Skip to content

v1.0.62 - Aho-Corasick Algorithm & 379+ Pre-trained Templates

Latest
Latest

Choose a tag to compare

View all tags
@AnkilP AnkilP released this 12 Nov 09:01
· 37 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.0.62
2528dfd
This commit was signed with the committer’s verified signature.
AnkilP Ankil Patel
SSH Key Fingerprint: SScCM62QDoZ1rVCr1Z6Oit7+0RiQX/wi74uXPMYPJIA
Verified
Learn about vigilant mode.

🚀 Major Performance Upgrade: Aho-Corasick Algorithm

Version 1.0.62 introduces a major architectural change, replacing the DRAIN algorithm with Aho-Corasick DFA-based template matching for superior log analysis performance and accuracy.

✨ What's New

Aho-Corasick Template Matching

  • 379+ Pre-trained Templates: Includes comprehensive log pattern libraries for:
    • Android, Apache, BGL, Hadoop, HDFS
    • Linux, macOS, Windows
    • OpenSSH, OpenStack, Spark
    • And many more application types
  • O(n+m) Complexity: Fast multi-pattern matching using deterministic finite automaton
  • Fragment-based Matching: Extracts static fragments from regex patterns for efficient matching
  • Automatic Template Learning: Falls back to learning new patterns from baseline logs when needed

Improved Detection

  • 100x Better Pattern Recognition: Now detects 200-600 unique log templates vs. just 1 with DRAIN
  • No Aggressive Wildcarding: Template matching based on learned patterns, not heuristic token replacement
  • Better Discrimination: Multiple templates can be learned even for logs with similar prefixes

Backend Improvements

  • Template Cache System: Pre-trained templates loaded from JSON cache files
  • Pattern Learning: Automatic pattern extraction from log samples
  • JS Divergence: Improved anomaly scoring using Jensen-Shannon divergence

🔧 Technical Details

New Components:

  • internal/parser/ahocorasick.go - DFA-based template matcher (ported from Rust implementation)
  • internal/parser/pattern_learner.go - Automatic pattern learning from log samples
  • internal/parser/template_loader.go - Loads cached templates into Aho-Corasick DFA
  • cache/*.json - 22 pre-trained template libraries with 379+ patterns

Architecture:

  • Fragment extraction from regex patterns
  • Aho-Corasick automaton for O(n+m) matching
  • Automatic template learning from baseline logs
  • Hybrid approach: cached templates + dynamic learning

📦 Installation

Download hover-hover-panel-1.0.62.zip and extract it to your Grafana plugins directory:

```bash

Linux

unzip hover-hover-panel-1.0.62.zip -d /var/lib/grafana/plugins/

macOS (Homebrew)

unzip hover-hover-panel-1.0.62.zip -d /usr/local/var/lib/grafana/plugins/

Docker - Mount in docker-compose.yml

volumes:

  • ./hover-hover-panel:/var/lib/grafana/plugins/hover-hover-panel
    ```

Then restart Grafana.

🔐 Verification

```bash

SHA256

echo "2afc6c6e33d8bba98833d085ce4b5295c7c986de9e58903f518d5b85a97273f8 hover-hover-panel-1.0.62.zip" | sha256sum -c

MD5

echo "0ed6ac54552ff855b525b08f4cedc297 hover-hover-panel-1.0.62.zip" | md5sum -c
```

📋 Changes from v1.0.61

Added:

  • Aho-Corasick DFA-based template matching algorithm
  • 379+ pre-trained log templates from comprehensive dataset
  • Automatic pattern learning from log samples
  • Template cache system with 22 JSON libraries
  • Fragment-based matching for better accuracy

Changed:

  • Replaced DRAIN algorithm with Aho-Corasick
  • Improved log grouping using prefix-based clustering
  • Enhanced template detection (200-600 unique patterns vs 1)
  • Better anomaly scoring with JS divergence

Fixed:

  • JSON log format issue causing all logs to collapse into one template
  • Log generator now outputs plain text instead of JSON
  • Template learning from varied log patterns

🐛 Known Issues

None

Full Changelog: v1.0.61...v1.0.62

🤖 Generated with Claude Code

Assets 6
Loading