Dynamic field extraction of data

Patent metadata

Field	Value
Publication number	US-10042834-B2
Application number	US-201514790189-A
Country	US
Kind code	B2
Filing date	Jul 2, 2015
Priority date	Mar 14, 2013
Publication date	Aug 7, 2018
Grant date	Aug 7, 2018

Abstract

A log analytics graphical user interface enables a user to dynamically extract and define a field from unstructured log data. The log analytics module automatically determines a definition for a field based on log text selected by the user. A portion of each log message is highlighted to reflect what the extracted field may be to assist users with understanding if input parameters are selected the intended log data. Changes to the definition of the field, by the user, may cause further highlighting that to indicate an incomplete or erroneous field definition.

First claim

What is claimed is:

1. A method for displaying a graphical user interface for analyzing unstructured data, the method comprising:
displaying a plurality of items of unstructured data, including a first item of unstructured data comprised of text;
receiving an indication to extract a field based on a specified portion of text of the first item;
generating, by operation of one or more processing units, a definition of the extracted field having (1) a pattern that matches the specified portion of the text, and (2) a context for the extracted field, wherein the context is determined based on the specified portion of the first item;
annotating a first portion of the text of the first item which matches the pattern; and
annotating a second portion of the text of the first item which matches the context.

2. The method of claim 1 , wherein receiving the indication to extract the field based on the specified portion of text of the first item further comprises receiving a text selection, from a user via the graphical user interface, which indicates the specified portion of text.

3. The method of claim 1 , wherein the pattern associated with the definition of the extracted field is a value type determined based on a match from a pre-determined list of regular expressions.

4. The method of claim 1 , wherein the context associated with the definition of the extracted field comprises a before pattern that matches a token of text before an instance of the extracted field and an after pattern that matches a token of text after the instance of the extracted field.

5. The method of claim 1 , wherein annotating of the first and second portions of the text of the first item comprises:
highlighting the first portion of the text using a first color; and
highlighting the second portion of the text using a second color, wherein the first color has different color intensity than the second color.

6. The method of claim 1 , further comprising:
annotating the plurality of items of unstructured data in the graphical user interface, such that for each of the plurality of items of unstructured data having an instance of the extracted field that satisfies the generated definition:
annotating a first portion of the item to indicate a match with the pattern of the extracted field associated with the item; and
annotating a second portion of the item, the second portion which matches with the context for the extracted field.

7. The method of claim 1 , further comprising:
receiving an indication that the context associated with the extracted field has been modified;
annotating the second portion of the first item to indicate an incomplete match with the modified context.

8. The method of claim 7 , wherein the annotating the second portion to indicate the incomplete match with the modified context further comprises:
determining the modified context partially matches a token of text adjacent to an instance of the extracted field that matches the pattern;
highlighting a portion of the token that matches the modified context with a first color; and
highlighting a remainder of the token with a second color, wherein the first color has a different color intensity than the second color.

9. A non-transitory computer readable storage medium having stored thereon computer software executable by a processor, the computer software embodying a method for displaying a graphical user interface for analyzing unstructured data, the method comprising:
displaying a plurality of items of unstructured data, including a first item of unstructured data comprised of text;
receiving an indication to extract a field based on a specified portion of text of the first item;
generating a definition of the extracted field having (1) a pattern that matches the specified portion of the text, and (2) a context for the extracted field, wherein the context is determined based on the specified portion of the first item;
annotating a first portion of the text of the first item which matches the pattern; and
annotating a second portion of the text of the first item which matches the context.

10. The non-transitory computer readable storage medium of claim 9 , wherein receiving the indication to extract the field based on the specified portion of text further comprises:
receiving a text selection, from a user via the graphical user interface, which indicates the specified portion of text.

11. The non-transitory computer readable storage medium of claim 9 , wherein the pattern associated with the definition of the extracted field is a value type determined based on a match from a pre-determined list of regular expressions.

12. The non-transitory computer readable storage medium of claim 9 , wherein the context associated with the definition of the extracted field comprises a before pattern that matches a token of text before an instance of the extracted field and an after pattern that matches a token of text after the instance of the extracted field.

13. The non-transitory computer readable storage medium of claim 9 , wherein annotating display of the first and second portions of text of the first item comprises:
annotating the first portion of the text using a first color; and
annotating the second portion of the text using a second color, wherein the first color has different color intensity than the second color.

14. The non-transitory computer readable storage medium of claim 9 , further comprising:
annotating the plurality of items of unstructured data in the graphical user interface:
for each of the plurality of items of unstructured data having an instance of the extracted field that satisfies the generated definition, annotating a first portion of the item to indicate a match with the pattern of the extracted field associated with the item and annotating a second portion of the item which matches the context for the extracted field.

15. The non-transitory computer readable storage medium of claim 9 , further comprising:
receiving an indication that the context associated with the extracted field has been modified; and
annotating the second portion of the first item to indicate an incomplete match with the modified context.

16. The non-transitory computer readable storage medium of claim 15 , wherein annotating the second portion to indicate the incomplete match with the modified context further comprises:
determining the modified context partially matches a token of text adjacent to an instance of the extracted field that matches the pattern;
annotating a portion of the token that matches the modified context with a first color; and
annotating a remainder of the token with a second color, wherein the first color has a different color intensity than the second color.

17. A computer system for displaying a graphical user interface for analyzing unstructured data for a computing environment, the computer system comprising:
a system memory;
a storage device having a plurality of items of unstructured data including a first item of unstructured data comprised of text; and
a processor programmed to carry out the steps of:
displaying the plurality of items of unstructured data;
receiving an indication to extract a field based on a specified portion of text of the first item;
generating a definition of the extracted field having (1) a pattern that matches the specified portion of the text, and (2) a context for the extracted field, wherein the context is determined based on the specified portion of the first item;
modifying display of a first portion of the text of the first item which matches the pa

Assignees

• Vmware Inc

Inventors

• Hinterbichler Erik
• Huang Chengdu
• Li Zhenmin
• Gery Ron Oded

Classifications

• G06F11/3476

  Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title

• G06F11/3072

  where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting · CPC title

• G06F17/40

  Data acquisition and logging (for input to computer G06F3/00) · CPC title

• G06F11/3452

  Performance evaluation by statistical analysis · CPC title

• G06F40/169 Primary

  Annotation, e.g. comment data or footnotes · CPC title