Knowledge-guided system for automated event monitoring

Abstract

Automated event monitoring is performed utilizing a Knowledge Graph (KG) constructed by grouping and consolidation of a variety of log Entry Types. A log entry is received by a knowledge graph parser (Kg parser). That parser finds contiguous sub-strings in a log entry that have a parameterized basic-format. The parser figures out which basic-formats are present, where, and with which parameters. Given a sub-string, its basic-format and its parameters, the parser can correctly parse the sub-string to components (e.g., keys and values if a key-value format; fields if a structured format). A result of the parsing is an entity type tree structure. Next, a grouping and consolidation capability functions to modify the KG to incorporate an incoming new entry type structure. The KG may be consumed by a user (e.g., visualization; querying), and may provide an artifact to an event monitoring system to automatically trigger certain actions (e.g., alerts).