Log query method and device, computer equipment and storage medium

Abstract

The invention relates to a log query method and device, computer equipment, a storage medium and a computer program product. The method comprises the steps of obtaining a log query text; determining a plurality of matching feature vectors corresponding to the log query text based on the keyword feature vectors corresponding to the log query text and a vector database; determining a target feature vector corresponding to the log query text based on the similarity between the semantic feature vector corresponding to the log query text and the matching feature vector; generating a target query statement corresponding to the log query text based on the target feature vector; and inputting the log query statement into a log query system to obtain a target query log corresponding to the log query text. By adopting the method, the log query efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a log query method, device, computer equipment and storage medium. Background Art

[0002] With the development of computer technology, the number of logs has shown a rapid growth trend. When you need to view logs, you first need to find the logs you need to view from the massive logs.

[0003] In traditional technology, query statements that conform to the grammatical rules of the log query system are entered into the log query system. The query statements include log field names, search keywords, time ranges, conditional operators, and sorting methods, etc. This takes a lot of time and results in low efficiency of log query. Summary of the invention

[0004] Based on this, it is necessary to provide a log query method, apparatus, computer device and computer-readable storage medium that can improve log query efficiency in response to the above technical problems.

[0005] In a first aspect, the present application provides a log query method. The method comprises:

[0006] Get the log query text;

[0007] Determine a plurality of matching feature vectors corresponding to the log query text based on the keyword feature vector corresponding to the log query text and a vector database;

[0008] Determining a target feature vector corresponding to the log query text based on a similarity between the semantic feature vector corresponding to the log query text and the matching feature vector;

[0009] Based on the target feature vector, generating a target query statement corresponding to the log query text;

[0010] The log query statement is input into a log query system to obtain a target query log corresponding to the log query text.

[0011] In one embodiment, the step of acquiring the vector database includes:

[0012] For each storage log generated by the business system, based on keywords in the storage log, generate a first feature vector corresponding to the storage log;

[0013] Based on the semantic features of the storage log, generating a second feature vector corresponding to the storage log;

[0014] For a business data table in the business system, generating a business data feature vector corresponding to the business data table;

[0015] A vector database is obtained based on the first feature vectors and the second feature vectors corresponding to the plurality of storage logs and the business data feature vectors corresponding to the plurality of business data tables.

[0016] In one embodiment, the determining a plurality of matching feature vectors corresponding to the log query text based on the keyword feature vector corresponding to the log query text and the vector database includes:

[0017] For each candidate feature vector in the vector database, calculating the similarity between the keyword feature vector and the candidate feature vector to obtain a first similarity corresponding to the candidate feature vector;

[0018] A preset number of candidate feature vectors are obtained in descending order of the first similarities, and the obtained candidate feature vectors are determined as matching feature vectors corresponding to the log query text.

[0019] In one embodiment, determining the target feature vector corresponding to the log query text based on the similarity between the semantic feature vector corresponding to the log query text and the matching feature vector includes:

[0020] For each of the matching feature vectors, calculating the similarity between the matching feature vector and the semantic feature vector to obtain a second similarity corresponding to the matching feature vector;

[0021] Comparing the second similarities corresponding to the plurality of matching feature vectors to obtain the maximum second similarity;

[0022] The matching feature vector corresponding to the largest second similarity is determined as the target feature vector corresponding to the log query text.

[0023] In one embodiment, generating a target query statement corresponding to the log query text based on the target feature vector includes:

[0024] The target feature vector is input into a target large language model to obtain a target query sentence corresponding to the log query text.

[0025] In one embodiment, before determining a plurality of matching feature vectors corresponding to the log query text based on the keyword feature vector corresponding to the log query text and the vector database, the method further includes:

[0026] Performing word segmentation processing on the log query text to obtain multiple candidate words of the log query text;

[0027] Filtering keywords from the plurality of candidate words;

[0028] Based on the keyword, generating a keyword feature vector corresponding to the log query text;

[0029] Before determining the target feature vector corresponding to the log query text based on the similarity between the semantic feature vector corresponding to the log query text and the matching feature vector, the method further includes:

[0030] Semantic feature extraction is performed on the multiple log query texts to obtain semantic feature vectors corresponding to the log query texts.

[0031] In a second aspect, the present application also provides a log query device. The device comprises:

[0032] The acquisition module is used to obtain the log query text;

[0033] A first matching module, configured to determine a plurality of matching feature vectors corresponding to the log query text based on the keyword feature vector corresponding to the log query text and a vector database;

[0034] A second matching module, configured to determine a target feature vector corresponding to the log query text based on a similarity between the semantic feature vector corresponding to the log query text and the matching feature vector;

[0035] A query statement generating module, used for generating a target query statement corresponding to the log query text based on the target feature vector;

[0036] The query module is used to input the log query statement into the log query system to obtain the target query log corresponding to the log query text.

[0037] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0038] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0039] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0040] In the log query method, device, computer device, storage medium and computer program product, the computer device obtains a log query text, which may be a text that does not conform to the grammatical rules of the log query system. The computer device first determines a plurality of candidate feature vectors that match the keyword feature vector with a high similarity from a vector database according to the keyword feature vector corresponding to the log query text, as the plurality of matching feature vectors corresponding to the log query text, that is, the candidate feature vectors are screened for the first time; secondly, according to the semantic feature vector corresponding to the log query text, a matching feature vector that matches the semantic feature vector is determined from a plurality of matching feature vectors, as the target feature vector corresponding to the log query text, that is, the candidate feature vectors are screened for the second time, and the screened target feature vector contains not only the keyword information in the log query text, but also the semantic information in the log query text, thereby improving the accuracy of the target feature vector, and generating a target query statement corresponding to the log query text based on the target feature vector, inputting the log query statement into the log query system, and obtaining a target query log corresponding to the log query text, thereby improving the accuracy of the target query log, and even for the log query text that does not conform to the grammatical rules of the log query system, the target query log corresponding to the log query text can be quickly obtained, thereby improving the efficiency of the log query. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] FIG1 is an application environment diagram of a log query method in one embodiment;

[0042] FIG2 is a schematic diagram of a flow chart of a log query method in an embodiment;

[0043] FIG3 is a schematic flow chart of a vector database acquisition step in one embodiment;

[0044] FIG4 is a schematic diagram of an inverted index table in one embodiment;

[0045] 5 is a schematic diagram of the deployment of an intelligent log service system, a business system, and a log query system in one embodiment;

[0046] Figure 6 A schematic diagram of a storage process for storing logs in an embodiment;

[0047] FIG7 is a schematic diagram of a log query process in one embodiment;

[0048] FIG8 is a structural block diagram of a log query device in one embodiment;

[0049] FIG. 9 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0051] The log query method provided in the embodiment of the present application can be applied in the application environment shown in Figure 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Both the terminal and the server can be used alone to execute the log query method provided in the embodiment of the present application. The terminal and the server can also be used in collaboration to execute the log query method provided in the embodiment of the present application. For example, obtain the log query text; based on the keyword feature vector and vector database corresponding to the log query text, determine the multiple matching feature vectors corresponding to the log query text; based on the similarity between the semantic feature vector corresponding to the log query text and the matching feature vector, determine the target feature vector corresponding to the log query text; based on the target feature vector, generate the target query statement corresponding to the log query text; input the log query statement into the log query system to obtain the target query log corresponding to the log query text. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. The portable wearable device may be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0052] In one embodiment, as shown in FIG. 2 , a log query method is provided. This embodiment is described by taking the method applied to a computer device as an example, and includes steps 202 to 210 .

[0053] Step 202: Obtain log query text.

[0054] The log query text refers to the text for querying the log. The log query text may be a log query statement. The log query text may be text that does not conform to the grammatical rules of the log query system, that is, the log query text is input into the log query system and cannot be recognized by the log query system.

[0055] Exemplarily, the querying personnel inputs the log query text into the intelligent log service system of the computer device, and the log service system of the computer device obtains the log query text.

[0056] Step 204: Based on the keyword feature vector corresponding to the log query text and the vector database, a plurality of matching feature vectors corresponding to the log query text are determined.

[0057] Among them, the keyword feature vector refers to a feature vector generated according to the keywords in the log query text. The vector database refers to a database storing candidate feature vectors, and the candidate feature vectors can be the first feature vector corresponding to the storage vector, the second feature vector corresponding to the storage vector, and the business data feature vector corresponding to the business data table. The first feature vector and the second feature vector corresponding to the storage vector are feature vectors generated using different feature vector generation methods.

[0058] Exemplarily, the intelligent log service system of the computer device obtains keywords from the log query text, generates keyword feature vectors based on the keywords, and determines multiple matching feature vectors corresponding to the log query text based on the similarity between the keyword feature vector and the candidate feature vectors in the vector database.

[0059] Step 206: Determine a target feature vector corresponding to the log query text based on the similarity between the semantic feature vector corresponding to the log query text and the matching feature vector.

[0060] The semantic feature vector refers to a feature vector generated based on the log query text, which can be understood as a feature vector directly generated based on the log query text without preprocessing the log query text. The semantic feature vector represents the semantic information of the log query text.

[0061] Exemplarily, the intelligent log service system of the computer device generates a semantic feature vector according to the log query text, and determines a target feature vector corresponding to the log query text based on the similarity between the semantic feature vector corresponding to the log query text and the matching feature vector.

[0062] Step 208: Generate a target query statement corresponding to the log query text based on the target feature vector.

[0063] The target query statement refers to a text corresponding to the log query text and conforming to the grammatical rules of the log query system.

[0064] Exemplarily, the intelligent log service system of the computer device inputs the output text requirement and the target feature vector into the target large language model, and the target large language model outputs the target query sentence corresponding to the log query text. The output text requirement refers to the constraint requirement on the target query sentence, and the output text requirement can be set according to the grammatical rules of the log query system.

[0065] Step 210: input the log query statement into the log query system to obtain the target query log corresponding to the log query text.

[0066] The log query system refers to a system that provides functions such as log storage and query, and the log query system can be an ELK (Elasticsearch-Logstash-Kibana, search-log processing-visualization system) system. The target query log refers to the storage log that matches the log query statement, which can be understood as the log query result output by the log query system according to the target query statement.

[0067] Exemplarily, the intelligent log service system of the computer device inputs the log query statement into the log query system, and the log query system outputs the target query log corresponding to the log query text.

[0068] In the above log query method, the computer device obtains a log query text, which may be a text that does not conform to the grammatical rules of the log query system. The computer device first determines multiple candidate feature vectors that match the keyword feature vector with a high similarity from a vector database according to the keyword feature vector corresponding to the log query text, as multiple matching feature vectors corresponding to the log query text, that is, the candidate feature vectors are screened for the first time; secondly, according to the semantic feature vector corresponding to the log query text, a matching feature vector that matches the semantic feature vector is determined from multiple matching feature vectors as a target feature vector corresponding to the log query text, that is, the candidate feature vectors are screened for the second time. The screened target feature vector not only contains the keyword information in the log query text, but also contains the semantic information in the log query text, thereby improving the accuracy of the target feature vector, generating a target query statement corresponding to the log query text based on the target feature vector, inputting the log query statement into the log query system, and obtaining a target query log corresponding to the log query text, thereby improving the accuracy of the target query log, and even for the log query text that does not conform to the grammatical rules of the log query system, the target query log corresponding to the log query text can be quickly obtained, thereby improving the efficiency of the log query.

[0069] In one embodiment, as shown in FIG3 , the step of acquiring the vector database includes:

[0070] Step 302: for each storage log generated by the business system, a first feature vector corresponding to the storage log is generated based on keywords in the storage log.

[0071] Among them, the business system refers to an information system designed and deployed to support the daily business operations, management and decision-making of an enterprise or organization. The storage log refers to the log generated by the business system. The storage log will be stored in the log query system. Keywords refer to words with high importance in the storage log. The first feature vector refers to a feature vector generated based on multiple keywords in the storage log. The first feature vector refers to a feature vector that represents the keywords in the storage log.

[0072] Exemplarily, after generating a storage log, the business system of a computer device saves the storage log in a log query system, then analyzes the storage log to obtain multiple words corresponding to the storage log, obtains an inverted index table, obtains the occurrence frequency corresponding to each word based on the inverted index table, determines the words whose occurrence frequency is greater than the frequency threshold as keywords, and generates a first feature vector corresponding to the storage log based on the multiple keywords.

[0073] In one embodiment, obtaining an inverted index table includes: obtaining the logs to be queried in the log query system, segmenting each log to be queried, and obtaining multiple segmentation words corresponding to the logs to be queried; for each segmentation word, determining the belonging log corresponding to the segmentation word, establishing a corresponding relationship between the segmentation word and the corresponding belonging log, and obtaining an inverted index table. For example, in the inverted index table shown in FIG4, the segmentation word User corresponds to log 1, log 2, and log 3, which means that the segmentation word User is included in log 1, log 2, and log 3. The log to be queried refers to the log stored in the log query system. The belonging log refers to the log to be queried that contains the segmentation word. That is, the inverted index table is not a fixed correspondence, but changes with the change of the log to be queried in the log query system, thereby improving the accuracy of the inverted index table.

[0074] In one embodiment, the occurrence frequency corresponding to each word is obtained based on the inverted index table, including: for each word in the stored log, obtaining the belonging log corresponding to the word from the inverted index table, counting the number of belonging logs to obtain a first statistical number, counting the logs to be queried in the log query system to obtain a second statistical number, and obtaining the occurrence frequency corresponding to the word based on the ratio between the first statistical number and the second statistical number.

[0075] Step 304: Generate a second feature vector corresponding to the storage log based on the semantic feature of the storage log.

[0076] The second feature vector refers to a vector representing the speech feature of the stored log.

[0077] Exemplarily, the business system of the computer device extracts semantic features from the storage log to obtain a second feature vector corresponding to the storage log.

[0078] Step 306: Generate a business data feature vector corresponding to the business data table in the business system.

[0079] Among them, the business data table refers to the data table of the business system, which includes but is not limited to the business data table identifier, field identifier and field value, etc. In the business data table, there is an association relationship among the business data table identifier, multiple field identifiers and multiple field values.

[0080] Exemplarily, the business system of the computer device obtains data table features from each business data table in the business system, and generates a business data feature vector corresponding to the business data table based on the data table features. The data table features may be information characterizing features of the business data table, such as a business data table identifier, ID (Identifier) ​​and tax number in the business data table.

[0081] Step 308: Obtain a vector database based on the first feature vectors and the second feature vectors corresponding to the multiple storage logs and the business data feature vectors corresponding to the multiple business data tables.

[0082] Exemplarily, the business system of the computer device saves the first feature vector and the second feature vector corresponding to each storage log, and the business data feature vector corresponding to each business data table, to the vector database.

[0083] In this embodiment, when a storage log is generated by the business system, the business system of the computer device generates a first feature vector corresponding to the storage log based on the keywords in the storage log, generates a second feature vector corresponding to the storage log based on the semantic features of the storage log, and saves the first feature vector and the second feature vector corresponding to the storage log in the vector database. In addition, for the business data table in the business system, a business data feature vector corresponding to the business data table is generated, and the business data feature vector corresponding to the business data table is saved in the vector database. That is, the vector database not only saves the first feature vector representing the keyword information of the storage log and the second feature vector representing the semantic information of the storage log, but also saves the business data feature vector representing the business data table information, thereby providing rich basic data for the subsequent determination of the target feature vector.

[0084] In one embodiment, based on the keyword feature vector corresponding to the log query text and the vector database, determining multiple matching feature vectors corresponding to the log query text includes:

[0085] For each candidate feature vector in the vector database, the similarity between the keyword feature vector and the candidate feature vector is calculated to obtain a first similarity corresponding to the candidate feature vector; a preset number of candidate feature vectors are obtained in descending order of the first similarities, and the obtained candidate feature vectors are determined as matching feature vectors corresponding to the log query text.

[0086] The candidate feature vector refers to a feature vector stored in a vector database. The first similarity refers to the similarity between the keyword feature vector and the candidate feature vector, and the similarity can be one of cosine similarity, Euclidean distance, Jaccard similarity coefficient, and Pearson correlation coefficient. The preset number refers to a preset number, and the preset number can be set according to demand and is not limited here. For example, the preset number is 10 or 20.

[0087] Exemplarily, the intelligent log service system of the computer device calculates the similarity between the keyword feature vector and the candidate feature vector in the vector database, obtains the first similarity corresponding to the candidate feature vector, and then obtains a preset number of candidate feature vectors in order of the first similarity from large to small, and determines the obtained candidate feature vectors as the matching feature vectors corresponding to the log query text.

[0088] In this embodiment, by calculating the similarity between the keyword feature vector and the candidate feature vector, the first similarity corresponding to the candidate feature vector is obtained, and the candidate feature vectors corresponding to the preset number of the largest first similarities are selected as the matching feature vectors corresponding to the log query text. That is, the candidate feature vectors in the vector database are screened for the first time to screen out multiple candidate feature vectors that best match the keyword feature vector, and the candidate feature vectors include the keyword information in the log query text.

[0089] In one embodiment, determining a target feature vector corresponding to the log query text based on the similarity between the semantic feature vector corresponding to the log query text and the matching feature vector includes:

[0090] For each matching feature vector, the similarity between the matching feature vector and the semantic feature vector is calculated to obtain a second similarity corresponding to the matching feature vector; the second similarities corresponding to multiple matching feature vectors are compared to obtain a maximum second similarity; and the matching feature vector corresponding to the maximum second similarity is determined as a target feature vector corresponding to the log query text.

[0091] The second similarity refers to the similarity between the matching feature vector and the semantic feature vector.

[0092] Exemplarily, the intelligent log service system of the computer device calculates the similarity between the matching feature vector and the semantic feature vector to obtain a second similarity corresponding to the matching feature vector, compares the second similarities corresponding to multiple matching feature vectors to obtain the maximum second similarity, and determines the matching feature vector corresponding to the maximum second similarity as the target feature vector corresponding to the log query text.

[0093] In this embodiment, the matching feature vector corresponding to the largest second similarity is determined as the target feature vector corresponding to the log query text, that is, the matching feature vector is screened again to select the target feature vector that best matches the semantic feature vector. The target feature vector includes not only the keyword information in the log query text, but also the semantic information in the target feature vector, thereby improving the accuracy of the target feature vector.

[0094] In one embodiment, based on the target feature vector, a target query statement corresponding to the log query text is generated, including:

[0095] The target feature vector is input into the target large language model to obtain the target query sentence corresponding to the log query text.

[0096] The target large language model refers to a trained large language model, and the target large language model can output a target query statement that conforms to the grammatical rules of the log query system according to the input target feature vector.

[0097] Exemplarily, the intelligent log service system of the computer device inputs the target feature vector into the target large language model, and the target large language model outputs the target query sentence corresponding to the log query text.

[0098] In this embodiment, the target large language model is converted into a target query sentence that conforms to the grammatical rules of the log query system, which provides basic data for subsequently obtaining the target query log corresponding to the log query text.

[0099] In one embodiment, before determining a plurality of matching feature vectors corresponding to the log query text based on the keyword feature vector corresponding to the log query text and the vector database, and determining a target feature vector corresponding to the log query text based on the similarity between the semantic feature vector corresponding to the log query text and the matching feature vector, the method further includes:

[0100] Perform word segmentation on the log query text to obtain multiple candidate words for the log query text; select keywords from the multiple candidate words; generate a keyword feature vector corresponding to the log query text based on the keywords; perform semantic feature extraction on the log query text to obtain a semantic feature vector corresponding to the log query text.

[0101] Among them, candidate words refer to words in the log query text, and keywords refer to candidate words whose occurrence frequency is greater than the frequency threshold.

[0102] Exemplarily, the intelligent log service system of the computer device performs word segmentation processing on the log query text to obtain multiple candidate words for the log query text, obtains an inverted index table, obtains the occurrence frequency corresponding to each candidate word based on the inverted index table, determines the candidate words whose occurrence frequency is greater than the frequency threshold as keywords, and generates a keyword feature vector corresponding to the log query text based on the keywords; performs semantic feature extraction on the log query text to obtain a semantic feature vector corresponding to the log query text.

[0103] In this embodiment, a keyword feature vector of the log query file is generated based on the keywords in the log query file, the keyword feature vector includes the keyword information in the log query file, and semantic features are extracted from the log query text to obtain a semantic feature vector corresponding to the log query text, the semantic feature vector includes the semantic feature information in the log query file, and provides accurate basic data for the subsequent determination of the target feature vector.

[0104] In an exemplary embodiment, a deployment diagram of the intelligent log service system, the business system, and the log query system is shown in FIG5 . The intelligent log service system, the business system, and the log query system are deployed in K8s (Kubernetes, a container orchestration system), and the log service system, the business system, and the log query system interact through the K8s API Server (Kubernetes application programming interface server).

[0105] The storage process diagram of the storage log is as follows: Figure 6 As shown, it includes: a user accesses a business system, the business system generates a storage log, and the storage log is saved in a log query system; then the storage log is analyzed to obtain multiple words corresponding to the storage log, an inverted index table is obtained, the occurrence frequency corresponding to each word is obtained based on the inverted index table, a word with an occurrence frequency greater than a frequency threshold is determined as a keyword, and a first feature vector corresponding to the storage log is generated according to multiple keywords; the business system extracts semantic features from the storage log to obtain a second feature vector corresponding to the storage log; the business system obtains data table features from each business data table in the business system, and generates a business data feature vector corresponding to the business data table based on the data table features; the business system saves the first feature vector and the second feature vector corresponding to each storage log, as well as the business data feature vector corresponding to each business data table, to a vector database.

[0106] The log query process diagram is shown in Figure 7, including: the query personnel inputs the log query text into the intelligent log service system, the log service system obtains the log query text, the intelligent log service system performs word segmentation processing on the log query text, obtains multiple candidate words of the log query text, obtains an inverted index table, obtains the occurrence frequency corresponding to each candidate word based on the inverted index table, determines the candidate word with an occurrence frequency greater than the frequency threshold as a keyword, and generates a keyword feature vector corresponding to the log query text based on the keyword; the intelligent log service system calculates the similarity between the keyword feature vector and the candidate feature vector in the vector database, obtains the first similarity corresponding to the candidate feature vector, and then obtains a preset number of candidate feature vectors in descending order of the first similarity, and determines the obtained candidate feature vector as the matching feature vector corresponding to the log query text.

[0107] The intelligent log service system extracts semantic features from the log query text to obtain a semantic feature vector corresponding to the log query text; calculates the similarity between the matching feature vector and the semantic feature vector to obtain a second similarity corresponding to the matching feature vector, compares the second similarities corresponding to multiple matching feature vectors to obtain the maximum second similarity, and determines the matching feature vector corresponding to the maximum second similarity as the target feature vector corresponding to the log query text.

[0108] The intelligent log service system inputs the target feature vector into the target large language model, and the target large language model outputs the target query sentence corresponding to the log query text.

[0109] The intelligent log service system inputs the log query statement into the log query system, the log query system returns the target query log corresponding to the log query text, and the intelligent log service system displays the intelligent log service system.

[0110] In the above log query method, the computer device obtains a log query text, which may be a text that does not conform to the grammatical rules of the log query system. The computer device first determines multiple candidate feature vectors that match the keyword feature vector with a high similarity from a vector database according to the keyword feature vector corresponding to the log query text, as multiple matching feature vectors corresponding to the log query text, that is, the candidate feature vectors are screened for the first time; secondly, according to the semantic feature vector corresponding to the log query text, a matching feature vector that matches the semantic feature vector is determined from multiple matching feature vectors as a target feature vector corresponding to the log query text, that is, the candidate feature vectors are screened for the second time. The screened target feature vector not only contains the keyword information in the log query text, but also contains the semantic information in the log query text, thereby improving the accuracy of the target feature vector, generating a target query statement corresponding to the log query text based on the target feature vector, inputting the log query statement into the log query system, and obtaining a target query log corresponding to the log query text, thereby improving the accuracy of the target query log, and even for the log query text that does not conform to the grammatical rules of the log query system, the target query log corresponding to the log query text can be quickly obtained, thereby improving the efficiency of the log query.

[0111] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0112] Based on the same inventive concept, the embodiment of the present application also provides a log query device for implementing the log query method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more log query device embodiments provided below can refer to the limitations on the log query method above, and will not be repeated here.

[0113] In one embodiment, as shown in FIG. 8 , a log query device is provided, including: an acquisition module 802 , a first matching module 804 , a second matching module 806 , a query statement generation module 808 and a query module 810 , wherein:

[0114] The acquisition module 802 is used to acquire the log query text;

[0115] A first matching module 804, configured to determine a plurality of matching feature vectors corresponding to the log query text based on the keyword feature vector corresponding to the log query text and a vector database;

[0116] A second matching module 806, configured to determine a target feature vector corresponding to the log query text based on the similarity between the semantic feature vector corresponding to the log query text and the matching feature vector;

[0117] A query statement generating module 808 is used to generate a target query statement corresponding to the log query text based on the target feature vector;

[0118] The query module 810 is used to input the log query statement into the log query system to obtain the target query log corresponding to the log query text.

[0119] In one embodiment, the acquisition module 802 is also used to: for each storage log generated by the business system, generate a first feature vector corresponding to the storage log based on the keywords in the storage log; generate a second feature vector corresponding to the storage log based on the semantic features of the storage log; for the business data table in the business system, generate a business data feature vector corresponding to the business data table; obtain a vector database based on the first feature vectors and the second feature vectors corresponding to multiple storage logs, and the business data feature vectors corresponding to multiple business data tables.

[0120] In one embodiment, the first matching module 804 is also used to: for each candidate feature vector in the vector database, calculate the similarity between the keyword feature vector and the candidate feature vector to obtain a first similarity corresponding to the candidate feature vector; obtain a preset number of candidate feature vectors in order of the first similarities from large to small, and determine the obtained candidate feature vectors as matching feature vectors corresponding to the log query text.

[0121] In one embodiment, the second matching module 806 is also used to: for each matching feature vector, calculate the similarity between the matching feature vector and the semantic feature vector to obtain a second similarity corresponding to the matching feature vector; compare the second similarities corresponding to multiple matching feature vectors to obtain the maximum second similarity; and determine the matching feature vector corresponding to the maximum second similarity as the target feature vector corresponding to the log query text.

[0122] In one embodiment, the query statement generation module 808 is further used to: input the target feature vector into the target large language model to obtain a target query statement corresponding to the log query text.

[0123] In one embodiment, the acquisition module 810 is also used to: perform word segmentation on the log query text to obtain multiple candidate words for the log query text; filter out keywords from the multiple candidate words; generate a keyword feature vector corresponding to the log query text based on the keywords; perform semantic feature extraction on multiple log query texts to obtain a semantic feature vector corresponding to the log query text.

[0124] Each module in the above-mentioned log query device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0125] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG9. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a log query method is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0126] Those skilled in the art will understand that the structure shown in FIG. 9 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0127] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0128] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0129] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0130] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0131] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0132] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0133] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A log query method, characterized in that: The method comprises: Get the log query text; Determine a plurality of matching feature vectors corresponding to the log query text based on the keyword feature vector corresponding to the log query text and a vector database; Determining a target feature vector corresponding to the log query text based on a similarity between the semantic feature vector corresponding to the log query text and the matching feature vector; Based on the target feature vector, generating a target query statement corresponding to the log query text; The log query statement is input into a log query system to obtain a target query log corresponding to the log query text.

2. The method according to claim 1, characterized in that The step of acquiring the vector database includes: For each storage log generated by the business system, based on keywords in the storage log, generate a first feature vector corresponding to the storage log; Based on the semantic features of the storage log, generating a second feature vector corresponding to the storage log; For a business data table in the business system, generating a business data feature vector corresponding to the business data table; A vector database is obtained based on the first feature vectors and the second feature vectors corresponding to the plurality of storage logs and the business data feature vectors corresponding to the plurality of business data tables.

3. The method according to claim 1, characterized in that The determining, based on the keyword feature vector corresponding to the log query text and the vector database, a plurality of matching feature vectors corresponding to the log query text comprises: For each candidate feature vector in the vector database, calculating the similarity between the keyword feature vector and the candidate feature vector to obtain a first similarity corresponding to the candidate feature vector; A preset number of candidate feature vectors are obtained in descending order of the first similarities, and the obtained candidate feature vectors are determined as matching feature vectors corresponding to the log query text.

4. The method according to claim 1, characterized in that: The determining, based on the similarity between the semantic feature vector corresponding to the log query text and the matching feature vector, a target feature vector corresponding to the log query text comprises: For each of the matching feature vectors, calculating the similarity between the matching feature vector and the semantic feature vector to obtain a second similarity corresponding to the matching feature vector; Comparing the second similarities corresponding to the plurality of matching feature vectors to obtain the maximum second similarity; The matching feature vector corresponding to the largest second similarity is determined as the target feature vector corresponding to the log query text.

5. The method according to claim 1, characterized in that The step of generating a target query statement corresponding to the log query text based on the target feature vector includes: The target feature vector is input into a target large language model to obtain a target query sentence corresponding to the log query text.

6. The method according to any one of claims 1 to 5, characterized in that Before determining a plurality of matching feature vectors corresponding to the log query text based on the keyword feature vector corresponding to the log query text and the vector database, the method further includes: Performing word segmentation processing on the log query text to obtain multiple candidate words of the log query text; Filtering keywords from the plurality of candidate words; Based on the keyword, generating a keyword feature vector corresponding to the log query text; Before determining the target feature vector corresponding to the log query text based on the similarity between the semantic feature vector corresponding to the log query text and the matching feature vector, the method further includes: Semantic feature extraction is performed on the multiple log query texts to obtain semantic feature vectors corresponding to the log query texts.

7. A log query device, characterized in that: The device comprises: The acquisition module is used to obtain the log query text; A first matching module, configured to determine a plurality of matching feature vectors corresponding to the log query text based on the keyword feature vector corresponding to the log query text and a vector database; A second matching module, configured to determine a target feature vector corresponding to the log query text based on a similarity between the semantic feature vector corresponding to the log query text and the matching feature vector; A query statement generating module, used for generating a target query statement corresponding to the log query text based on the target feature vector; The query module is used to input the log query statement into the log query system to obtain the target query log corresponding to the log query text.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images