Systems and methods for proactive service health detection

1 . A system comprising:

a processor; and

a memory storing computer-executable instructions that, when executed by the processor, cause the processor to:

receive, by a centralized computing system, first data associated with a first application at a first time and second data associated with the first application at a second time;

determine an anomaly associated with the first application;

compare, by a first natural language processing model on the centralized computing system, the second data and the first data;

determine, by the first natural language processing model and based on the comparison, a first difference indicative that a portion of the first data is different than a portion of the second data;

train the first natural language processing model on the centralized computing system, and a second natural language processing model on an edge computing system based on the first difference;

receive, by the first natural language processing model, third data associated with the first application;

receive, by the second natural language processing model, fourth data associated with the first application, wherein the third data and fourth data are processed in parallel;

determine, by the second natural language processing model, that the first difference exists in the fourth data; and

automatically initiate a first action to prevent or mitigate a second anomaly associated with the first application.

2 . The system of claim 1 , wherein the first data and the third data are a same type of data, and wherein the first data and the third data are grouped based on being the same type of data.

3 . The system of claim 1 , wherein the computer-executable instructions further cause the processor to:

receive, by the centralized computing system, fifth data associated with the first application at the first time; and

group the first data and the fifth data based on the first data and the fifth data being received at the first time.

4 . The system of claim 3 , wherein the first data and the fifth data are a different type of data.

5 . The system of claim 1 , wherein the first data, second data, third data, and fourth data are stored within an access log or a developer log.

6 . The system of claim 5 , wherein determining that the first difference exists in the fourth data further comprises extracting, by the second natural language processing model, text from the access log or developer log.

7 . The system of claim 1 , wherein the first action comprises at least one of: generating an alert, sending a shutdown or restart command, and increasing a capacity of a micro-service.

8 . A method comprising:

receiving, by a first computing system, a first log and a second log associated with a first application at a first time and a third log associated with the first application at a second time;

grouping, by the first computing system, the first log and the second log based on the first log and the second log being received at the first time;

determining that an anomaly exists with the first application at the second time;

comparing, by a first natural language processing model on the first computing system, the third log and the first log;

determining, by the first natural language processing model and based on the comparison, a first difference indicative that a first type of data in the first log is different than the first type of data in the third log;

receiving, by the first natural language processing model, a fourth log associated with the first application;

receiving, by the first natural language processing model, a fifth log associated with the first application, wherein the fourth log and fifth log are processed in parallel;

determining, by the first natural language processing model, that the first difference also exists in the fourth log; and

automatically initiating a first action to prevent or mitigate a second anomaly associated with the first application, the first action including adding an additional container to increase capacity of a micro-service.

9 . The method of claim 8 , further comprising:

receiving a fifth log associated with the first application; and

determining, by a second natural language processing model on a second computing system, that the first difference also exists in the fifth log.

10 . The method of claim 9 , further comprising:

training both the first natural language processing model and the second natural language processing model based on determining the first difference.

11 . The method of claim 9 , wherein the first computing system is a centralized computing system and the second computing system is an edge computing system.

12 . The method of claim 8 , further comprising:

receiving a fifth log associated with the first application; and

grouping the fifth log and the first log based on the fifth log and the first log including a same type of data.

13 . The method of claim 8 , further comprising:

receiving, by a second computing system, a fifth log associated with a second application;

determining, by a second natural language processing model on the second computing system, that a second difference exists in the fifth log; and

automatically initiating a second action to prevent or mitigate a third anomaly associated with the second application, wherein determining, by the first computing system, that the first difference exists and determining, by the second computing system, that the second difference exists are performed in parallel.

14 . The method of claim 8 , wherein the first action includes automatically initiating a change to a computing system associated with the first application.

15 . A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a processor, cause the processor to perform operations of:

receiving, by a first computing system, a first log and a second log associated with a first application at a first time and a third log associated with the first application at a second time;

grouping, by the first computing system, the first log and the second log based on the first log and the second log being received at the first time;

determining that an anomaly exists with the first application at the second time;

comparing, by a first natural language processing model on the first computing system, the third log and the first log;

determining, by the first natural language processing model and based on the comparison, a first difference indicative that a first type of data in the first log is different than the first type of data in the third log;

receiving, by the first natural language processing model, a fourth log associated with the first application;

receiving, by the first natural language processing model, a fifth log associated with the first application, wherein the fourth log and fifth log are processed in parallel;

determining, by the first natural language processing model, that the first difference also exists in the fourth log; and

automatically initiating a first action to prevent or mitigate a second anomaly associated with the first application, the first action including adding an additional container to increase capacity of a micro-service.

16 . The non-transitory computer-readable medium of claim 15 , wherein the computer-executable instructions further cause the processor to perform operations of:

receiving a fifth log associated with the first application; and

determining, by a second natural language processing model on a second computing system, that the first difference also exists in the fifth log.

17 . The non-transitory computer-readable medium of claim 16 , wherein the computer-executable instructions further cause the processor to perform operations of:

training both the first natural language processing model and the second natural language processing model based on determining the first difference.

18 . The non-transitory computer-readable medium of claim 16 , wherein the first computing system is a centralized computing system and the second computing system is an edge computing system.

19 . The non-transitory computer-readable medium of claim 15 , wherein the computer-executable instructions further cause the processor to perform operations of:

receiving a fifth log associated with the first application; and

grouping the fifth log and the first log based on the fifth log and the first log including a same type of data.

20 . The non-transitory computer-readable medium of claim 15 , wherein the computer-executable instructions further cause the processor to perform operations of:

receiving, by a second computing system, a fifth log associated with a second application;

determining, by a second natural language processing model on the second computing system, that a second difference exists in the fifth log; and

automatically initiating a second action to prevent or mitigate a third anomaly associated with the second application, wherein determining, by the first computing system, that the first difference exists and determining, by the second computing system, that the second difference exists are performed in parallel.