A conditional query method and system for distributed logs based on cuckoo filter

Abstract

The invention discloses a distributed log condition query method based on a cuckoo filter, comprising: obtaining a condition query request sent by a client, performing data query in a pre-built hot database according to the condition query request, and judging the query Whether the total amount of data received is lower than the amount of data corresponding to the conditional query request, if so, process the conditional query request to obtain the identification string, use the identification string as the key (Key), and store data in the unpopular condition cache layer Query to determine whether there is a value (Value) corresponding to the key in the unpopular condition cache layer. If not, execute the query operation in the pre-built cold database data sub-table according to the condition query request to obtain the condition query result, and set the condition The query data result processing generates a JSON string, uses the identification string as a key, and uses the JSON string as a value to form a key-value pair, and stores the key-value pair in the unpopular condition cache layer.

Description

Technical field [0001] The present invention belongs to the field of computer technology, more particularly, relates to a distributed log condition query method and system based on a cuckoo filter. Background [0002] With the rapid popularization of Internet of Things technology, terminal devices in the field of industrial control will generate a huge amount of log data every day for security analysis and evaluation of terminal devices and statistical management. How to conveniently and quickly query the targeted conditions in the huge industrial control log data set stored for months or even years has become a common and severe problem that the industrial control management system needs to face. [0003] The existing log condition query methods include distributed database sub-database or table-splitting and then querying operations and caching data. Database sharding refers to dividing a single database into multiple databases according to the system business or the possibili...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the above defects or improvement needs of the prior art, the present invention provides a distributed log condition query method and system based on a cuckoo filter. The technical problem of query time consumption, and the existing method of pre-segmenting tables for the database needs to face the technical problem of system performance degradation caused by too many sub-tables, and the existing method of adding data cache in the system cannot effectively solve the condition When querying, the query requirements of multi-field condition matching, spend a lot of time, and greatly affect the technical problems of the overall performance of the system

Images