The present disclosure relates to identifying process flows from log sources (e.g., log files), and generating visual representations (e.g., flow diagrams, Sankey diagrams, etc.) of the identified process flows. In addition, the present disclosure relates to clustering of tree structures based on the shape of the tree structure using one or more hashing algorithms. The present disclosure also relates to a user interface that presents a query builder for efficiently querying a log analytics system for tree structures that satisfy a user-defined range.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A computer-implemented method, the method comprising: defining, for each data set of a plurality of data sets, a first multi-stage structure, wherein: the first multi-stage structure is generated based on a set of log messages corresponding to the data set; the first multi-stage structure includes a tree structure that includes a set of nodes and a set of node connections; each node in the set of nodes represents a stage of a plurality of stages of a process flow, each stage of the plurality of stages representing an event in a time sequence; and each node connection of the set of node connections is configured to connect a first node of the set of nodes with a second node of the set of nodes; determining a first shape of the first multi-stage structure; clustering the data sets of the plurality of data sets based at least in part on the first shape of the first multi-stage structure, wherein the data set associated with the first shape is clustered with a data set associated with a second shape representing a second multi-stage structure when the first shape and the second shape are corresponding shapes; and displaying a graphical user interface (GUI) presenting a visualization of the clustered data sets, wherein the visualization presents a cluster corresponding to each of the first multi-stage structure and the second multi-stage structure. 2. The computer-implemented method of claim 1, wherein the visualization includes one or more fields configured to accept input that identifies a name for each of one or more data clusters. 3. The computer-implemented method of claim 2, wherein the first shape is not clustered with a third shape representing a third multi-stage structure, wherein the first shape and the third shape are different from each other. 4. The computer-implemented method of claim 1, wherein each data set of the plurality of data sets is associated with a different time period, and wherein, for each data set of the plurality of data sets, each log message of the set of log messages is associated with a timestamp within a time period. 5. The computer-implemented method of claim 1, wherein a hashing algorithm is executed on each of the first multi-stage structure and the second multi-stage structure, wherein executing the hashing algorithm generates a hash value, and wherein the hash value for each of the first multi-stage structure and the second multi-stage structure is the same. 6. The computer-implemented method of claim 5, wherein the hashing algorithm receives as an input a strength of each connection of the set of connections, wherein the strength is indicative of a count of log messages in a subset of the set of log messages, wherein the subset of log messages flows from the first node to the second node, and wherein the clustering of the data sets of the plurality of data sets is further based at least in part on the strength of each connection of the set of connections. 7. The computer-implemented method of claim 1, further comprising: accessing a learning model configured to predict failure messages; receiving one or more new log messages that have not been labeled; feeding the one or more new log messages into the learning model; identifying a new shape associated with the one or more new log messages; and comparing the new shape with one or more existing shapes to identify whether the new shape corresponds to an existing shape of the one or more existing shapes, wherein the existing shape includes a failure stage. 8. A system, comprising: one or more data processors; and a non-transitory computer-readable storage medium containing instructions which, when executed on the one or more data processors, cause the one or more data processors to perform operations including: defining, for each data set of a plurality of data sets, a first multi-stage structure, wherein: the first multi-stage structure is generated based on a set of log messages corresponding to the data set; the first multi-stage structure includes a tree structure that includes a set of nodes and a set of node connections; each node in the set of nodes represents a stage of a plurality of stages of a process flow, each stage of the plurality of stages representing an event in a time sequence; and each node connection of the set of node connections is configured to connect a first node of the set of nodes with a second node of the set of nodes; determining a first shape of the first multi-stage structure; clustering the data sets of the plurality of data sets based at least in part on the first shape of the first multi-stage structure, wherein the data set associated with the first shape is clustered with a data set associated with a second shape representing a second multi-stage structure when the first shape and the second shape are corresponding shapes; and displaying a graphical user interface (GUI) presenting a visualization of the clustered data sets, wherein the visualization presents a cluster corresponding to each of the first multi-stage structure and the second multi-stage structure. 9. The system of claim 8, wherein the visualization includes one or more fields configured to accept input that identifies a name for each of one or more data clusters. 10. The system of claim 9, wherein the first shape is not clustered with a third shape representing a third multi-stage structure, wherein the first shape and the third shape are different from each other. 11. The system of claim 8, wherein each data set of the plurality of data sets is associated with a different time period, and wherein, for each data set of the plurality of data sets, each log message of the set of log messages is associated with a timestamp within a time period. 12. The system of claim 8, wherein a hashing algorithm is executed on each of the first multi-stage structure and the second multi-stage structure, wherein executing the hashing algorithm generates a hash value, and wherein the hash value for each of the first multi-stage structure and the second multi-stage structure is the same. 13. The system of claim 12, wherein the hashing algorithm receives as an input a strength of each connection of the set of connections, wherein the strength is indicative of a count of log messages in a subset of the set of log messages, wherein the subset of log messages flows from the first node to the second node, and wherein the clustering of the data sets of the plurality of data sets is further based at least in part on the strength of each connection of the set of connections. 14. The system of claim 8, wherein the operations further include: accessing a learning model configured to predict failure messages; receiving one or more new log messages that have not been labeled; feeding the one or more new log messages into the learning model; identifying a new shape associated with the one or more new log messages; and comparing the new shape with one or more existing shapes to identify whether the new shape corresponds to an existing shape of the one or more existing shapes, wherein the existing shape includes a failure stage. 15. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a data processing apparatus to perform operations including: defining, for each data set of a plurality of data sets, a first multi-stage structure, wherein: the first multi-stage structure is generated based on a set of log messages corresponding to the data set; the first multi-stage structure includes a tree structure that includes a set of nodes and a set of node connections; each node in the set of nodes represents a stage of a plurality of stages of a process flow, each stage of the plurality of stages representing an event in a time sequence; and each node connection of the set of node connections is configured to connect a first node of the set of nodes with a second node of the set of nodes; determining a first shape of the first multi-stage structure; clustering the data sets of the plurality of data sets based at least in part on the first shape of the first multi-stage structure, wherein the data set associated with the first shape is clustered with a data set associated with a second shape representing a second multi-stage structure when the first shape and the second shape are corresponding shapes; and displaying a graphical user interface (GUI) presenting a visualization of the clustered data sets, wherein the visualization presents a cluster corresponding to each of the first multi-stage structure and the second multi-stage structure. 16. The computer-program product of claim 15, wherein the visualization includes one or more fields configured to accept input that identifies a name for each of one or more data clusters. 17. The computer-program product of claim 15, wherein each data set of the plurality of data sets is associated with a different time period, and wherein, for each data set of the plurality of data sets, each log message of the set of log messages is associated with a timestamp within a time period. 18. The computer-program product of claim 16, wherein the first shape is not clustered with a third shape representing a third multi-stage structure, wherein the first shape and the third shape are different from each other. 19. The computer-program product of claim 15, wherein a hashing algorithm is executed on each of the first multi-stage structure and the second multi-stage structure, wherein executing the hashing algorithm generates a hash value, and wherein the hash value for each of the first multi-stage structure and the second multi-stage structure is the same. 20. The computer-program product of claim 19, wherein the hashing algorithm receives as an input a strength of each connection of the set of connections, wherein the strength is indicative of a count of log messages in a subset of the set of log messages, wherein the subset of log messages flows from the first node to the second node, and wherein the clustering of the data sets of the plurality of data sets is further based at least in part on the strength of each connection of the set of connections.