Patent Document ID: 9892166
Application ID: 14510401
Patent Status: 1

Claim One:
1. A method by a log record processing computer comprising: receiving a log record as part of a stream of log records from a host machine node, the log record comprising terms; determining frequency of occurrence of the terms across the log records of the stream; based on the frequency of occurrence satisfying a defined frequency threshold: selecting a frequency partitioned Bloom filter vector from among a plurality of Bloom filter vectors in a repository based on the frequency; and updating the frequency partitioned Bloom filter vector in the repository based on the terms; storing an identifier for the log record associated with the frequency partitioned Bloom filter vector; and based on the frequency of occurrence not satisfying the defined frequency range: identifying a type identifier based on the terms; selecting a type identifier partitioned Bloom filter vector from among the plurality of Bloom filter vectors in the repository based on the type identifier; updating the type identifier partitioned Bloom filter vector in the repository based on the terms; storing an identifier for the log record associated with the type identifier partitioned Bloom filter vector; for each unique term contained in earlier log records received by the log record processing computer: counting a number of occurrences of the unique term to generate a historical count for the unique term; defining a frequency threshold based on the historical count; and storing the frequency threshold among a set of frequency thresholds with a logical association to the unique term; selecting frequency thresholds from among the set of frequency thresholds based on the terms of the log record; and determining whether the frequency of occurrence satisfies the defined frequency threshold based on comparing the frequency of occurrence of the terms to the frequency thresholds selected from among the set of frequency thresholds.