends on 8)

The computing device of claim 8, wherein the operation of determining the target item to be second-parsed comprises operations of:
providing a user with one or more items capable of being second-parsed, among the items first-parsed and loaded into the memory; and
determining an item selected by the user from the provided one or more items, as the target item to be second-parsed.