METHODS AND SYSTEMS FOR CONSTRUCTING AN ONTOLOGY OF LOG MESSAGES WITH NAVIGATION AND KNOWLEDGE TRANSFER

1 . A computer-implemented method for constructing a navigable ontology of products. applications, and event types of log messages associated with a system running in a data center, the method comprising:

retrieving from data storage a mapping of applications to products executing in the data center and log messages that correspond to the applications for a user-selected time frame;

constructing a tiered ontology based on the products, applications, and event types of the log messages, the ontology representing how the log messages are distributed across the products, applications, and event types: and

displaying the ontology as a navigable flow map in a graphical user interface (“GUI”) on a display device, the flow map visually representing a distribution of the log messages across products and applications and enabling a user to select particular event types of the log messages for visual inspection.

2 . The method of claim I wherein constructing the tiered ontology comprises:

using regular expressions to extract parametric and non-parametric tokens from the log messages; and

discarding the parametric token to obtain non-parametric tokens that reveal the event types of the log messages.

3 . The method of claim 1 wherein constructing the tiered ontology comprises:

generating a heatmap of the event types of the log messages recorded in time windows of the user-selected time frame; and

classifying the event types as rare, regular, and frequent based on the heatmap.

4 . The method of claim 1 wherein constructing the tiered ontology comprises:

for each log message.

embedding non-parametric tokens of the log message into a word vectors, and

combining the word vectors to form a log vector that represents the log message in an embedding space:

using support vector machines to create classification models that classify the log vectors as corresponding to the products; and

applying the classification models to the log vectors to classify the corresponding log message as corresponding to the products.

5 . The method of claim 1 wherein enabling the user to select particular event types of the log messages for visual inspection comprises filtering event types for non-parametric selected via the GUI.

6 . A computer system constructing a navigable ontology of products, applications, and event types of log messages associated with a system running in a data center, the system comprising:

one or more processors;

one or more data storage devices; and

machine-readable instructions stored in the one or more data storage devices of the computer system that when executed using the one or more processors controls the computer system to perform operations comprising:

retrieving from the one or more data storage devices a mapping of applications to products executing in the data center and log messages that correspond to the applications for a user-selected time frame:

constructing a tiered ontology based on the products, applications, and event types of the log messages, the ontology representing how the log messages are distributed across the products, applications, and event types: and

displaying the ontology as a navigable flow map in a graphical user interface (“GUI”) of a display device, the flow map visually representing a distribution of the log messages across products and applications and enabling a user to select particular event types of the log messages for visual inspection.

7 . The system of claim 6 wherein constructing the tiered ontology comprises:

using regular expressions to extract parametric and non-parametric tokens from the log messages; and

discarding the parametric token to obtain non-parametric tokens that reveal the event types of the log messages.

8 . The system of claim 6 wherein constructing the tiered ontology comprises: generating a heatmap of the event types of the log messages recorded in time windows of the user-selected time frame; and

classifying the event types as rare, regular, and frequent based on the heatmap.

9 . The system of claim 6 wherein constructing the tiered ontology comprises:

for each log message,

embedding non-parametric tokens of the log message into a word vectors, and

combining the word vectors to form a log vector that represents the log message in an embedding space:

using support vector machines to create classification models that classify the log vectors as corresponding to the products; and

applying the classification models to the log vectors to classify the corresponding log message as corresponding to the products.

10 . The system of claim 6 wherein enabling the user to select particular event types of the log messages for visual inspection comprises filtering event types for non-parametric selected via the GUI.

11 . A non-transitory computer-readable medium encoded with machine-readable instructions for enabling one or more processors of a computer system to . . . in a data center by performing operations comprising:

retrieving from data storage a mapping of applications to products executing in the data center and log messages that correspond to the applications for a user-selected time frame;

constructing a tiered ontology based on the products, applications, and event types of the log messages, the ontology representing how the log messages are distributed across the products, applications, and event types; and

displaying the ontology as a navigable flow map in a graphical user interface (“GUI”) of a display device, the flow map visually representing a distribution of the log messages across products and applications and enabling a user to select particular event types of the log messages for visual inspection.

12 . The medium of claim 11 wherein constructing the tiered ontology comprises:

using regular expressions to extract parametric and non-parametric tokens from the log messages; and

discarding the parametric token to obtain non-parametric tokens that reveal the event types of the log messages.

13 . The medium of claim 11 wherein constructing the tiered ontology comprises:

generating a heatmap of the event types of the log messages recorded in time windows of the user-selected time frame; and

classifying the event types as rare. regular, and frequent based on the heatmap.

14 . The medium of claim 11 wherein constructing the tiered ontology comprises:

for each log message,

embedding non-parametric tokens of the log message into a word vectors, and

combining the word vectors to form a log vector that represents the log message in an embedding space:

using support vector machines to create classification models that classify the log vectors as corresponding to the products; and

applying the classification models to the log vectors to classify the corresponding log message as corresponding to the products.

15 . The medium of claim II wherein enabling the user to select particular event types of the log messages for visual inspection comprises filtering event types for non-parametric selected via the GUI.