Abstract: Exemplary methods, apparatuses, and systems for parsing unstructured data with a plurality of pattern matching rules are disclosed. An optimized pattern matching rule for one or more respective pattern matching rules is derived from an original pattern matching rule. The optimized pattern matching rule includes an extracted text string from the respective pattern matching rule or a less complex pattern match than the respective pattern matching rule. If the extracted text string or pattern is determined to match any of the data to be parsed, application of the original pattern matching rule is bypassed. The original pattern matching rule is applied when the one or more optimized pattern matching rules match the data.

Abstract: Exemplary methods, apparatuses, and systems parse data with a plurality of pattern matching rules. Pattern matching rules are applied in an ordered sequence and a first rule is applied to the data before a second rule is applied to the data. In response to determining the second rule matches the data the second rule is determined to match the data and the sequence is reordered to apply the second rule prior to the first rule.

Abstract: Exemplary methods, apparatuses, and systems receive data as input to be parsed. The data is parsed using a plurality of pattern matching rules, the plurality of pattern matching rules organized according to a hierarchy including a parent rule and one or more child rules of the parent rule. Parsing includes applying the parent rule to the unstructured data, determining the parent rule is unable to find a pattern match in the unstructured data, and bypassing the application of each child rule to the unstructured data in response to the determination that the parent rule is unable to find a pattern match.

Abstract: A log analytics graphical user interface enables a user to dynamically extract and define a field from unstructured log data. The log analytics module automatically determines a definition for a field based on log text selected by the user. A portion of each log message is highlighted to reflect what the extracted field may be to assist users with understanding if input parameters are selected the intended log data. Changes to the definition of the field, by the user, may cause further highlighting that to indicate an incomplete or erroneous field definition.

Abstract: A method of automated diagnosis of a distributed system having a plurality of computing systems hosting replicated applications thereon is provided. The method includes deriving at least one diagnosis model correlating first metrics relating to a first application instance on a first one of the plurality of computing systems to a state of a system health indicator of the first application instance; determining whether the at least one diagnosis model is sufficiently accurate based on a probability of a predicted system health state of the first application instance given the first metrics and an actual system health state of the first application instance; and upon the determining that the at least one diagnosis model is sufficiently accurate, transferring the at least one diagnosis model to a second one of the plurality of computing systems for diagnosis of a second application instance on the second computing system that is a replicate of the first application instance.

Abstract: A method for diagnosing system health with system event logs is provided. The method includes receiving a plurality of event logs and health indicator states from a system; transducing the plurality of event logs into numeric-based metrics of the system; and deriving, based on the transduced numeric-based metrics, at least one model of the system that correlates the plurality of event logs to the corresponding health indicator states.