METHOD AND SYSTEM FOR IMPLEMENTING A LOG PARSER IN A LOG ANALYTICS SYSTEM

摘要

Disclosed is a system, method, and computer program product for implementing a log analytics method and system that can configure, collect, and analyze log records in an efficient manner. An improved approach has been described to automatically generate a log parser by analysis of the line content of a log. In addition, an efficient approach has been described to extract key-value content from the log content.

主权项

1. A method implemented with a processor, comprising:
identifying a log to analyze; creating a mapping structure that maps contents of the log to identified element types for one or more data portions within the log; selecting a data portion from the log; analyzing the data portion relative to the mapping structure to identify variable parts and non-variable parts; for at least one of the variable parts, assigning the at least one variable part to a least restrictive data type that encompasses a variability of values detected in the at least one variable part; and automatically generating a regular expression for the non-variable parts with placeholders for the variable parts to implement a log parser, wherein at least two different placeholders are associated with different data types.