Patent ID: 8620928

Claim:
A method of generating a log parser, the method comprising the steps of: a computer receiving a sample log whose parts are delimited by one or more occurrences of a delimiter in the sample log; the computer retrieving a plurality of tokens; the computer generating a tokenized log by delimiting the received sample log based on a token included in the retrieved plurality of tokens, the tokenized log comprising a plurality of elements, each element delimited in the tokenized log by the token; the computer determining one or more matches between respective one or more elements in the plurality of elements and respective one or more attributes, each attribute being an attribute of a field included in one or more fields of the sample log; based on the one or more matches and based on the token, the computer determining one or more positions of the respective one or more elements within the tokenized log; based on the one or more matches, the computer determining a ranking of the token, the ranking indicating a first likelihood that the token is the delimiter that delimits the parts of the sample log; the computer determining a second ranking of another token included in the retrieved plurality of tokens, the second ranking indicating a second likelihood that the other token is the delimiter; the computer determining the first likelihood is greater than the second likelihood; based on the one or more positions, the one or more matches, and the token, the computer generating a first parser by generating one or more parser patterns for the one or more matches, respectively; the computer generating a second parser based in part on the other token; the computer parsing the sample log based on the generated first parser; and based on the first likelihood being greater than the second likelihood, the computer presenting a result of the step of parsing the sample log and the computer receiving a validation of the presented result without the computer presenting another result of parsing the sample log based on the second parser.