Real-time log analysis service for integrating external event data with log data for use in root cause analysis

摘要

A real-time log analyzer (“RTLA”) network service obtains log data from host computers. The RTLA network service also obtains event data from external network services. A user interface (“UI”) associated with the RTLA network service retrieves the log data and the event data from the RTLA network service for a time period, and presents the log data and the event data for the time period together for use in analyzing the root cause of failures indicated in the log data. The UI can also provide functionality for defining the time period, selecting the hosts for which log data and event data is to be presented, specifying the type of log data and event data to be displayed or otherwise filtering the log and event data, displaying data from a trouble ticket system, defining and displaying annotations relating to the event data, and/or displaying a human-friendly description of the event data.