CLUSTER-BASED PROCESSING OF UNSTRUCTURED LOG MESSAGES

    公开(公告)号:US20180101423A1

    公开(公告)日:2018-04-12

    申请号:US15416571

    申请日:2017-01-26

    Abstract: Some embodiments relate to assigning individual log messages to clusters. An initial cluster assignment may be performed by applying a hash function to one or more non-variable components of the message to generate an initial cluster identifier. Subsequently, clustering may be further refined (e.g., by determining whether to merge clusters based on similarity values). An interface can present a representative message of each cluster and indicate which portions of the message correspond to a variable component. Particular inputs detected at the input corresponding to one of these components can cause other values for the component to be presented. For a given cluster, timestamps of assigned messages can be used to generate a time series, which can facilitate grouping of clusters (with similar or complementary shapes) and/or triggering alerts (with a condition corresponding to a temporal aspect).

    CORRELATION OF TIME SERIES SIGNALS USING SHAPE IDENTIFICATION VALUES

    公开(公告)号:US20240370348A1

    公开(公告)日:2024-11-07

    申请号:US18312813

    申请日:2023-05-05

    Abstract: Some embodiments relate to analyzing log records. A method may include determining a first shape identification value that characterizes a shape described by data points of a first time series signal that represents a time distribution of timestamps of a first plurality of messages. For each message among a second plurality of messages, the method may also include determining a shape identification value for the message that characterizes a shape described by data points of a corresponding time series signal that represents a time distribution of timestamps of a plurality of instances of the message. The method may further include determining that a shape identification value, from among the shape identification values for the second plurality of messages, is the same as the first shape identification value and, in response to the determining, providing information identifying the corresponding message to a user interface.

    Extracting and labeling custom information from log messages

    公开(公告)号:US11042525B2

    公开(公告)日:2021-06-22

    申请号:US15699529

    申请日:2017-09-08

    Abstract: A set of field values corresponding to a set of underlying fields are extracted from individual log messages. A space of potential values for underlying field(s) is identified. The space of potential values is segmented into value subspaces. Each value subspace is automatically associated with a category name. A definition for the new categorical field is generated, which indicates how a categorical value of the new categorical field depends on value(s) of the underlying field(s). For each log message, a categorical value is determined for the new categorical field based on the definition and the one or more values of the one or more underlying fields extracted from the log message. A presentation is generated that represents, for each log message, the particular category name corresponding to the categorical value determined for the log message.

    Cluster-based processing of unstructured log messages

    公开(公告)号:US10353756B2

    公开(公告)日:2019-07-16

    申请号:US15416571

    申请日:2017-01-26

    Abstract: Some embodiments relate to assigning individual log messages to clusters. An initial cluster assignment may be performed by applying a hash function to one or more non-variable components of the message to generate an initial cluster identifier. Subsequently, clustering may be further refined (e.g., by determining whether to merge clusters based on similarity values). An interface can present a representative message of each cluster and indicate which portions of the message correspond to a variable component. Particular inputs detected at the input corresponding to one of these components can cause other values for the component to be presented. For a given cluster, timestamps of assigned messages can be used to generate a time series, which can facilitate grouping of clusters (with similar or complementary shapes) and/or triggering alerts (with a condition corresponding to a temporal aspect).

Patent Agency Ranking