Patent ID: 11971898
Assignee: ORACLE INTERNATIONAL CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 16:
17. A system comprising:
one or more devices, each including one or more hardware processors; and
the system being configured to perform operations comprising:
training a plurality of machine-learned classifiers to classify logs of unknown log types, using a set of training data comprising a plurality of logs of known log types, the plurality of machine-learned classifiers comprising at least:
(a) a first machine-learned classifier having a classifier type that is one of a distribution classifier, a token classifier, or a regular expression matching classifier; and
(b) a second machine-learned classifier that is of a different classifier type than the classifier type of the first machine-learned classifier;

obtaining, by a log analytics system, a log comprising raw log data produced by a target;
classifying, by the log analytics system, the log as being of a log type using the plurality of machine-learned classifiers based on at least a portion of the log, at least by;
determining a first score for classifying the log as being of the log type using the first machine-learned classifier;
determining a second score for classifying the log as being of the log type using the second machine-learned classifier;
determining an aggregate score for classifying the log as being of the log type, at least by:
(a) multiplying the first score by a first weight, to obtain a weighted first score;
(b) multiplying the second score by a second weight, to obtain a weighted second score; and
(c) computing the aggregate score as a function of at least the weighted first score and the weighted second score;

selecting, by the log analytics system, a parser from a plurality of parsers, based on the log type;
applying, by the log analytics system, the parser to the raw log data to generate processed log data;
storing, by the log analytics system, the processed log data into a first partition of a plurality of partitions of a first datastore.