DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This Non-Final Office Action is in response to the application 18/313,731 filed on 03/19/2026.
Status of Claims:
Claims 6, 9, 11, 16, and 19 are canceled in this Office Action.
Claims 1-3, 5, 12-15, and 20 are amended in this Office Action.
Claims 1-5, 7-8, 10, 12-15, and 17-18, and 20 are pending in this Office Action.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 03/19/2026 has been entered.
Response to Arguments
CLAIM REJECTIONS UNDER 35 U.S.C. § 103
Applicant’s arguments filed on 03/19/2026 (pages 8-11) regarding claim rejections under 35 U.S.C 103 have been fully considered. However, after further examination, new grounds of rejection are presented necessitated by applicant’s amendments.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-5, 7-10, 12-15, and 17-20 are rejected under 35 U.S.C. 103 as being unpatentable over Lion et al. (US PGPUB 20230195694) “Lion” in view of Ben-Natan et al. (US Patent 11144580) “Ben-Natan” and Amit et al. (US PGPUB 20140195499) “Amit”.
Regarding claim 1, Lion teaches computing system ([0040]) comprising: one or more processors; and one or more memory devices storing instructions executable by the one or more processors to cause the one or more processors to perform operations, the operations comprising: receiving, by an event processing system, a plurality of log statements ([0043] Log messages (log statements) may be generated by a program for various reasons. Log messages are often stored in files, such as text files. An example log file stores a series of log messages, one message per line of the file. Numerous other examples exist, such as log messages that span multiple lines…[0049]: Raw log data is processed without advanced knowledge of the format or content of the log messages… Examiner’s note: Thus, the log messages are received for processing); initiating, by the event processing system for each of the one or more servers, a first data compression model, wherein:(i) the first data compression model is configured to generate an intermediate representation of the plurality of log statements by parsing a log template and variables from the plurality of log statements ([0099]: Timestamp, if any, is parsed in the log message. A plurality of timestamps schemas may be applied to the log message to detect a timestamp. An identified timestamp may be converted into an integer representation, such as a Unix epoch timestamp...[0100]: Remainder of the log message is tokenized (an intermediate representation of the plurality of log statements) using a set of delimiters…[0101]: The tokens are analyzed to identify expressions of variables…[0104]: A log type is identified and log type may be the original log message without the timestamp and with numeric and non-numeric variable expressions replaced by placeholders. Placeholders may include an integer placeholder that serves double duty as a non-numeric expression placeholder and a floating-point placeholder that describes how to parse a representation of the floating-point number… Examiner’s note: Thus, an intermediate representation such as variables forming a log type is generated based on the input log message. The generation of log type/ intermediate representation of a log message is executed at the identify log type stage which is equivalent to a first data compression model); (ii) parsing the log template and variables comprises determining dictionary values, wherein the dictionary values are encoded and indexed within the format ([0105]: A log-type dictionary is referenced for the identified log type. A key or ID in the dictionary is obtained for a matching log type. If the log type is not present in the dictionary, it is added to the dictionary under a new key or ID...[0106]: The compressed log message includes the representation of the timestamp, a log-type key or ID that identifies the log type in the log-type dictionary, and an ordered sequence of identified numeric and non-numeric expressions identified from the tokens.); generating, using a second data compression model, a compressed intermediate representation that further compresses the intermediate representation, wherein the compressed intermediate representation is associated with an index type ([0105] At block 112, a log-type dictionary is referenced for the identified log type (intermediate representation). A key or ID in the dictionary is obtained for a matching log type. If the log type is not present in the dictionary, it is added to the dictionary under a new key or ID…[0106] A compressed log message (compressed intermediate representation) is generated. The compressed log message may be stored in a database table or similar data structure. The compressed log message includes the representation of the timestamp, a log-type key or ID (index type) that identifies the log type in the log-type dictionary, and an ordered sequence of identified numeric and non-numeric expressions identified from the tokens… Examiner’s note: Thus, the compressed log message is generated based on key or id that identifies the log type and other expressions found from the tokens so the log type is further compressed. The generation of compressed log message is executed at a generate compressed log message stage which is separate from the identify log type stage so it can be equivalent to a second data compression model); and storing, by applying a universal schema, the compressed intermediate representation in the columnar format in an online analytical processing database based on the index type, wherein: (i) the universal schema implements columns within the online analytical processing database corresponding to the columnar format of the compressed intermediate representation (Fig. 5 element 146 & [0106]: A compressed log message is generated and may be stored in a database table or similar data structure (online analytical processing database with universal schema)... The timestamp representation may be stored in a timestamp field of a database table, the log-type key may be stored in a log-type field, and any non-numeric keys and numeric values may be stored in a variables field as an ordered sequence of values. All information of the original log message is stored in a lossless manner… Examiner’s note: Thus, the compressed log message can store its values in a database tables with different fields, so the database table is equivalent to online analytical processing database corresponding to the columnar format. The database table such as database table 146 in fig. 5 can be constructed with specified columns such as columns “timestamp”, “log type”, and “variables in Ordered sequence” and the structure of a database table can be equivalent to a universal schema because the sets of columns are constructed to 1 specific schema such as “timestamp”, “log type”, and “variables in Ordered sequence” and the table is used to store compressed log messages that contain all information of the original log message is stored in a lossless manner), the (ii) compressed intermediate representation is accessible from the online analytical processing database for real- time querying, based on the compressed intermediate representation ([0036] Searching may be more efficient because searches can be performed directly on compressed log messages without decompression… [0142] Subqueries are generated from the tokens and their classes and the subqueries are composed... [0145]: Matched log messages are returned as results. Once all of the compressed log messages that match the composition of all the subqueries are identified, these compressed log messages are decompressed in a lossless manner. Thus, original log messages are returned… [0180] These results indicate that log data will be ready to be searched much faster when using the present system as compared to Elasticsearch, enabling the present system to be used as a real-time search tool… Examiner’s note: Thus, the compressed log messages are stored and to be queried in real-time).
Lion does not explicitly teach generating, by the event processing system, one or more data streams, wherein the one or more data streams distributes the plurality of log statements across one or more servers of the computing system according to an identifier and parsing the plurality of log statements into a columnar format.
Ben-Natan teaches parsing the plurality of log statements into a columnar format (Col 3 line 59-67: Storage system for storing unstructured data as a columnar database as described herein. Depicted below are examples of unstructured data and the corresponding operations and storage arrangements for the columnar form…Fig. 4 & Col 7 line 47-54: Each of FIGS. 4-8 shows a manner of storage for a variety of simple and compound type arrangements. FIG. 4 shows a format for storing a collection according to FIG. 3. Referring to FIGS. 2-4, a document (log template) includes three fields A_string, B_num and C_Bool. Respective files 450-1, 450-2 and 450-3 store each of the values… Examiner’s note: Thus, data can be stored into a columnar form with the known fields). It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the Ben-Natan teachings in the Lion system. Skilled artisan would have been motivated to incorporate parsing data into a columnar storage taught by Ben-Natan in the Lion system to reduce processing times and compression can be more effective because columns of the same type and semantic meaning compress better, etc., as recognized by Ben-Natan (Col 5 line 5-16). This close relation between both of the references highly suggests an expectation of success.
Lion in view of Ben-Natan does not explicitly teach generating, by the event processing system, one or more data streams, wherein the one or more data streams distributes the plurality of log statements across one or more servers of the computing system according to an identifier.
Amit teaches generating, by the event processing system, one or more data streams, wherein the one or more data streams distributes the plurality of log statements across one or more servers of the computing system according to an identifier ([0018]: The present invention allows for writing to multiple compression streams based on domains of data. The present invention identifies and decides to which compression domain a write operation should be forward to and decides which compression stream to use. A compression domain may have one or more active compression streams. The detection method reads small fragments of the input data, which are randomly selected, and computes a set of classifying heuristics to create a fingerprint for the data. Data with similar fingerprints are compressed together in a single compression stream, while write operations that contain data with different fingerprint and characteristics (e.g., image versus text) will be split to different compression streams…Examiner’s note: The system creates multiple streams to process data based on fingerprint similarity such that data with common fingerprints can compress in one stream while other stream can compress data with different fingerprint identity). It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the Amit teachings in the Lion and Ben-Natan system. Skilled artisan would have been motivated to incorporate plurality of streams to process data compressions taught by Amit in the Lion and Ben-Natan system to increase efficiency and provide for a better use of a distributed system (i.e., multiple compression nodes) by allowing more nodes to assist in compressing the data by keeping similar data in a single stream, but utilizing multiple machines, as recognized by Amit ([0018]). This close relation between both of the references highly suggests an expectation of success.
Regarding claim 2, Lion in view of Ben-Natan and Amit teaches all of the limitations of claim 1. Lion further teaches a first data compression model configured to receive the plurality of log statements ([0098] FIG. 5 shows an example method of compressing a log message in conjunction with example values. The method may be implemented by instructions usable with a memory and processor… Examiner’s note: Thus, the log message is received for further processing) and determine the index type, the index type indicative of a type of log statement of the plurality of log statements associated with the log template and the variables ([0104] : A log type is identified. Log type may be taken as the tokens remaining after identification of numeric and non-numeric variable expressions as well as the delimiters. log type 136 may be the original log message without the timestamp and with numeric and non-numeric variable expressions replaced by placeholders….[0105]: Log-type dictionary is referenced for the identified log type. A key or ID in the dictionary is obtained for a matching log type. If the log type is not present in the dictionary, it is added to the dictionary under a new key or ID… Examiner’s note: Thus, a log type or index type is determined for each log message).
Regarding claim 3, Lion in view of Ben-Natan and Amit teaches all of the limitations of claim 1. Lion further teaches a second data compression model configured to receive the intermediate representation and generate a compressed intermediate representation , wherein the compressed intermediate representation is indicative of the plurality of log statements ([0106]: A compressed log message is generated. The compressed log message may be stored in a database table or similar data structure. The compressed log message includes the representation of the timestamp, a log-type key or ID that identifies the log type in the log-type dictionary, and an ordered sequence of identified numeric and non-numeric expressions identified from the tokens.).
Regarding claim 4, Lion in view of Ben-Natan and Amit teaches all of the limitations of claim 1. Lion further teaches wherein the index type is associated with a data type, the data type indicative of a compressed form of the plurality of log statements ([0104]: Log type may be taken as the tokens remaining after identification of numeric and non-numeric variable expressions as well as the delimiters. In other words, log type may be the original log message without the timestamp and with numeric and non-numeric variable expressions replaced by placeholders.).
Regarding claim 5, Lion in view of Ben-Natan and Amit teaches all of the limitations of claim 1. Lion further teaches wherein parsing the log template and variables comprise: determining one or more repetitive properties of the plurality of log statements; converting the plurality of log statements into the columnar format based on the repetitive properties ([0103]:A non-numeric expression dictionary is referenced for any non-numeric expressions identified among the tokens. A key or ID in the dictionary is obtained for a matching non-numeric expression. If a non-numeric expression is not present in the dictionary, it is added to the dictionary under a new key or ID.); determining repetitive values and non-repetitive values associated with the one or more repetitive properties; and storing the repetitive values as the dictionary values and the non-repetitive values as non-dictionary values ([0105]: A log-type dictionary is referenced for the identified log type. A key or ID in the dictionary is obtained for a matching log type (repetitive values). If the log type is not present in the dictionary (non-repetitive values), it is added to the dictionary under a new key or ID… Examiner’s note: Thus, matching log type can be identified and stored in a dictionary and new log type can be created if the particular log type is not found in the dictionary).
Regarding claim 7, Lion in view of Ben-Natan and Amit teaches all of the limitations of claim 1. Lion further teaches wherein the plurality of log statements are indicative of at least unstructured logs or structured logs ([0043] Log messages may be generated by a program for various reasons. Log messages are often stored in files, such as text files. An example log file stores a series of log messages, one message per line of the file. Numerous other examples exist, such as log messages that span multiple lines. An example snippet of a log file is given below: [0044] 2018-07-24 06:32:11.995 INFO File Upload job_6368 file uploaded by user user3994, file-ID: 34D0058…[0045] 2018-07-24 06:33:43.151 INFO Job job_2936 submitted by user admin128 is completed, job completion time:12.863 second…[0046] 2018-07-24 06:33:52.003, user admin128 logs out… Examiner’s note: Thus log messages can be indicative of at least structured logs).
Regarding claim 8, Lion in view of Ben-Natan and Amit teaches all of the limitations of claim 1. Lion does not explicitly teach wherein the columnar format comprises at least three columns.
Ben-Natan teaches wherein the columnar format comprises at least three columns (Fig. 4 & Col 7 line 47-54: FIG. 4 shows a format for storing a collection according to FIG. 3. Referring to FIGS. 2-4, a document includes three fields A_string, B_num and C_Bool. Respective files 450-1, 450-2 and 450-3 store each of the values… Examiner’s note: Thus at least three columns are present in a columnar format). Please refer to claim 1 for the motivational statement.
Regarding claim 10, Lion in view of Ben-Natan and Amit teaches all of the limitations of claim 1. Lion further teaches wherein the index type is modified to accommodate a high variance of structured log statements ([0105]: A log-type dictionary is referenced for the identified log type. A key or ID in the dictionary is obtained for a matching log type. If the log type 136 is not present in the dictionary, it is added to the dictionary under a new key or ID… [0106]: The compressed log message includes a log-type key or ID that identifies the log type in the log-type dictionary... Examiner’s note: Thus, new key or ID is created for every new log-type and is shown in the compressed log message).
Regarding claim 12, the disclosed method performs all the limitations performed by the system as shown in claim 1. Please refer to claim 1 as shown above.
Regarding claim 13, the disclosed method performs all the limitations performed by the system as shown in claim 2. Please refer to claim 2 as shown above.
Regarding claim 14, the disclosed method performs all the limitations performed by the system as shown in claim 3. Please refer to claim 3 as shown above.
Regarding claim 15, the disclosed method performs all the limitations performed by the system as shown in claim 5. Please refer to claim 5 as shown above.
Regarding claim 17, the disclosed method performs all the limitations performed by the system as shown in claim 7. Please refer to claim 7 as shown above.
Regarding claim 18, the disclosed method performs all the limitations performed by the system as shown in claim 8. Please refer to claim 8 as shown above.
Regarding claim 20, the disclosed method performs all the limitations performed by the system as shown in claim 1. Please refer to claim 1 as shown above.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CAO DANG VUONG whose telephone number is (571)272-1812. The examiner can normally be reached M-F 7:30-5 EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kavita Stanley can be reached at (571) 272-8352. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/C.D.V./Examiner, Art Unit 2153 06/17/2026
/KAVITA STANLEY/Supervisory Patent Examiner, Art Unit 2153
Prosecution Insights