Searching for associated events in log data

摘要

To retrieve a sequence of associated events in log data, a request expression is parsed to retrieve types of dependencies between events which are searched, and the constraints (e.g., keywords) which characterize each event. Based on the parsing results, query components can be formed, expressing the constraints for individual events and interrelations (e.g., time spans) between events. A resultant span query comprising the query components can then be run against an index of events, which encodes a mutual location of associated events in storage.

主权项

1. A computer-implemented method, comprising:
receiving, by a processor, a query searching for associated events in log data, the associated events being multiple events that are related to one another by a common component; parsing the received query, including:
locating a reserved term from the received query;identifying an intermediate component of the received query, the intermediate component including a portion of the received query that is located after the reserved term; andidentifying a final component of the received query, the final component including a portion of the received query preceding the reserved term, wherein the reserved term comprises a term indicating that the intermediate component constrains a variable in the final component; forming an intermediate query for the intermediate component, including constructing a first search term for the intermediate component, the first search term explicitly indicating one or more first keywords that appeared in the intermediate component of the received query; performing the intermediate query, including determining, using the intermediate query, one or more second keywords, each second keyword satisfying the search term in the intermediate query; forming a final query for the final component, including constructing a second search term for the final component, the second search term explicitly indicates the one or more second keywords resulted from performing the intermediate query; merging a result of performing the intermediate query and a result of performing the final query; and designating the merged results as the associated events in response to the received query, wherein the method is performed by one or more computers.