Automatically generating a log parser given a sample log

A computer system comprising:

• a central processing unit (CPU);
• a memory coupled to the CPU;
• a computer-readable, tangible storage device coupled to the CPU, the storage device containing instructions that, when carried out by the CPU via the memory, implement a method of generating a log parser, the method comprising the steps of:
• the computer system receiving a sample log whose parts are delimited by one or more occurrences of a delimiter in the sample log;
• the computer system retrieving a plurality of tokens;
• the computer system generating a tokenized log by delimiting the received sample log based on a token included in the retrieved plurality of tokens, the tokenized log comprising a plurality of elements, each element delimited in the tokenized log by the token;
• the computer system determining one or more matches between respective one or more elements in the plurality of elements and respective one or more attributes, each attribute being an attribute of a field included in one or more fields of the sample log;
• based on the one or more matches and based on the token, the computer system determining one or more positions of the respective one or more elements within the tokenized log;
• based on the one or more matches, the computer system determining a ranking of the token, the ranking indicating a first likelihood that the token is the delimiter that delimits the parts of the sample log;
• the computer system determining a second ranking of another token included in the retrieved plurality of tokens, the second ranking indicating a second likelihood that the other token is the delimiter;
• the computer system determining the first likelihood is greater than the second likelihood;
• based on the one or more positions, the one or more matches, and the token, the computer system generating a first parser by generating one or more parser patterns for the one or more matches, respectively;
• the computer system generating a second parser based in part on the other token;
• the computer system parsing the sample log based on the generated first parser;
• and
• based on the first likelihood being greater than the second likelihood, the computer system presenting a result of the step of parsing the sample log and the computer system receiving a validation of the presented result without the computer system presenting another result of parsing the sample log based on the second parser.

A computer program product comprising:

• a computer-readable, tangible storage device;
• and
• computer-readable program instructions stored in the computer-readable, tangible storage device, the computer-readable program instructions, when carried out by a central processing unit (CPU) of a computer system, implement a method of generating a log parser, the method comprising the steps of:
• the computer system receiving a sample log whose parts are delimited by one or more occurrences of a delimiter in the sample log;
• the computer system retrieving a plurality of tokens;
• the computer system generating a tokenized log by delimiting the received sample log based on a token included in the retrieved plurality of tokens, the tokenized log comprising a plurality of elements, each element delimited in the tokenized log by the token;
• the computer system determining one or more matches between respective one or more elements in the plurality of elements and respective one or more attributes, each attribute being an attribute of a field included in one or more fields of the sample log;
• based on the one or more matches and based on the token, the computer system determining one or more positions of the respective one or more elements within the tokenized log;
• based on the one or more matches, the computer system determining a ranking of the token, the ranking indicating a first likelihood that the token is the delimiter that delimits the parts of the sample log;
• the computer system determining a second ranking of another token included in the retrieved plurality of tokens, the second ranking indicating a second likelihood that the other token is the delimiter;
• the computer system determining the first likelihood is greater than the second likelihood;
• based on the one or more positions, the one or more matches, and the token, the computer system generating a first parser by generating one or more parser patterns for the one or more matches, respectively;
• the computer system generating a second parser based in part on the other token;
• the computer system parsing the sample log based on the generated first parser;
• and
• based on the first likelihood being greater than the second likelihood, the computer system presenting a result of the step of parsing the sample log and the computer system receiving a validation of the presented result without the computer system presenting another result of parsing the sample log based on the second parser.

A process for supporting computing infrastructure, the process comprising:

• a first computer system providing at least one support service for at least one of creating, integrating, hosting, maintaining, and deploying computer-readable code in a second computer system, the computer-readable code containing instructions, wherein the instructions, when carried out by a processor of the second computer system, implement a method of generating a log parser, the method comprising the steps of:
• the second computer system receiving a sample log whose parts are delimited by one or more occurrences of a delimiter in the sample log;
• the second computer system retrieving a plurality of tokens;
• the second computer system generating a tokenized log by delimiting the received sample log based on a token included in the retrieved plurality of tokens, the tokenized log comprising a plurality of elements, each element delimited in the tokenized log by the token;
• the second computer system determining one or more matches between respective one or more elements in the plurality of elements and respective one or more attributes, each attribute being an attribute of a field included in one or more fields of the sample log;
• based on the one or more matches and based on the token, the second computer system determining one or more positions of the respective one or more elements within the tokenized log;
• based on the one or more matches, the second computer system determining a ranking of the token, the ranking indicating a first likelihood that the token is the delimiter that delimits the parts of the sample log;
• the second computer system determining a second ranking of another token included in the retrieved plurality of tokens, the second ranking indicating a second likelihood that the other token is the delimiter;
• the second computer system determining the first likelihood is greater than the second likelihood;
• based on the one or more positions, the one or more matches, and the token, the second computer system generating a first parser by generating one or more parser patterns for the one or more matches, respectively;
• the second computer system generating a second parser based in part on the other token;
• the second computer system parsing the sample log based on the generated first parser;
• and
• based on the first likelihood being greater than the second likelihood, the second computer system presenting a result of the step of parsing the sample log and the second computer system receiving a validation of the presented result without the second computer system presenting another result of parsing the sample log based on the second parser.