Clustering of structured log data by key schema

1. A system, comprising:

a processor configured to:

receive a raw log message, wherein at least a portion of the raw log message comprises structured machine data including a set of key-value pairs;

receive a map of keys to values;

use the received map of keys to values to determine a key schema of the structured machine data, wherein the key schema is associated with a corresponding cluster; and

associate the raw log message with the cluster corresponding to the determined key schema; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 wherein the key schema comprises a combination of keys is present in the set of key-value pairs included in the structured machine data.

3. The system recited in claim 2 wherein the combination of keys present in the set of key-value pairs included in the structured machine data is determined at least in part by using a parser to extract keys in the set of key-value pairs included in the structured machine data.

4. The system recited in claim 1 wherein the cluster is associated with a cluster identifier that is generated based at least in part on the key schema.

5. The system recited in claim 4 wherein the cluster identifier comprises a hash of the key schema.

6. The system recited in claim 1 wherein the raw log message comprises a first raw log message, and wherein the processor is further configured to:

receive a second raw log message; and

associate the second raw log message with a different cluster based at least in part on a determination that structured log information in the second raw log message has a different key schema.

7. The system recited in claim 1 wherein the determining of the key schema is performed in response to a request made, via a user interface, to apply an operator to cluster a set of raw log messages based on keys.

8. The system recited in claim 1 wherein the processor is further configured to present, via a user interface, an indication of the cluster.

9. The system recited in claim 8 wherein the processor is further configured to present, via the user interface, information pertaining to the cluster, the information comprising at least one of a number of log messages present in the cluster and an indication of keys present in the key schema corresponding to the cluster.

10. The system recited in claim 8 wherein the processor is further configured to present, via is the user interface, a link to a view of raw log messages in the cluster.

11. A method, comprising:

receiving a raw log message, wherein at least a portion of the raw log message comprises structured machine data including a set of key-value pairs;

receiving a map of keys to values;

using the received map of keys to values to determine a key schema of the structured machine data, wherein the key schema is associated with a corresponding cluster; and

associating the raw log message with the cluster corresponding to the determined key schema.

12. The method of claim 11 wherein the key schema comprises a combination of keys present in the set of key-value pairs included in the structured machine data.

13. The method of claim 12 wherein the combination of keys present in the set of key-value pairs included in the structured machine data is determined at least in part by using a parser to extract keys in the set of key-value pairs included in the structured machine data.

14. The method of claim 11 wherein the cluster is associated with a cluster identifier that is generated based at least in part on the key schema.

15. The method of claim 14 wherein the cluster identifier comprises a hash of the key schema.

16. The method of claim 11 wherein the raw log message comprises a first raw log message, and further comprising:

receiving a second raw log message; and

associating the second raw log message with a different cluster based at least in part on a determination that structured log information in the second raw log message has a different key schema.

17. The method of claim 11 wherein the determining of the key schema is performed in response to a request made, via a user interface, to apply an operator to cluster a set of raw log messages based on keys.

18. The method of claim 11 further comprising presenting, via a user interface, an indication is of the cluster.

19. The method of claim 18 further comprising presenting, via the user interface, information pertaining to the cluster, the information comprising at least one of a number of log messages present in the cluster and an indication of keys present in the key schema corresponding to the cluster.

20. The method of claim 18 further comprising presenting, via the user interface, a link to a view of raw log messages in the cluster.

21. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving a raw log message, wherein at least a portion of the raw log message comprises structured machine data including a set of key-value pairs;

receiving a map of keys to values;

using the received map of keys to values to determine a key schema of the structured machine data, wherein the key schema is associated with a corresponding cluster; and

associating the raw log message with the cluster corresponding to the determined key schema.