AUTOMATICALLY GENERATING REGULAR EXPRESSIONS FOR DATA FIELD EXTRACTIONS WITH NATURAL LANGUAGE EDITING

摘要

Embodiments are directed towards automatically generating extraction rules for extracting fields from event records. An extraction rule application receives field data describing the fields to be extracted (including one or more examples) and a collection of event records that may be a representative sample set from a larger set of events records. The extraction rule application generates extraction rules based on the event records and the field data. These extraction rules may be ranked using a determined quality score. Quality scores for extraction rules may be determined based on various metrics related to the operation of the extraction rules and the resultant extracted values. Preferred extraction rules may be determined by ranking the extraction rules based on their quality scores. Also, natural language expressions may be used to create, edit, or modify extraction rules.

主权项

1. A computer-implemented method comprising:
gathering, using a computing device, a stream of data; transforming the stream of data into a plurality of events, wherein each event includes a portion of the stream of data; associating a time stamp with each event of the plurality of events; storing the plurality of events and their associated time stamps; displaying a first event of the plurality of events; receiving a selection of a portion of text within the first event; determining a field extraction rule that extracts as a value of a field the selection of the portion of text within the first event when the field extraction rule is applied to the first event; displaying a second event of the plurality of events; and indicating, for the second event, a value of the field for the second event that would be extracted by applying the extraction rule to the second event.