DETAILED ACTION
Priority
Applicant’s claim for the benefit to 16/945578 filed July 31, 2020 is acknowledged. Application 16/645578 is Published as Patent #12321396.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim 20 is rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. The claim(s) does/do not fall within at least one of the four categories of patent eligible subject matter because the claim appears to be directed to software per sae.
Claim 20 is directed to a “non-transitory computer-readable media comprising computer-executable instructions”. One of ordinary skill in the art may reasonable read this to mean that the computer-readable media is and of itself the computer-executable instructions, which may reasonably include software per sae. As such, the claims may reasonably be read as being directed to the software per sae. It is noted that within clam the recited “processor” is recited as an additional element, that is not part of the claimed computer-readable media, but instead appears to be an external element that is intended to execute the computer-readable media to achieve the claimed steps. It is suggested that the claim be amended to explicitly recite that the computer-readable media include the processor, to ensure that the claim is not directed to just the software itself (e.g. the reasonable reading of the computer-readable media comprising the computer-executable instructions).
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-20 are rejected under 35 U.S.C. 102(a)(1) and 35 U.S.C. 102(a)(2) as being anticipated by Pal [2019/0310977].
With regard to claim 1 Pal teaches A method comprising:
obtaining, at an ingestion node as the worker nodes ingesting the chunks (Pal, ¶76 “FIG. 64 is a block diagram illustrating an embodiment of a worker node ingesting four chunks of data and reducing the records”; ¶114 “the external data systems 12 are communicatively coupled to worker nodes 14-1 and 14-2 (also referred to collectively and individually as worker node(s) 14) of the data intake and query system 16”) of a data intake system as the data intake and query system 16 (Id), a plurality of events, wherein each event of the plurality (Pal, ¶122, “the data intake and query system 16 or external data systems similar to the data intake and query system 16 can address some of these challenges by collecting and storing raw data as structured “events””) of events includes raw machine data (Pal, ¶127 “For example, machine data can be raw machine data that is generated by various components in IT environments, such as servers, sensors, routers, mobile devices, Internet of Things (IoT) devices, etc.”) associated with a timestamp (Pal, ¶122 “For example, events may be derived from “time series data,” where the time series data comprises a sequence of data points (e.g., performance measurements from a computer system) that are associated with successive points in time.”; ¶124 “he raw data can be divided into segments and indexed by timestamps”);
generating, at the ingestion node, a group of events from the plurality of events as buckets of events (Pal, ¶211 “In some embodiments, the stored events are organized into "buckets," where each bucket stores events associated with a specific time range based on the timestamps associated with each event.”);
communicating the group of events from the ingestion node to a message bus (¶1335 “The interconnect 84 may be or include one or more… buses… and/or other conventional connection devices.”) in accordance with the size as the size of the bucket (¶193 “a forwarder receives the raw data and may segment the data stream into "blocks", possibly of a uniform data size, to facilitate subsequent processing steps.”; ¶211 “In some embodiments, each bucket may be associated with an identifier, a time range, and a size constraint.”) of the group of events as the bucket (Id).
With regard to claim 2 Pal teaches wherein the plurality of events are obtained from a forwarder (Pal, ¶362 “The data intake and query system includes one or more forwarders that receive raw machine data from a variety of input data sources, and one or more indexers that process and store the data in one or more data stores”).
With regard to claim 3 Pal teaches determining, at the ingestion node, a manner as the mapping (Pal, ¶785 “In some cases, the header information can also include mapping information for mapping field names to field positions ( e.g., where a particular field name is located within an event, etc.). In some embodiments, as part of determining the header information for the events, the serialization module can serialize the header information. For example, if some field names are repetitive or have been identified before in previous groups, they can be replaced with an identifier indicating a cache entry that has that field name.”; Please note this claim limitation has been read in light of Paragraph [0482] of the instant specification)) in which to process the plurality of events as the event (Id) based on processing previously performed as the field names are identified in previous groups (Id) in association with the plurality of events as the grouping of events (Id); and
processing the plurality of events based on the manner determined as the identifier may be mapped to the identified field name (Id).
With regard to claim 4 Pal teaches wherein the ingestion node of the data intake system generates the plurality of events by parsing data and applying line breaking to the data as paring the data block using predefined characters including line breaks, e.g. ‘\n’(Pal, ¶198 “These predefined characters may include punctuation marks or other special characters including, for example, carriage returns, tabs, spaces, line breaks, etc.”; ¶786 “In addition, the serialization module can identify data other data for removal. For example, in some embodiments, certain delimiters, such as ',' or '\n' can be removed from the events.”).
With regard to claim 5 Pal teaches adding events of the plurality of events to a buffer (¶404 “ingested data buffers (illustrated in FIG. 48) that include ingested streaming data.”; ¶602) or queue (¶833 “Metadata regarding a topic may include, for example, a number of message queues within the ingested data buffer 4802 corresponding to the topic”) after obtaining the plurality of events as ingested data stream (¶404) or the message queue within the ingested data buffer (¶833).
With regard to claim 6 Pal teaches comprising encoding, by the ingestion node, the group of events (¶608 “In some cases, the serialization/deserialization module 3412 can generate and transmit serialized event groups.”; ¶464; ¶594; Please note this claim limitation has been read in light of Paragraph [00367] as serializing the group of events).
With regard to claim 7 Pal further teaches determining, by the ingestion node, the size of the group of events as selecting the size of the bucket (¶193”; ¶211; ¶803 “The size of each bucket may be selected according to the computational resources of the common storage 4602 or the data intake and query system 3301 overall. For example, the size of each bucket may be selected to enable an individual bucket to be relatively quickly transmitted via a network, without introducing excessive additional data storage requirements due to metadata or other overhead associated with an individual bucket. In one embodiment, each bucket is 750 megabytes in size.”).
With regard to claim 8 Pal teaches wherein when the size of the group of events satisfies or exceeds a message size threshold as the threshold amount of data (¶803 “n another embodiment, a first tier may include a threshold amount (e.g., n terabytes) or recently accessed data, while a second tier stores the remaining less recently accessed data. In one embodiment, data within the data stores 208 is grouped into buckets, each of which is commonly accessible to the indexers 206. The size of each bucket may be selected according to the computational resources of the common storage 4602 or the data intake and query system 3301 overall.”), the ingestion node stores the group of events in a data store (¶104 “the data stores of the indexers (“internal data stores”)”) of the message bus (¶1335 “buses”), obtains a location reference to the storage location of the group of events in the data store as the location of the event (¶227 “The event references 517 can be used to locate the events in the corresponding bucket. For example, the inverted index can include, or be associated with, an event reference array 515. The event reference array 515 can include an array entry 517 for each event reference in the inverted index 507B. Each array entry 517 can include location information 519 of the event corresponding to the unique identifier (non-limiting example: seek address of the event), a timestamp 521 associated with the event, or additional information regarding the event associated with the event reference, etc.”), and communicates the location reference (¶252 “Having identified the events (and event references) that satisfy all of the filter criteria, the indexer 206 can group the event references using the received categorization criteria (source). In doing so, the indexer can determine that event references 5 and 6 are located in the field-value pair entry source:… . This information can be communicated to the search head”) to a message queue (¶833 “Metadata regarding a topic may include, for example, a number of message queues within the ingested data buffer 4802 corresponding to the topic”) of the message bus(¶1335 “bus”).
With regard to claim 9 Pal teaches wherein when the size of the group of events does not satisfy a message size threshold as the second tier stores the remaining data (¶803 “n another embodiment, a first tier may include a threshold amount (e.g., n terabytes) or recently accessed data, while a second tier stores the remaining less recently accessed data. In one embodiment, data within the data stores 208 is grouped into buckets, each of which is commonly accessible to the indexers 206. The size of each bucket may be selected according to the computational resources of the common storage 4602 or the data intake and query system 3301 overall.”), the ingestion node communicates the group of events to a message queue (¶833 “Metadata regarding a topic may include, for example, a number of message queues within the ingested data buffer 4802 corresponding to the topic”) of the message bus (¶1335 “bus”).
With regard to claim 10 Pal teaches wherein the message bus (¶1335 “bus”) processes messages related to the group of events (¶833 “Metadata regarding a topic may include, for example, a number of message queues within the ingested data buffer 4802 corresponding to the topic”).
With regard to claim 11 Pal teaches wherein the message bus includes a data store and a message queue implemented as a pub-sub (¶830 “the ingested data buffer 4802 operates according to a publish-subscribe ("pub-sub") messaging model. For example, each data source 203 may be represented as one or more "topics" within a pub-sub model, and new information at the data source may be represented as a "message" within the pub-sub model.”; Please note this claim limitation has been read in light of Paragraph [00106] of the original specification).
With regard to claim 12 Pal further teaches wherein the message bus (Pal, ¶1335 “bus”) includes a message queue (Pal, ¶833 “Metadata regarding a topic may include, for example, a number of message queues within the ingested data buffer 4802 corresponding to the topic”), and wherein the message queue includes the group of events as the corresponding topic, e.g. buckets (¶833, ¶211) or a location references the location of the event (¶227 “The event references 517 can be used to locate the events in the corresponding bucket”) to the group of events stored in a data store (¶104 “the data stores of the indexers (“internal data stores”)”) associated with the message bus (Pal, ¶1335 “bus”).
With regard to claim 13 Pal teaches wherein the message bus (Pal, ¶1335 “bus”) includes a message queue (Pal, ¶833 “Metadata regarding a topic may include, for example, a number of message queues within the ingested data buffer 4802 corresponding to the topic”), and wherein the message queue tracks (¶450 “In particular, the order from which the event chunks flowed from peer indexers 206 can be tracked to enable collating the chunks in time order at the worker nodes 214.”) which messages have been sent to (¶227 “The event references 517 can be used to locate the events in the corresponding bucket”) which indexers (¶104 “the data stores of the indexers (“internal data stores”)”).
With regard to claim 14 Pal further teaches wherein the message bus acknowledges (¶831 “After data representing a message has been processed by an indexer 206, the indexer 206 can send an acknowledgement of the message to the ingested data buffer 4802”) that the group of events has been stored as the data has been processed by the indexer (Id) in a recoverable manner. (¶214 “events and buckets can also be replicated across different indexers and data stores to facilitate high availability and disaster recovery”)
With regard to claim 15 Pal further teaches
acknowledging, by the ingestion node, that the group of events have been stored (¶831 “After data representing a message has been processed by an indexer 206, the indexer 206 can send an acknowledgement of the message to the ingested data buffer 4802”);
and based on the acknowledgment, deleting as deleting (¶831), by a forwarder (¶827 “Specifically, where information from a data source 203 is required to pass through a forwarder 204, be processed at an indexer 206,”), data that corresponds to the group of events or communicating, by the forwarder, with a data source to delete the data that corresponds to the group of events as deleting the message once acknowledgements have been received (¶831, “In accordance with the pub-sub messaging model, the ingested data buffer 4802 can delete a message once acknowledgements have been received from all subscribers (which may include, for example, a single indexer 206 configured to process the message).”).
With regard to claim 16 Pal further teaches wherein the group of events form a message payload (¶453 “For example, when the worker nodes 214 are not local (e.g., remote from the peer indexers 206), compressed payloads of the event chunks can be transferred to improve performance”).
With regard to claim 17 Pal further teaches wherein the group of events is generated by the ingestion node pulling events (¶492 “In particular, the worker nodes may use a list identifying indexers from which to pull the sharded partial search results.”; ¶912 “The daemon can pull the results from the disk and send them to the assigned worker node 3306.”) from a buffer (¶404 “ingested data buffers (illustrated in FIG. 48) that include ingested streaming data.”; ¶602) or queue (¶833 “Metadata regarding a topic may include, for example, a number of message queues within the ingested data buffer 4802 corresponding to the topic”) that temporarily stores the plurality of events as cache stores (¶524 “The cloud-based system 242 includes index cache components 254. The index cache components 254 are communicatively coupled to cloud storage 256, which can form a global index 258.”).
With regard to claim 18 Pal further teaches wherein the ingestion node generates the group of events as the selected size of the bucket (¶193”; ¶211; ¶803) based on a constraint a size constraint (¶211 “In some embodiments, each bucket may be associated with an identifier, a time range, and a size constraint.”) or a capacity (¶568 “the maximum capacity that can be run at any one time”) of the message bus (¶1335 “bus”) or a message queue (¶833 “Metadata regarding a topic may include, for example, a number of message queues within the ingested data buffer 4802 corresponding to the topic”) associated with the message bus (¶1335 “bus”).
With regard to claim 19 Pal teaches A system comprising:
Memory as the memory (¶592 “For example, in some embodiments, each machine 3402 can include 32, 48, 64, or more processor cores, multiple terabytes of memory, etc.”); and
one or more processing devices as the processor cores (¶592 “For example, in some embodiments, each machine 3402 can include 32, 48, 64, or more processor cores, multiple terabytes of memory, etc.”) communicatively coupled to the memory and configured to:
obtain, at an ingestion node as the worker nodes ingesting the chunks (Pal, ¶76 “FIG. 64 is a block diagram illustrating an embodiment of a worker node ingesting four chunks of data and reducing the records”; ¶114 “the external data systems 12 are communicatively coupled to worker nodes 14-1 and 14-2 (also referred to collectively and individually as worker node(s) 14) of the data intake and query system 16”) of a data intake system as the data intake and query system 16 (Id), a plurality of events, wherein each event of the plurality (Pal, ¶122, “the data intake and query system 16 or external data systems similar to the data intake and query system 16 can address some of these challenges by collecting and storing raw data as structured “events””) of events includes raw machine data (Pal, ¶127 “For example, machine data can be raw machine data that is generated by various components in IT environments, such as servers, sensors, routers, mobile devices, Internet of Things (IoT) devices, etc.”) associated with a timestamp (Pal, ¶122 “For example, events may be derived from “time series data,” where the time series data comprises a sequence of data points (e.g., performance measurements from a computer system) that are associated with successive points in time.”; ¶124 “he raw data can be divided into segments and indexed by timestamps”);
generate, at the ingestion node, a group of events from the plurality of events as buckets of events (Pal, ¶211 “In some embodiments, the stored events are organized into "buckets," where each bucket stores events associated with a specific time range based on the timestamps associated with each event.”);
communicate the group of events from the ingestion node to a message bus (¶1335 “The interconnect 84 may be or include one or more… buses… and/or other conventional connection devices.”) in accordance with the size as the size of the bucket (¶193 “a forwarder receives the raw data and may segment the data stream into "blocks", possibly of a uniform data size, to facilitate subsequent processing steps.”; ¶211 “In some embodiments, each bucket may be associated with an identifier, a time range, and a size constraint.”) of the group of events as the bucket (Id).
With regard to claim 20 Pal teaches Non-transitory computer-readable media comprising computer-executable instructions that when executed by one or more processing devices of an ingestion node of a data intake system, cause the one or more processing devices (¶1381 “Non-transitory computer-readable media comprising computer-executable instructions that, when executed by a computing system of a data intake and query system, cause the computing system to:”) to:
obtain, at an ingestion node as the worker nodes ingesting the chunks (Pal, ¶76 “FIG. 64 is a block diagram illustrating an embodiment of a worker node ingesting four chunks of data and reducing the records”; ¶114 “the external data systems 12 are communicatively coupled to worker nodes 14-1 and 14-2 (also referred to collectively and individually as worker node(s) 14) of the data intake and query system 16”) of a data intake system as the data intake and query system 16 (Id), a plurality of events, wherein each event of the plurality (Pal, ¶122, “the data intake and query system 16 or external data systems similar to the data intake and query system 16 can address some of these challenges by collecting and storing raw data as structured “events””) of events includes raw machine data (Pal, ¶127 “For example, machine data can be raw machine data that is generated by various components in IT environments, such as servers, sensors, routers, mobile devices, Internet of Things (IoT) devices, etc.”) associated with a timestamp (Pal, ¶122 “For example, events may be derived from “time series data,” where the time series data comprises a sequence of data points (e.g., performance measurements from a computer system) that are associated with successive points in time.”; ¶124 “he raw data can be divided into segments and indexed by timestamps”);
generate, at the ingestion node, a group of events from the plurality of events as buckets of events (Pal, ¶211 “In some embodiments, the stored events are organized into "buckets," where each bucket stores events associated with a specific time range based on the timestamps associated with each event.”);
communicate the group of events from the ingestion node to a message bus (¶1335 “The interconnect 84 may be or include one or more… buses… and/or other conventional connection devices.”) in accordance with the size as the size of the bucket (¶193 “a forwarder receives the raw data and may segment the data stream into "blocks", possibly of a uniform data size, to facilitate subsequent processing steps.”; ¶211 “In some embodiments, each bucket may be associated with an identifier, a time range, and a size constraint.”) of the group of events as the bucket (Id).
Claims 1-5, 7-10, 12-14, 16, 18-20 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Patel [2013/0311428].
With regard to claim 1 Patel teaches A method comprising:
obtaining, at an ingestion node as a member indexer (Patel, ¶42 “One embodiment, of a cluster member indexer is disclosed in more detail below in conjunction with FIG. 3. Briefly, however, cluster 120 includes a plurality of member indexers 121-123, and master device 126.”) of a data intake system as the cluster (Patel, ¶41 “In one embodiment, cluster 120 is configured to manage data storage and replication of data received by one or more client devices operating as forwarder devices.”), a plurality of events, wherein each event of the plurality of events includes raw machine data as raw data (Patel, ¶45 “During indexing, incoming raw data from, for example, a forwarder device, may be processed to enable fast search and analysis, the results of which may be stored in an index, or bucket”) associated with a timestamp as identifying timestamps (Patel, ¶45 “As part of the indexing process, the indexer 121-123 may add knowledge to the data in various ways, including by: separating a data stream into individual, searchable events; creating or identifying timestamps”);
generating, at the ingestion node, a group of events from the plurality of events as the bucket to which the indexer stores the data (Patel, ¶87 “Indexer 121, assuming it is functional and active (has not failed), then prepares and saves the data to the hot bucket. As noted above, in one embodiment, the received data may be referred to as a "slice." That is, in one embodiment, the slice may represent a small amount of data, typically of a few kilobytes in size-although other sizes may also be received.”);
communicating the group of events from the ingestion node as the index communicating through the network device (Patel, ¶71 “Index manager 320 may perform a variety of actions as disclosed herein to enable network device 300 to operate as an indexer within the cluster.”) to a message bus as the network device includes a bus to be used for all communication (Patel, ¶39 “through a universal serial bus”; ¶71 “all in communication with each other via bus 326”) in accordance with the size of the group of events as the amount of space for storing of the data, which may be measured by kilobytes in size (Patel, ¶67 “In one embodiment, forwarder 261 may specify an amount of space for storing of the data, and/or may specify a replication factor indicating a number of times the data is to be replicated.”; ¶87 “That is, in one embodiment, the slice may represent a small amount of data, typically of a few kilobytes in size-although other sizes may also be received.”).
With regard to claim 2 Patel teaches wherein the plurality of events are obtained from a forwarder (Patel, ¶41 “In one embodiment, cluster 120 is configured to manage data storage and replication of data received by one or more client devices operating as forwarder devices.”).
With regard to claim 3 Patel further teaches determining, at the ingestion node as being configured on an indexer (Patel, ¶67 “However, in other embodiments, the replication factor might be configured on an indexer based on, for example, a type of data being replicated. Forwarder 261 may also indicate when to close a bucket for data, open a new bucket, or the like.”), a manner in which to process the plurality of events based on processing previously performed in association with the plurality of events as for the type of data being replicated to close a bucket for data and open a new bucket (Id); and
processing the plurality of events based on the manner determined as determining to open a new hot bucket for data storage (Patel, ¶86 “In one embodiment, receiving of the data from a forwarder device may initiate opening or otherwise creation of a hot bucket for storage of the data.”).
With regard to claim 4 Patel further teaches wherein the ingestion node of the data intake system generates the plurality of events by parsing data as separating a data string into individual, searchable events (¶45 “As part of the indexing process, the indexer 121-123 may add knowledge to the data in various ways, including by: separating a data stream into individual, searchable events; …”) and applying line breaking to the data as applying breaking rules for multi-line events (¶45 “As part of the indexing process, the indexer 121-123 may add knowledge to the data in various ways, including by: separating a data stream into individual, searchable events; …, applying breaking rules for multi-line events”).
With regard to claim 5 Patel further teaches adding events of the plurality of events to a buffer or queue after obtaining the plurality of events as the hot bucket (¶83 “As shown, buckets 410 may be designated as hot 411, warm 412, cold 413 buckets, to indicate whether a bucket is open to receive and store data (hot), recently closed for receiving data but available for access of data (warm), or closed and may be unavailable readily for access of data ( cold).”; Please note this claim limitation has been read in light of Paragraph [00400] of the original specification which describes the message queue as a ‘hot bucket’).
With regard to claim 7 Patel further teaches determining, by the ingestion node, the size of the group of events (Patel, ¶67 “In one embodiment, forwarder 261 may specify an amount of space for storing of the data, and/or may specify a replication factor indicating a number of times the data is to be replicated”).
With regard to claim 8 Patel further teaches wherein when the size of the group of events satisfies or exceeds a message size threshold (Patel, ¶66 “Forwarder 261 may select an indexer to receive the data based on any of a variety of criteria, including, but not limited to a load-balancing algorithm.”), the ingestion node stores the group of events in a data store of the message bus as the network device includes a bus to be used for all communication (Patel, ¶39 “through a universal serial bus”; ¶71 “all in communication with each other via bus 326”), obtains a location reference to the storage location of the group of events in the data store as the GEN_ID (¶26 “In one embodiment, member indexers may store different 'slices' of data having different GEN_IDs”), and communicates the location reference (¶26 “Further, although the master device manages GEN_IDs for data, requests for data may employ earlier GEN_ID numbers and therefore are also minimally impacted by a master device failure.”) to a message queue of the message bus as the network device includes a bus to be used for all communication (Patel, ¶39 “through a universal serial bus”; ¶71 “all in communication with each other via bus 326”).
With regard to claim 9 Patel further teaches wherein when the size of the group of events does not satisfy a message size threshold as the indexer is not at its set load expectation (Patel, ¶66 “Forwarder 261 may select an indexer to receive the data based on any of a variety of criteria, including, but not limited to a load-balancing algorithm.”), the ingestion node communicates the group of events (¶67 “In one embodiment, forwarder 261 may specify an amount of space for storing of the data, and/or may specify a replication factor indicating a number of times the data is to be replicated”) to a message queue of the message bus as the network device includes a bus to be used for all communication (Patel, ¶39 “through a universal serial bus”; ¶71 “all in communication with each other via bus 326”).
With regard to claim 10 Patel further teaches wherein the message bus processes messages related to the group of events as the network device includes a bus to be used for all communication (Patel, ¶39 “through a universal serial bus”; ¶71 “all in communication with each other via bus 326”).
With regard to claim 12 Patel further teaches wherein the message bus includes a message queue as the network device includes a bus to be used for all communication (Patel, ¶39 “through a universal serial bus”; ¶71 “all in communication with each other via bus 326”), and wherein the message queue includes the group of events or a location reference to the group of events as the GEN_ID (¶26 “In one embodiment, member indexers may store different 'slices' of data having different GEN_IDs”) stored in a data store associated with the message bus as the network device includes a bus to be used for all communication (Patel, ¶39 “through a universal serial bus”; ¶71 “all in communication with each other via bus 326”).
With regard to claim 13 Patel further teaches wherein the message bus includes a message queue, and wherein the message queue tracks which messages have been sent to which indexers (¶78 “”Thus, index manager 320 may manage collection of data, generation of journals about the data, storage of the data, generations of buckets for storage of the data, closing and opening of buckets based on a variety of criteria”).
With regard to claim 14 Patel further teaches wherein the message bus acknowledges that the group of events has been stored (¶78 “and provide acknowledgements in response to receiving data for storage”) in a recoverable manner (¶20 “The forwarder device may, in one embodiment, specify a number of copies or a number of times the data is to be replicated for data recovery, herein termed a "replication factor”).
With regard to claim 16 Patel further teaches wherein the group of events form a message payload as a data stream (¶45 “separating a data stream into individual”).
With regard to claim 18 Patel further teaches wherein the ingestion node generates the group of events based on a constraint or a capacity of the message bus or a message queue associated with the message bus as selecting the indexer based on a load balancing algorithm (Patel, ¶33 “Forwarder devices may make the selection based on a load-balancing algorithm, including a least loaded algorithm, a fastest response algorithm, a round-robin, random selection, or any of a variety of other mechanisms.”).
With regard to claim 19 Patel teaches A system comprising:
Memory (Patel, ¶73 “processor-readable storage media”); and
one or more processing devices communicatively coupled to the memory (Patel, ¶73 “processor-readable storage media”) and configured to:
obtain, at an ingestion node as a member indexer (Patel, ¶42 “One embodiment, of a cluster member indexer is disclosed in more detail below in conjunction with FIG. 3. Briefly, however, cluster 120 includes a plurality of member indexers 121-123, and master device 126.”) of a data intake system as the cluster (Patel, ¶41 “In one embodiment, cluster 120 is configured to manage data storage and replication of data received by one or more client devices operating as forwarder devices.”), a plurality of events, wherein each event of the plurality of events includes raw machine data as raw data (Patel, ¶45 “During indexing, incoming raw data from, for example, a forwarder device, may be processed to enable fast search and analysis, the results of which may be stored in an index, or bucket”) associated with a timestamp as identifying timestamps (Patel, ¶45 “As part of the indexing process, the indexer 121-123 may add knowledge to the data in various ways, including by: separating a data stream into individual, searchable events; creating or identifying timestamps”);
generate, at the ingestion node, a group of events from the plurality of events as the bucket to which the indexer stores the data (Patel, ¶87 “Indexer 121, assuming it is functional and active (has not failed), then prepares and saves the data to the hot bucket. As noted above, in one embodiment, the received data may be referred to as a "slice." That is, in one embodiment, the slice may represent a small amount of data, typically of a few kilobytes in size-although other sizes may also be received.”);
communicate the group of events from the ingestion node as the index communicating through the network device (Patel, ¶71 “Index manager 320 may perform a variety of actions as disclosed herein to enable network device 300 to operate as an indexer within the cluster.”) to a message bus as the network device includes a bus to be used for all communication (Patel, ¶39 “through a universal serial bus”; ¶71 “all in communication with each other via bus 326”) in accordance with the size of the group of events as the amount of space for storing of the data, which may be measured by kilobytes in size (Patel, ¶67 “In one embodiment, forwarder 261 may specify an amount of space for storing of the data, and/or may specify a replication factor indicating a number of times the data is to be replicated.”; ¶87 “That is, in one embodiment, the slice may represent a small amount of data, typically of a few kilobytes in size-although other sizes may also be received.”).
With regard to claim 20 Patel teaches Non-transitory computer-readable media comprising computer-executable instructions that when executed by one or more processing devices of an ingestion node of a data intake system, cause the one or more processing devices (Patel, ¶73 “processor-readable storage media”) to:
obtain, at an ingestion node as a member indexer (Patel, ¶42 “One embodiment, of a cluster member indexer is disclosed in more detail below in conjunction with FIG. 3. Briefly, however, cluster 120 includes a plurality of member indexers 121-123, and master device 126.”) of a data intake system as the cluster (Patel, ¶41 “In one embodiment, cluster 120 is configured to manage data storage and replication of data received by one or more client devices operating as forwarder devices.”), a plurality of events, wherein each event of the plurality of events includes raw machine data as raw data (Patel, ¶45 “During indexing, incoming raw data from, for example, a forwarder device, may be processed to enable fast search and analysis, the results of which may be stored in an index, or bucket”) associated with a timestamp as identifying timestamps (Patel, ¶45 “As part of the indexing process, the indexer 121-123 may add knowledge to the data in various ways, including by: separating a data stream into individual, searchable events; creating or identifying timestamps”);
generate, at the ingestion node, a group of events from the plurality of events as the bucket to which the indexer stores the data (Patel, ¶87 “Indexer 121, assuming it is functional and active (has not failed), then prepares and saves the data to the hot bucket. As noted above, in one embodiment, the received data may be referred to as a "slice." That is, in one embodiment, the slice may represent a small amount of data, typically of a few kilobytes in size-although other sizes may also be received.”);
communicate the group of events from the ingestion node as the index communicating through the network device (Patel, ¶71 “Index manager 320 may perform a variety of actions as disclosed herein to enable network device 300 to operate as an indexer within the cluster.”) to a message bus as the network device includes a bus to be used for all communication (Patel, ¶39 “through a universal serial bus”; ¶71 “all in communication with each other via bus 326”) in accordance with the size of the group of events as the amount of space for storing of the data, which may be measured by kilobytes in size (Patel, ¶67 “In one embodiment, forwarder 261 may specify an amount of space for storing of the data, and/or may specify a replication factor indicating a number of times the data is to be replicated.”; ¶87 “That is, in one embodiment, the slice may represent a small amount of data, typically of a few kilobytes in size-although other sizes may also be received.”).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 6 and 11 are rejected under 35 U.S.C. 103 as being unpatentable over Patel in view of Apostolopoulos [20200044927].
With regard to claim 6 Patel teaches all the limitation of claim 1 as detailed above. Patel does not explicitly teach encoding the group of events.
Apostolopoulos teaches encoding, by the ingestion node, the group of events (Apostolopoulos, ¶124 “It encodes the domain knowledge necessary to build a variety of specialized searches of those datasets”).
It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have implemented the storage system taught by Patel to use the hierarchical semantic data structure taught by Apostolopoulos as it facilities enabling specialized searches of datasets.
With regard to claim 11 Patel teaches all the limitations of claim 1 a detailed above. Patel does not teach a pub-sub data store. Apostolopoulos teaches wherein the message bus includes a data store and a message queue implemented as a pub-sub (¶164 “Typically, a user may pay a subscription or other fee to use such a service. Each subscribing user of the cloud-based service may be provided with an account that enables the user to configure a customized cloud-based system based on the user's preferences.”).
It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have implemented the storage system taught by Patel as a cloud-based service, thereby enabling the system to provide the storage as a service for pay.
Claims 15 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Patel in view of Kim [4625308].
With regard to claim 15 Patel further teaches
acknowledging, by the ingestion node, that the group of events have been stored (¶78 “and provide acknowledgements in response to receiving data for storage”);…
Patel does not explicitly teach based on the acknowledgement, deleting, by a forwarder, data.
Kim teaches and based on the acknowledgment, deleting, by a forwarder, data that corresponds to the group of events or communicating, by the forwarder, with a data source to delete the data that corresponds to the group of events (Column 67, lines 47-54 “The ACK bytes from the received block are then processed. If an ACK byte indicates an acknowledgement for a dummy block, it is ignored. If the ACK byte is for a particular block sequence number, it is marked off in the outgoing block queue entry for the block sequence number. If the queue entry indicates that all required nodes have ACKed the block, the block is removed from the queue.”).
It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have implemented the acknowledgement system as taught by Patel to include removing blocks from the queue once the ack is received as it provides a means of de-docking messages and pulling them out of the queue for transmission.
With regard to claim 17 Patel teaches all the limitations of claim 1 as detailed above. Patel does not explicitly teach pulling events from a buffer that temporarily stores the polarity of events.
Kim teaches wherein the group of events is generated by the ingestion node pulling events from a buffer or queue that temporarily stores the plurality of events (Kim, Column 85, lines 9-10 “If no error processing is needed, then a message is pulled off the output queue and the protocol characters are added to the message”).
It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have build the messages transmitted by Patel using the message building technique taught by Kim as it yields the predictable results of building a message to be transmitted within the network (Kim, Column 85, lines 1-10).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to AMANDA WILLIS whose telephone number is (571)270-7691. The examiner can normally be reached Monday-Friday 8am-2pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ajay Bhatia can be reached at 571-272-3906. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/AMANDA L WILLIS/ Primary Examiner, Art Unit 2156
Prosecution Insights