Context-Based Event Log Enrichment With Batched Lookup Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional querying of enrichment services for event logs is resource-intensive due to a large volume of enrichment lookup requests when multiple values are extracted, leading to inefficiencies.
Innovation Solution
A context-based enrichment system that extracts values and contexts from event logs, sends concurrent requests to multiple enrichment servers, and inserts enrichment information back into logs based on context, allowing parallel processing and customized enrichment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If individual enrichment lookup requests are made for each extracted value from logs, then enrichment information can be retrieved for all values, but the volume of requests becomes large and resource consumption increases
Solution Approach 1:
The patent combines multiple individual enrichment requests into a single batch request. Instead of querying enrichment services for each extracted value separately, the system aggregates all extracted values into one request, thereby reducing the total number of requests while maintaining complete enrichment information retrieval.
Solution Approach 2:
The enrichment service is designed to handle multiple values simultaneously through a universal request interface. The system sends a single request that can process multiple extracted values (such as user identifiers, IP addresses, etc.) and receives comprehensive enrichment information for all values in one operation.
2Loss of information
If individual enrichment lookup requests are made for each extracted value from logs, then enrichment can be performed comprehensively, but the number of requests becomes large leading to inefficiency
Solution Approach 1:
Multiple enrichment requests are merged into a single batch request that processes all extracted values simultaneously. This consolidation maintains enrichment completeness while dramatically improving processing efficiency by reducing the number of round trips to the enrichment service.
Solution Approach 2:
The system performs preliminary extraction and aggregation of all values from logs before sending the enrichment request. By preparing the complete list of extracted values in advance and sending them as a single batch, the system optimizes the enrichment process and avoids the inefficiency of sequential individual requests.
3Loss of information
If conventional per-value enrichment querying is used, then all values can be enriched, but the querying process becomes resource intensive
Solution Approach 1:
The patent merges multiple individual querying operations into a single consolidated enrichment request. This approach maintains the ability to enrich all extracted values while simplifying the querying process from multiple complex sequential requests to one streamlined batch operation.
Data Source
AI summary
Efficient context-based event log enrichment is disclosed, including: extracting a set of values and corresponding contexts from a plurality of event logs; sending respective enrichment requests that each includes the set of values to a set of enrichment target servers; receiving respective enrichment responses from at least a portion of the set of enrichment target servers; and inserting at least a portion of the respective enrichment responses into a portion of the plurality of event logs based at least in part on the corresponding contexts of the set of values.