US Patent 11042525 Extracting and labeling custom information from log messages

A set of field values corresponding to a set of underlying fields are extracted from individual log messages. A space of potential values for underlying field(s) is identified. The space of potential values is segmented into value subspaces. Each value subspace is automatically associated with a category name. A definition for the new categorical field is generated, which indicates how a categorical value of the new categorical field depends on value(s) of the underlying field(s). For each log message, a categorical value is determined for the new categorical field based on the definition and the one or more values of the one or more underlying fields extracted from the log message. A presentation is generated that represents, for each log message, the particular category name corresponding to the categorical value determined for the log message.