A sampling-based approach to accelerating queries in log management systems
Tal Wagner, Eric Schkufza, Udi Wieder · 2016
Log management systems are common in industry and an essential part of a system administrator’s toolkit. Examples include Splunk, elk, Log Insight, Sexilog, and more. Logs in these systems are characterized by a small number of predefined fields such as timestamp and host, with the bulk of an entry being unstructured text. System administrators query these logs using a combination of range constraints over predefined fields and patterns or regular expressions over the text portion of the message. These queries are both complex and diverse.