Abstract: In examples, a system adaptively orders a set of regular expressions based on frequencies that respective regular expressions of the set of regular expressions match a set of messages, the adaptive ordering to produce an adaptively ordered set of regular expressions. The system determines, for a first message of the set of messages, whether a plurality of regular expressions of the adaptively ordered set of regular expressions match the first message. The system constructs a bi-directional graph representing the plurality of regular expressions that match the first message, and classifies a second message based on the adaptively ordered set of regular expressions and the bi-directional graph.

Abstract: A probabilistic data structure may be queried to test whether text of a received log message is present in the probabilistic data structure. The representative log messages may be included in respective existing clusters are included in the probabilistic data structure. Based on whether the text is present, whether to create a new cluster for the received log message may be determined.

Abstract: In examples, a system adaptively orders a set of regular expressions based on frequencies that respective regular expressions of the set of regular expressions match a set of messages, the adaptive ordering to produce an adaptively ordered set of regular expressions. The system determines, for a first message of the set of messages, whether a plurality of regular expressions of the adaptively ordered set of regular expressions match the first message. The system constructs a bi-directional graph representing the plurality of regular expressions that match the first message, and classifies a second message based on the adaptively ordered set of regular expressions and the bi-directional graph.

Abstract: In examples, an apparatus comprises: a memory, and a processor coupled to the memory. The processor to: adaptively order an ordered set of regular expressions based on training messages to produce a set of adaptively ordered regular expressions having an adaptive order, determine a first of the adaptively ordered regular expressions that matches an additional message, and determine whether a second of the adaptively ordered regular expressions matches the additional message. Responsive to determining that the second of the other of the adaptively ordered regular expressions matches the additional message, the processor to: classify the additional message with the first regular expression if the first regular expression has a higher priority in the adaptive order; and classify the additional message with the second regular expression if the second regular expression has a higher priority in the adaptive order.

Abstract: In examples, an apparatus comprises: a memory, and a processor coupled to the memory. The processor to: adaptively order an ordered set of regular expressions based on training messages to produce a set of adaptively ordered regular expressions having an adaptive order, determine a first of the adaptively ordered regular expressions that matches an additional message, and determine whether a second of the adaptively ordered regular expressions matches the additional message. Responsive to determining that the second of the other of the adaptively ordered regular expressions matches the additional message, the processor to: classify the additional message with the first regular expression if the first regular expression has a higher priority in the adaptive order; and classify the additional message with the second regular expression if the second regular expression has a higher priority in the adaptive order.

Abstract: A probabilistic data structure may be queried to test whether text of a received log message is present in the probabilistic data structure. The representative log messages may be included in respective existing clusters are included in the probabilistic data structure. Based on whether the text is present, whether to create a new cluster for the received log message may be determined.