The disclosed technology relates to log file processing techniques for root cause analysis of a network fabric. A system may be configured to identify a feature of interest in a log file and calculating an abnormal level for the feature of interest. The system is further configured to detect that a performance event has occurred during a time period, determine whether the feature of interest is at the abnormal level during the time period, and identify a correlation between the feature of interest and the performance event based on the determining.