Abstract: A log message classifier employs machine learning for identifying a corresponding parser for interpreting the incoming log message and for retraining a classification logic model processing the incoming log messages. Voluminous log messages generate a large amount of data, typically in a text form. Data fields are parseable from the message by a parser that knows a format of the message. The classification logic is trained by a set of messages having a known format for defining groups of messages recognizable by a corresponding parser. The classification logic is defined by a random forest that outputs a corresponding group and confidence value for each incoming message. Groups may be split to define new groups based on a recurring matching tail (latter portion) of the incoming messages. A trend of decreased confidence scores triggers a periodic retraining of the random forest, and may also generate an alert to operators.

Abstract: Classification for data intake operations in an enterprise ensures that sensitive data is not disseminated inappropriately, but incurs substantial time, effort and expense. A method of classifying data in a large set of data repositories captures a set of raw rules resulting from inputs indicative of evaluations and conclusions of data classification operations, typically by logging data classification operations, and identifies patterns in the set of raw rules by consolidating duplicative conditions and eliminating inconsequential conditions. External conditions and observations may be referenced for applying a context to the rules based on a usage or domain of the data, and data sets of disparate entities may be examined for anonymizing the data and combining with other sets of anonymized data.

Abstract: A data gathering and query method for collecting ongoing updates to large, unstructured databases performing data collection from multiple sites. A large repository of unstructured or semi-structured data according to a JSON syntax receives periodic updates from an enterprise site for gathered event data. A bigdata cloud store receives the additions as columnar parts that arrange the data in a columnar form for storing similarly named fields consecutively. The enterprise site generating the event data arranges the block files containing the columnar data, and header files containing metadata. Incremental time and/or size triggers the periodic part upload, and a query server in network communication with the cloud store integrates the incoming additions by receiving the header files and updating a catalog of collections in the cloud store, without downloading the larger block files containing the actual columnar data. Query requests operate on the cloud store without moving the block files.

Abstract: A query server performs method of generating a query result using an aggregation pipeline by identifying, based on a query, a sequence of operations to be applied to documents from an unstructured database, in which a portion of the operations are dependent on other operations in the sequence of operations. The pipeline determines, from the operations, lightweight and heavyweight operations, in which the heavyweight operations generate a materialized result have a substantial impact on processing resources. The pipeline defers the lightweight operations until a materialized result is needed, for performing with a corresponding heavyweight operation, in which the materialized result includes either creation of a new document or movement of substantial data from a document. Lightweight operations are grouped with heavyweight operations such that multiple operations can be collapsed into a single operation that act upon the data together thus avoiding the number of materializations.

Abstract: A system and method of storing data in an unstructured or semi-structured database, such as a JSON database, includes defining a columnar store, or hybrid column portion having a set of values for each field, such that each set stores a sequence of values from commonly named fields of each document together, and defining a hybrid store, or hybrid row portion having, for each document in the columnar store, a hybrid entry storing fields from the same document together, such that each entry in the hybrid store includes fields of a corresponding document represented in the columnar store. The hybrid arrangement provides that both the columnar store and the hybrid store are derived from the same set of documents, and each of the columnar store and the hybrid store are configured to fulfill a query request for determining whether to access the columnar store or the hybrid store.

Abstract: A query engine for an unstructured database satisfies window based queries and analytics by defining a window of documents, and performing analytics on the window using a default value for omitted field. A tabular index containing only values needed for analytics and document ordering defines each window. The tabular index includes all fields from each document that are required to satisfy the query, retrieved on a single pass by the query engine so that multiple fetches to the same document are avoided. Since each document in the window need not contain all the same fields as the other documents, an adapter includes logic for defining a default or placeholder value for a field called for in an analytic computation but nonexistent in a particular document. By retrieving only the computationally relevant fields, and by performing the retrieval only once on each document, the I/O overhead is greatly reduced.

Abstract: A tabular (relational) DB interface is responsive to SQL commands for accessing unstructured data bases. An application receives a relational data command or query and maps fields from the relational query to fields in an unstructured data store including documents arranged in a hierarchy and unbounded by fixed types or field lengths. The application generates field names by concatenating nested hierarchy field names to define unique “flat file” field names in a tabular form. The application generates a catalog defining the mapping which is used as metadata for accessing the unstructured data to satisfy the relational query. Use of the metadata avoids copying or translating the unstructured data store to a tabular form because the unstructured data collection remains unmodified, and is accessed via the catalog.