Log Event Search System Parsing Request Expressions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional log search methods are inadequate for retrieving sequences of associated log messages, limiting their effectiveness in log management and network troubleshooting.
Innovation Solution
A system that parses request expressions to identify dependencies and constraints between log events, forming query components to search for associated events within a searchable data structure, enabling quicker access and more interactive analysis of log data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If conventional search approaches using an index are used, then individual log messages can be retrieved, but groups of associated log messages cannot be retrieved
Solution Approach 1:
The patent segments the search process into multiple components: parsing the request expression to identify event types and constraints, forming separate query components for individual events and their interrelations, and executing these components against the index. This segmentation enables retrieval of associated log messages by breaking down the complex search task into manageable parts that can be processed systematically.
Solution Approach 2:
The patent introduces an intermediary processing layer between the conventional index and the search query. This intermediary parses the request expression, identifies dependencies between events, forms query components expressing constraints and interrelations, and then executes the search. This intermediary enables the system to handle complex associated message retrieval that the conventional index alone cannot support.
2Reliability
If log search is performed to identify individual log messages, then compliance goals can be achieved, but the ability to retrieve sequences of associated events is limited
Solution Approach 1:
The patent performs preliminary action by parsing the request expression before executing the search. The system identifies event types, dependencies, and constraints in advance, forming query components that express interrelations between events. This preliminary analysis enables more efficient retrieval of associated events by preparing the search strategy beforehand, reducing the time needed to analyze log sequences during incident response.
3Ease of operation
If conventional index-based search is used, then simple queries can be executed, but interactive analysis of log data is not automated
Solution Approach 1:
The patent implements self-service by automating the log analysis process. The system automatically parses request expressions, identifies event dependencies, forms query components, and executes searches without requiring manual intervention. This automation maintains ease of operation for users while significantly increasing the extent of automation in log analysis, allowing the system to serve itself in processing and analyzing log data.
Data Source
AI summary
To retrieve a sequence of associated events in log data, a request expression is parsed to retrieve types of dependencies between events which are searched, and the constraints (e.g., keywords) which characterize each event. Based on the parsing results, query components can be formed, expressing the constraints for individual events and interrelations (e.g., time spans) between events. A resultant span query comprising the query components can then be run against an index of events, which encodes a mutual location of associated events in storage.