Log filtering using log templates

A system comprising:

• a hardware processor;
• and
• a non-transitory storage medium storing instructions executable on the hardware processor to:
• compute scores for log templates, wherein a score computed for a respective log template of the log templates is based on characteristics of events relating to log entries represented by the respective log template;
• add, to a log templates collection, the log templates and the scores assigned to the log templates;
• receive a plurality of log entries for a plurality of components in a computing environment;
• produce, based on the log templates collection, a filtered collection of log entries by filtering the plurality of log entries based on matching the plurality of log entries to the of log templates collection, wherein the filtering comprises excluding, from the filtered collection of log entries, a first log entry of the plurality of log entries that is represented by a first log template assigned a score that fails to satisfy a usefulness criterion;
• and
• trigger a remediation action in the computing environment based on the filtered collection of log entries.

A method comprising:

• computing, by a system comprising a hardware processor, scores for a plurality of log templates mapped to log entries containing log data, wherein a score computed for a respective log template of the plurality of log templates is based on characteristics of events relating to log entries represented by the respective log template;
• populating, by the system, a log templates collection with entries containing the log templates and the scores assigned the log templates;
• receiving, by the system, a plurality of log entries for a plurality of components in a computing environment;
• filtering, by the system, the plurality of log entries to produce a filtered collection of log entries, wherein the filtering comprises:
• excluding, from the filtered collection of log entries, a first log entry of the plurality of log entries that is represented by a first log template in the log templates collection assigned a score that fails to satisfy a usefulness criterion, and
• adding, to the filtered collection of log entries, a second log entry of the plurality of log entries that is represented by a second log template in the log templates collection assigned a score that satisfies the usefulness criterion;
• and
• triggering, by the system, a remediation action in the computing environment based on the filtered collection of log entries.