Patent ID: 11921571
Assignee: KONINKLIJKE PHILIPS N.V.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 9:
10. A log pattern analysis device, comprising:
an electronic processor; and
a non-transitory computer-readable medium storing instructions readable and executable by the electronic processor to:
perform a retrieval constraint generation method operating on historical log data comprising log events which are time stamped and which are defined by values for the set of fields, the retrieval constraint generation method comprising:
normalizing selected fields of the set of fields in the log pattern to generate at least one normalized log pattern item wherein the selected fields do not include the one or more filter fields;
identifying matching normalized log events that match the at least one normalized log pattern item in normalized log data wherein the normalized log data are generated from the historical log data by normalizing the selected fields in the historical log data; and
generating at least one additional constraint from values of the one or more filter fields in the matching normalized log events; and

perform a log pattern analysis method by applying a log pattern to log data undergoing analysis comprising log events which are time stamped and which are defined by values for a set of fields, wherein the log data undergoing analysis are stored on a server accessible by the at least one electronic processor via an electronic network, the log pattern analysis method comprising:
constructing a retrieval query to select log events that are in a time interval and that also satisfy the at least one additional constraint associated with the log pattern and defined on one or more filter fields of the set of fields;
downloading a sub-set of the log data undergoing analysis from the server to the at least one electronic processor via the electronic network, wherein the sub-set is selected from the log data undergoing analysis by the retrieval query;
applying the log pattern to the downloaded sub-set of the log data undergoing analysis to identify log pattern hits in the log data undergoing analysis; and
controlling a display screen to display a report of the log pattern hits in the log data undergoing analysis.