Implementing large language models to extract customized insights from log data

1 . A method comprising:

ingesting raw log data output by a plurality of data shippers associated with a computer system;

ingesting domain-specific data applicable to the computer system, wherein the domain-specific data is stored on a domain-specific database;

preprocessing the raw log data by abbreviating well-known domain-specific terms within the raw log data, wherein the well-known domain-specific terms are identified in the domain-specific data;

storing the preprocessed log data on an index search database in communication with an engine comprising a large language model, wherein the index search database is independent of the domain-specific database;

causing the engine to execute the large language model to assess the preprocessed log data stored on the index search database in view of the domain-specific data to provide a sentiment classification to a first log event within the preprocessed log data;

receiving from the engine a first sentiment classification for a first log event within the preprocessed log data;

storing the first log event with the first sentiment classification on the index search database.

2 . The method of claim 1 , wherein the first sentiment classification for the first log event comprises one of:

an indication the first log event is a negative event for the computer system;

an indication the first log event is a neutral event for the computer system; or

an indication the first log event is a positive event for the computer system.

3 . The method of claim 1 , wherein preprocessing the raw log data further comprises amending the raw log data to reduce one or more of a storage requirement or a processor requirement for assessing the raw log data.

4 . The method of claim 1 , wherein preprocessing the raw log data further comprises:

abbreviating one or more terms in the log data;

substituting a large length identifier in the log data with a shorter length identifier; and

suppressing duplicate information identified in the log data.

5 . The method of claim 1 , wherein the domain-specific data comprises an indication of an appropriate sentiment classification for an event type identified in the preprocessed log data.

6 . The method of claim 1 , further comprising:

causing the engine to execute the large language model to assess the preprocessed log data in view of the domain-specific data to identify an anomaly in the preprocessed log data; and

receiving from the engine a notification applicable to the anomaly identified in the preprocessed log data, wherein the notification comprises a sentiment classification for the anomaly.

7 . The method of claim 1 , further comprising:

causing the engine to execute the large language model to assess the preprocessed log data in view of the domain-specific data to identify two or more correlated events in the preprocessed log data; and

receiving from the engine a notification applicable to the two or more correlated events identified in the preprocessed log data, wherein the notification comprises a sentiment classification for the two or more correlated events.

8 . The method of claim 1 , wherein the raw log data comprises one or more of system logs, application logs, security logs, web server logs, database logs, network logs, or audit logs.

9 . The method of claim 1 , wherein the engine is an artificial intelligence 9 . and/or machine learning engine.

10 . The method of claim 1 , further comprising generating a notification relating to the first sentiment classification for the first log event, and wherein the notification comprises:

a plaintext notification explaining the first log event; and

the sentiment classification for the first log event, wherein the sentiment classification comprises one of a neutral sentiment classification, a negative sentiment classification, or a positive sentiment classification.

11 . The method of claim 10 , wherein generating the notification comprises causing the engine to execute the generating utilizing a large language model algorithm.

12 . The method of claim 1 , further comprising storing the raw log data on an archive database, wherein the archive database is independent of the computer system, and wherein the archive database is further independent of a domain-specific database storing the domain-specific data.

13 . The method of claim 1 , wherein the first log event indicates that a file writing sequence has failed; and

wherein the engine applies a negative sentiment classification to the first log event.

14 . The method of claim 1 , wherein the first log event indicates that a hardware component of the computer system should undergo routine servicing; and

wherein the engine applies a neutral sentiment classification to the first log event.

15 . The method of claim 1 , wherein the first log event indicates that a hardware component of the computer system has undergone a state change and is now operating in an online or functional state; and

wherein the engine applies a positive sentiment classification to the first log event.

16 . The method of claim 1 , wherein the first log event indicates that a hardware component of the computer system has undergone a state change and is now non-operational due to being in an offline or non-functional state; and

wherein the engine applies a negative sentiment classification to the first log event.

17 . Non-transitory computer readable storage medium storing instructions to be executed by one or more processors, the instructions comprising:

ingesting raw log data output by a plurality of data shippers associated with a computer system;

ingesting domain-specific data applicable to the computer system, wherein the domain-specific data is stored on a domain-specific database;

preprocessing the raw log data by abbreviating well-known domain-specific terms within the raw log data, wherein the well-known domain-specific terms are identified in the domain-specific data;

storing the preprocessed log data on an index search database in communication with an engine comprising a large language model, wherein the index search database is independent of the domain-specific database;

causing the engine to execute the large language model to assess the preprocessed log data stored on the index search database in view of the domain-specific data to provide a sentiment classification to a first log event within the preprocessed log data;

receiving from the engine a first sentiment classification for a first log event within the preprocessed log data;

storing the first log event with the first sentiment classification on the index search database.

18 . The non-transitory computer readable storage medium of claim 17 , wherein the first sentiment classification for the first log event comprises one of:

an indication the first log event is a negative event for the computer system;

an indication the first log event is a neutral event for the computer system; or

an indication the first log event is a positive event for the computer system.

19 . The non-transitory computer readable storage medium of claim 17 , wherein the instructions are such that preprocessing the raw log data further comprises prior to providing the log data to the engine, wherein preprocessing the log data comprises amending the raw log data to reduce one or more of a storage requirement or a processor requirement for assessing the raw log data.

20 . The non-transitory computer readable storage medium of claim 17 , wherein the instructions are such that preprocessing the raw log data further comprises:

abbreviating one or more terms in the log data;

substituting a large length identifier in the log data with a shorter length identifier; or

suppressing duplicate information identified in the log data.