Business log analysis method and device, electronic equipment and storage medium

Abstract

The invention discloses a business log analysis method and device, electronic equipment and a storage medium, and relates to the technical field of log analysis. Generating target log data containing a target field according to related log data of each transfer node in the business creation transfer process, the target field comprises an identification field of the current transfer node, an identification field representing an association relationship between the current transfer node and other transfer nodes in a business creation transfer process, and a target log content field corresponding to the current transfer node; creating an index for the target field in a search engine; and when the query service for the target field content is received, the queried target log content associated with the target field content is aggregated and fed back to the query end, so that the problems that the log data of each node is dispersed, and the related log data cannot be quickly analyzed and then quickly positioned are solved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of log analysis, and in particular to a business log analysis method, device, electronic device, storage medium, and program product. Background Art

[0002] For businesses that include multiple transfer nodes, when performing anomaly analysis on the transfer process of business creation, the logs scattered across each transfer node are usually combined to perform anomaly analysis and troubleshooting one by one. For example, for an advertising delivery system that includes multiple transfer nodes, the delivery link of the advertising delivery system generally includes multiple transfer nodes such as advertising creation, review, post-review creation, and online / offline delivery. In related technologies, when problems arise in the delivery of advertisements corresponding to an advertising business, the link problem is generally analyzed based on the log data scattered across each transfer node, and the entire link problem analysis process requires repeated communication with the developers of each transfer node to locate the problem, resulting in an inability to quickly locate the link where the problem occurs. Summary of the Invention

[0003] In view of this, the present disclosure provides a business log analysis method, device, electronic device, storage medium and program product to solve the problem of low efficiency of existing multi-transfer node business anomaly analysis based on the logs of each transfer node.

[0004] In a first aspect, the present disclosure provides a business log analysis method, the method comprising: in response to receiving a call operation for a log aggregation analysis function, generating target log data containing target fields based on relevant log data of each flow node in the business creation flow process, the target fields comprising: an identification field of the current flow node, an identification field representing the association relationship between the current flow node and other flow nodes in the business creation flow process, and a target log content field corresponding to the current flow node; creating an index for the target field in a search engine; and when receiving a query service for the target field content, aggregating the target log content associated with the target field content that has been queried and feeding it back to the query end.

[0005] In the second aspect, the present disclosure provides a business log analysis device, which includes: a first generation module, which is used to generate target log data containing target fields based on the relevant log data of each flow node in the business creation flow process in response to receiving a call operation for the log aggregation analysis function, and the target field includes: an identification field of the current flow node, an identification field representing the association relationship between the current flow node and other flow nodes in the business creation flow process, and a target log content field corresponding to the current flow node; a creation module, which is used to create an index for the target field in a search engine; an aggregation module, which is used to aggregate the target log content associated with the target field content when receiving a query service for the target field content and feed it back to the query end.

[0006] In a third aspect, the present disclosure provides an electronic device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, computer instructions being stored in the memory, and the processor executing the business log analysis method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0007] In a fourth aspect, the present disclosure provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the business log analysis method of the first aspect or any corresponding embodiment thereof.

[0008] In a fifth aspect, the present disclosure provides a computer program product, including computer instructions, which are used to enable a computer to execute the business log analysis method of the first aspect or any corresponding embodiment thereof.

[0009] The business log analysis method provided by the embodiment of the present disclosure generates target log data including an identification field of the current flow node, an identification field representing the association relationship between the current flow node and other flow nodes in the business creation flow process, and a target log content field corresponding to the current flow node by calling the log aggregation analysis function and based on relevant log data in the business creation flow process. The target log data is stored in a search engine and the target field is indexed. Upon receiving a query service for the target field content, the target log content associated with the target field content can be aggregated and fed back to the query end according to the corresponding identification field, thereby solving the problem that the existing log data of each node is scattered and the relevant log data cannot be quickly analyzed and then quickly located. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the related technologies, the following briefly introduces the drawings required for use in the specific embodiments or related technical descriptions. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0011] Figure 1 is a schematic diagram corresponding to the business log analysis method according to an embodiment of the present disclosure;

[0012] Figure 2 is a flowchart of a business log analysis method according to an embodiment of the present disclosure;

[0013] Figure 3 is a schematic diagram corresponding to the business log analysis method according to an embodiment of the present disclosure;

[0014] Figure 4 is a schematic diagram corresponding to the business log analysis method according to an embodiment of the present disclosure;

[0015] Figure 5 is a structural block diagram of a service log analysis device according to an embodiment of the present disclosure;

[0016] Figure 6 Schematic diagram of the hardware structure of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0017] To make the purpose, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present disclosure.

[0018] It is understandable that before using the technical solutions disclosed in the various embodiments of this disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved in this disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0019] For example, in response to a user's active request, a prompt message is sent to the user to clearly inform the user that the operation requested will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the electronic device, application, server, storage medium, or other software or hardware that performs the operations of the disclosed technical solution based on the prompt message.

[0020] As an optional but non-limiting implementation, in response to receiving a user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. Furthermore, the pop-up window may also contain a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0021] It is understandable that the above notification and user authorization process are merely illustrative and do not limit the implementation of the present disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0022] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) must comply with the requirements of relevant laws, regulations and relevant provisions.

[0023] For businesses with multiple transfer nodes, when analyzing the abnormality of the transfer process of business creation, it is usually combined with the logs scattered in each transfer node to analyze and troubleshoot the abnormality one by one. For example, for an advertising delivery system with multiple transfer nodes, Figure 1 The advertising delivery system shown may include a business line interface module 1 and an advertising delivery link module 2, wherein the business line interface module 1 may include interfaces for advertising development corresponding to various types of businesses, and enter the advertising delivery link module 2 of the corresponding business by calling the interface of the corresponding business; the flow nodes contained in the advertising delivery link module 2 may include creation nodes, review nodes, post-review creation nodes, automation nodes, database nodes and investment event nodes, wherein the creation nodes can be used for the creation and configuration of advertising creativity and delivery plans, the review nodes are used to review the created advertising content to ensure the compliance of the advertising content and the rationality of the delivery strategy, the post-review creation nodes are used for supplementary configuration and optimization adjustments after the review is passed, the automation nodes are used to automate the delivery process based on preset rules, the database nodes are used to store advertising-related data after creation (such as advertising creative information), and the investment event nodes are used to monitor the delivery status in real time after delivery and respond to dynamic events. Each flow node in the advertising delivery link module 2 generates corresponding log data. When an advertising delivery problem occurs in the advertising business, it is necessary to analyze the delivery link problem based on the log data scattered in each flow node, which makes it impossible to quickly locate the flow link where the problem occurs. For example, if the cause of the problem is unreasonable configuration of the delivery plan of the creation node or incompatibility of the audit strategy of the audit node, etc., it is necessary to obtain the corresponding log data from each flow node to check the cause of the link failure one by one.

[0024] Each transfer node may have multiple microservice businesses based on its corresponding functions. Taking the advertising delivery process as an example, for the creation node, its corresponding microservice business may include advertising creativity and corresponding creative material configuration microservices, delivery strategy configuration microservices, etc.; for the review node, its corresponding microservice business may include review strategy parameter configuration microservices, review method configuration microservices (such as automated review or automated and manual review), etc. Since there are many types of microservices corresponding to each transfer node, when troubleshooting advertising delivery problems, each transfer node also contains many internal sub-flow links, and each internal sub-flow link will also generate corresponding log data, resulting in a long problem troubleshooting path. At the same time, the log data format or archiving timeliness of each scattered transfer node may also be different. These problems will affect the problem troubleshooting, so the embodiment of the present application proposes a business log analysis method to solve the above-mentioned technical problems.

[0025] According to an embodiment of the present disclosure, an embodiment of a business log analysis method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0026] In this embodiment, a service log analysis method is provided, which can be used on any electronic device capable of executing the method, such as a server. Figure 2 is a flow chart of a business log analysis method according to an embodiment of the present disclosure, such as Figure 2 As shown, the process includes the following steps:

[0027] Step S101, in response to receiving a call operation for the log aggregation and analysis function, generates target log data containing target fields based on the relevant log data of each flow node in the business creation flow process. The target fields include: an identification field of the current flow node, an identification field representing the association relationship between the current flow node and other flow nodes in the business creation flow process, and a target log content field corresponding to the current flow node.

[0028] For example, in the embodiment of the present application, the call operation of the log aggregation analysis function can be to configure an interactive control in the corresponding business system, trigger the interactive control to enable the function, and enable the function to extract the relevant log data of the corresponding flow node in the business flow process according to the target field. The relevant log data of each flow node may include: the flow log data corresponding to the current flow node in the business creation flow process, the microservice call data corresponding to the current flow node in the business creation flow process, and the business database operation record data corresponding to the corresponding flow log data, so as to avoid the log data of the flow node not being archived in time, affecting the acquisition operation of the log content of the target field, such as the call operation record of the corresponding data in the flow log data that has not been archived in time can be supplemented according to the business database operation record data corresponding to the flow log data, and then the log data of the call of the data in the database can be obtained according to the business database operation record data corresponding to the flow log data.

[0029] In the embodiment of the present application, the target field includes an identification field of the current flow node, which is used to represent the identification of each flow link corresponding to the current business. Taking the advertising delivery business as an example, the identification field of the current flow node may include a creation node identification field and an audit node identification field; the identification field for representing the association relationship between the current flow node and other flow nodes in the business creation flow process may be a field that represents the association relationship between each node corresponding to the business creation flow process and its upstream / downstream points. For example, by setting an "upstream flow node field" in the target field, the upstream flow node corresponding to the current flow node can be clearly determined by filling in the identification of the corresponding upstream field in the "upstream flow node field". It may also include a downstream flow node identification field, which can be determined by those skilled in the art according to actual needs; by setting an identification field that represents the association relationship between the current flow node and other flow nodes in the business creation flow process, it is possible to quickly and accurately extract the log data of the associated nodes based on the associated flow node identification during log query analysis, and to perform log data drill-down analysis operations; the embodiment of the present application does not limit the specific representation method of each identification field, which can be determined by those skilled in the art according to actual needs. The target field in the embodiment of the present application also includes a target log content field corresponding to the corresponding process node, such as the target log content field includes a detailed log content field (msg) of the corresponding flow node, and the log content corresponding to the detailed log content identification field contains log data of the business creation process corresponding to the specific target field content. By establishing an association relationship with the corresponding target field, the corresponding log data, the timestamp field (time_ms) when recording the log, the debug type data field (level), and the exception or error description field (err_msg) can be obtained according to the specific field content. The target log data generated in the embodiment of the present application only contains specific type data representing the debug type data field, such as info, warming, error, etc., and does not display the specific debug content. The specific debug content can be stored in the database.

[0030] The target log data containing the target field generated in the embodiment of the present application can be classified and stored according to each flow node according to the flow identification field of all flow nodes involved in the business creation process, the identification field of the corresponding upstream and downstream association relationship, the corresponding target log content field, and the field content corresponding to each field. For example, the log data corresponding to the audit node is generated according to the field content specified by the above-mentioned target field and stored in a template, such as a table template; the identification field of the current flow node in the target field can be used to distinguish which type of flow node the log data corresponds to. The identification field in the target field that represents the association relationship between the current flow node and other flow nodes in the business creation flow process can accurately know the other nodes corresponding to the upstream or downstream of the current audit node, so as to clarify the flow relationship of each node in the business creation process, and the target log content included in the target log data can make it possible to directly associate the corresponding log content according to the search result of the identification field when searching through the identification field, so as to achieve comprehensive, accurate and fast acquisition of the log content in the business creation process and further analysis of problems arising in the business based on the acquired log content. In addition to the specific field types contained in the above-mentioned target fields, the embodiments of the present application may also include a unified identifier of the business log of the business link corresponding to the current flow node. The unified identifier can be used to distinguish the log data of different links, and all log data of the business link where the current flow node is located can be directly extracted through the unified identifier.

[0031] Step S102: Create an index for the target field in the search engine. For example, the specific field content of the generated target log data can be stored in a search engine (such as ES) or in other databases. By creating an index for the target field in the target log data in the search engine, subsequent query operations based on the indexed target log data can be implemented.

[0032] Step S103: When a query service for the target field content is received, the target log content associated with the target field content is aggregated and fed back to the query end.

[0033] Exemplarily, if the received target field content to be queried is an audit node identifier, all target log data corresponding to the audit node in the target log data stored by the search engine are extracted, aggregated, and fed back to the query end; or, based on analysis requirements, all relevant target log data of the current audit node and the upstream creation node are aggregated and fed back to the query end according to the identification information contained in the upstream flow node identification field associated with the audit node (such as the upstream flow node is a creation node); or the upstream flow node identification field corresponding to the current flow node is set to a visual control that can receive touch operations, and the label information of the visual control is the upstream flow node identifier. When it is necessary to further obtain the log data of the upstream flow node, directly touching the control will display the corresponding log data.

[0034] The business log analysis method provided by this embodiment generates target log data including an identification field of the current flow node, an identification field representing the association relationship between the current flow node and other flow nodes in the business creation flow process, and a target log content field corresponding to the current flow node by calling the log aggregation analysis function and based on relevant log data in the business creation flow process. The target log data is stored in a search engine and the target field is indexed. Upon receiving a query service for the target field content, the target log content associated with the target field content can be aggregated and fed back to the query end according to the corresponding identification field, thereby solving the problem that the existing log data of each node is scattered and the relevant log data cannot be quickly analyzed and then quickly located.

[0035] In some optional implementations, the method further includes: obtaining a constructed log collection configuration template, and obtaining a target field from fields included in the target collection configuration template.

[0036] For example, the log collection configuration template may include a variety of field types, and those skilled in the art can pre-configure the included fields based on actual log analysis needs. The log aggregation analysis tool can directly generate target log data containing target fields based on the definition of the fields included in the configured target collection configuration template. By setting a configurable log collection configuration template, flexible collection of different types of log content can be achieved.

[0037] In some optional embodiments, the method also includes: when any flow node includes multiple sub-flow nodes, target log data containing a target field is generated based on the relevant log data corresponding to each sub-flow node, and the field content corresponding to the identification field in the target field that represents the association relationship between the current flow node and other flow nodes in the business creation flow process includes the identification of the upstream flow node or upstream sub-flow node corresponding to the sub-flow process where the current sub-flow node is located.

[0038] For example, for an advertisement review node, its corresponding multiple sub-flow nodes may include an advertisement review sub-node, a content review sub-node, etc., and for a content review sub-node, it may be divided into a first-level content review sub-node and a second-level content review sub-node. In the embodiment of the present application, for each sub-flow node corresponding to any flow node, the target log data corresponding to each sub-flow node is generated according to the above-mentioned method of generating target log data based on the relevant log data of the flow node, wherein for the identification field contained in the target field that represents the association relationship between the current flow node and other flow nodes in the business creation flow process, the corresponding identification field content includes the upstream corresponding flow node identifier or the identifier of the upstream sub-flow node in the sub-flow process where the sub-flow node is located. For example, for a content review sub-node, the content of the identification field that represents its upstream association relationship is the identifier of the upstream advertisement review node, and for a first-level content review sub-node, the content of the identification field that represents its upstream association relationship is the upstream content review sub-node. By setting the upstream associated node information, you can implement the tracing operation of the previous flow process log. At the same time, you can also include the identifier of the corresponding downstream sub-flow node to clarify the upstream and downstream position relationship of the current flow node in the flow process. By further constructing the target log data for the included sub-flow nodes, you can achieve more detailed log queries. For example, you can directly query the identifier of any target sub-flow node to obtain the query results of the log data corresponding to the target sub-flow node.

[0039] In some optional implementations, the target field also includes: an identification field of the business model adopted by the current flow node during the business creation flow and an identification field of the business model adopted by other associated flow nodes. The business model represents the model adopted by the corresponding flow node to implement the node function.

[0040] For example, in the embodiment of the present application, the fields included in the log collection configuration template include, in addition to the identification field of the current flow node, the identification field representing the association relationship between the current flow node and other flow nodes in the business creation flow process, and the target log content field corresponding to the current flow node, the identification field of the business model adopted by the current flow node in the business creation flow process and the business model identification field adopted by other associated flow nodes. The business model represents the model adopted by the corresponding flow node to implement the node function. For example, for the audit node, its corresponding audit mode configuration microservice can be configured to obtain a variety of audit business models, and each audit business model has a different corresponding audit strategy; as the upstream flow node of the audit node is the creation node, the configuration microservice for the advertising creativity and corresponding creative materials included in the node can be configured to obtain a variety of types of advertising creation business models, and each advertising creation business model has different corresponding creativity and materials. In the target field, add the identification field of the business model (audit model) adopted by the current flow node (audit node) during the business creation flow, as well as the identification field of the business model (advertising creation business model) adopted by other related flow nodes (creation nodes). By setting the business model-related fields, when querying the log content of the corresponding fields, combined with the business models adopted by the queried upstream and downstream flow nodes, it can be clarified whether there are any inapplicable or mismatching issues in the upstream and downstream business models. For example, the adopted audit model cannot achieve a comprehensive review of the content contained in the advertising creation business model, resulting in non-compliant creation content of the generated advertisements, which in turn affects the advertising delivery results.

[0041] In some optional embodiments, the method further includes: responding to a receiving operation of the target field content to be queried input through the interactive interface; when multiple target field contents to be queried are received, merging the multiple target field contents to be queried; generating a query service based on the merged processing result and displaying the query result through the interactive interface.

[0042] Exemplarily, the interactive interface can be set up to fill in the information input interface corresponding to the target field content to be retrieved according to the target field type for indexing. For example, the interactive interface is provided with an identification field of the current flow node and a business model identification field. According to the information input interface, the input data corresponding to the identification field of the current flow node received is "creation node A", and the input data corresponding to the business model identification field is "creative model A". Then, the query service obtained by performing the logic and merge operation is to query "the log data generated by the creative model A in the creation link where the creation node A is located". The query information corresponding to the log data under the corresponding link is fed back to the interactive interface for display, so that the user can review the log data concisely and intuitively.

[0043] In some optional implementations, the target field also includes: a business processing log field within the current transfer node.

[0044] For example, the tasks of each transfer node corresponding to the business creation process are completed by different executors. In view of the differences in the tasks of each transfer node, the corresponding executors will adaptively set the business processing log content that needs to be included in the internal log file based on the task requirements of their own nodes. For example, for the audit node, the business processing log content of its internal adaptive setting may include specific details of the audit result data such as what kind of advertising data caused the advertising audit result to fail during the specific audit process. By adding a business processing log field for the internal transfer node in the target field, it is convenient to troubleshoot and audit the internal log data of the transfer node by obtaining the log content of the corresponding field.

[0045] In some optional implementations, the method further includes: storing the business processing log fields within the transfer node and the corresponding field contents in a first type storage module; and storing other fields in the target field and the corresponding field contents in a second type storage module.

[0046] Exemplarily, the embodiment of the present application does not limit the specific types of the first type storage module and the second type storage module. The first type storage module and the second type storage module can both be set in the search engine, or other fields in the target field and the corresponding field contents can be stored in the search engine (ES). The business processing log field and the corresponding field contents inside the transfer node are stored in other key-value type databases. When a search operation is performed through the search engine, the corresponding field contents are directly obtained from the corresponding storage module according to the field contents to be queried. By storing the business processing log field and the corresponding field contents inside the transfer node, as well as other fields and the corresponding field contents in the target field in different types of storage modules, it is avoided that there are too many field contents corresponding to the business processing log field inside the transfer node. If they are all stored in one storage module, it may affect the creation and query efficiency of log data at the entire business creation level.

[0047] In some optional implementations, the method further includes: obtaining a log display format configuration template corresponding to the business processing log field; and generating target log data for the business processing log field according to the format corresponding to the log display format configuration template based on the log content corresponding to the business processing log field.

[0048] For example, the tasks of different flow nodes are executed by different executors and the specific execution process of each task is different, resulting in different log archiving formats corresponding to the log content contained in the business processing log fields within different flow nodes. Therefore, when the log content corresponding to the business processing log field is obtained, the embodiment of the present application organizes the log content according to the format corresponding to the log display format configuration template to obtain the target log data of the business processing log field. The target log data generated according to the log display format configuration template makes the target log data format corresponding to the internal business processing log fields corresponding to the displayed different flow nodes uniform, which is convenient for understanding and troubleshooting.

[0049] In some optional implementations, the target field also includes: a service identification field used by each transfer node to implement the node function and a service identification field used by other transfer nodes with an associated relationship.

[0050] Exemplarily, the service identification fields used by each transfer node in implementing the node function may include the current service environment field (env), the container name field (pod_name) of the current service, the current service IP address field (address), and the current service process field (psm); the service identification fields used by other transfer nodes with associated relationships may include: the upstream transparent service environment field (ctx_env), the upstream service process field (caller_psm), and the upstream service IP address field (caller_address), wherein the field contents corresponding to the upstream service psm and the upstream service IP address can be obtained by remotely calling the data in the upstream server through the remote call protocol (rpc). The embodiment of the present application does not limit the specific type of the service identification field, and those skilled in the art can set it according to the actual problem troubleshooting needs.

[0051] As a specific embodiment of the present application, the target fields included in the log collection configuration template are classified as shown in Table 1 below, including aggregation fields, business model fields, basic information fields, and context service related fields:

[0052] Table 1 Log collection configuration template

[0053]

[0054]

[0055] In addition to the general target fields mentioned above, the business processing log field (data) within the current flow node is also included, as shown in Table 2:

[0056] Table 2 Business processing log fields

[0057]

[0058] Combined with the field types contained in the pre-built log collection configuration template, the log aggregation query operation is implemented by calling the log aggregation analysis function tool. Specifically, a lightweight SDK is provided. The methods and usage methods provided by the SDK are aligned with the logging package of the go language to reduce the cognitive understanding and access costs of the tool access party. The business log analysis process is as follows Figure 3 As shown, taking the advertising creation scenario as an example, the AdLog SDK (for collecting node log data) and AdLogMW (for collecting microservice call data corresponding to the current creation node) are set on the creation service side, and the creation service database side includes a database tracking component (mysqltracer) and sets the AdLog SDK to collect business database operation record data; the log aggregation analysis function tool generates target log data containing target fields according to the log collection configuration template based on the collected data; further transmitted to the retrieval data writing service module through mq (message queue), for data parsing and data conversion of the generated target log data and storing the corresponding converted log data, the retrieval data writing service module includes at least two types of storage modules, and creates an index in the search engine ES for the target fields contained in the log collection configuration template through mq; when the interactive retrieval query service module receives the query service for the target field content, the corresponding retrieval results obtained through ES are displayed in the display interface of the target device side. Specifically, taking the creation node as an example, some of the target log data generated by the log aggregation analysis function tool based on the target fields of the log collection configuration template are shown in Table 3 below:

[0059] Table 3 contains the target log data of the target field

[0060]

[0061] In Table 3 above, “ / ” represents an empty value. For the advertising creation node, it can include a plan creation sub-node and a creative creation sub-node. According to the field type contained in the log collection configuration template, the target log data of each sub-flow node can be obtained, and the associated storage is performed to obtain Table 3.

[0062] Based on the generated target log data, the corresponding log content can be retrieved and queried through visual query. The query fields corresponding to the specific query scenario are shown in Table 4 below:

[0063] Table 4 Query fields corresponding to query scenarios

[0064]

[0065] log_id and pod_name pod_name

[0066] In Table 4, src_log_id is the unified link log identifier generated for the upper link corresponding to the link where the current flow node is located during the generation of the target log data corresponding to the log_id of the link where the current flow node is located. src_model_id is the corresponding business model identifier field generated for the upstream flow node associated with the current flow node during the generation of the target log data corresponding to the link where the current flow node is located. When performing the log drill-down service, the query operation of the relevant log data of the upstream flow node associated with the current flow node is implemented by entering src_log_id and src_model_id.

[0067] Taking the creation node as an example, when drilling down into the log service, when the creation node contains different business model logs, to improve the efficiency of troubleshooting, the relationship between plans and creatives during cross-producting is established through logs. One advertising plan can correspond to multiple creatives to implement the plan, and each creative can correspond to multiple materials. Through cross-producting, you can quickly locate which plans and creatives have changed their corresponding relationships and the specific change operations.

[0068] The business log analysis tool corresponding to the business log analysis method provided in the embodiment of the present application can be divided into a client version and a web version. When the tool is enabled, a corresponding target field content input interface is set in the interactive interface of the client or web side, so that the business party or advertiser can input the corresponding log query field content based on the log troubleshooting requirements, and then display the corresponding log query results in the corresponding interactive interface. Figure 4 As shown, it includes an interactive interface 3. When the corresponding field content is entered in the input interface of the corresponding field of the interactive interface 3, the corresponding log content is displayed in the dotted box area 4 by clicking the query component. A "drill-down" function interactive component can also be set on the interactive interface of the displayed log content. The drill-down analysis function is realized by touching the interactive component and the drill-down results are displayed. Figure 4 This is only an example of the web version. Those skilled in the art can set a variety of interactive controls for log query in the interactive interface as needed.

[0069] The business log analysis method provided in the embodiment of the present application automatically converts business logs into standardized business models by designing a configurable log schema and a lightweight SDK, establishes a cross-model execution link mapping through dynamic log_id replacement, supports drill-down queries based on business model associations, and achieves the effect of shortening the average processing time of self-service troubleshooting from 30 minutes to 3 to 10 minutes.

[0070] In this embodiment, a service log analysis device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments. The details that have been described will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0071] This embodiment provides a service log analysis device, such as Figure 5 Shown, including:

[0072] The first generation module 201 is configured to generate target log data including target fields based on the relevant log data of each flow node in the business creation flow process in response to receiving a call operation for the log aggregation analysis function. The target fields include: an identification field of the current flow node, an identification field representing the association relationship between the current flow node and other flow nodes in the business creation flow process, and a target log content field corresponding to the current flow node;

[0073] A creation module 202 is used to create an index for the target field in a search engine;

[0074] The aggregation module 202 is configured to aggregate the target log content associated with the target field content and feed the aggregated content back to the query end upon receiving a query service for the target field content.

[0075] The business log analysis device provided by this embodiment generates target log data including an identification field of the current flow node, an identification field representing the association relationship between the current flow node and other flow nodes in the business creation flow process, and a target log content field corresponding to the current flow node by calling the log aggregation analysis function and based on relevant log data in the business creation flow process. The target log data is stored in a search engine and the target field is indexed. Upon receiving a query service for the target field content, the target log content associated with the target field content can be aggregated and fed back to the query end according to the corresponding identification field, thereby solving the problem that the existing log data of each node is scattered and the relevant log data cannot be quickly analyzed and then quickly located.

[0076] In some optional implementations, the apparatus further includes: a first acquisition module configured to acquire the constructed log collection configuration template; and a second acquisition module configured to acquire a target field from fields included in the target collection configuration template.

[0077] In some optional embodiments, the device also includes: a second generation module, which is used to generate target log data containing a target field based on the relevant log data corresponding to each sub-flow node when any flow node includes multiple sub-flow nodes. The field content corresponding to the identification field in the target field that represents the association relationship between the current flow node and other flow nodes in the business creation flow process includes the identification of the upstream flow node or upstream sub-flow node corresponding to the sub-flow process where the current sub-flow node is located.

[0078] In some optional implementations, the target field also includes: an identification field of the business model adopted by the current flow node during the business creation flow and an identification field of the business model adopted by other associated flow nodes. The business model represents the model adopted by the corresponding flow node to implement the node function.

[0079] In some optional embodiments, the device also includes: a receiving module for responding to the reception operation of the target field content to be queried input through the interactive interface; a merging module for merging the multiple target field contents to be queried when multiple target field contents to be queried are received; and a display module for generating a query service based on the merging processing result and displaying the query result through the interactive interface.

[0080] In some optional implementations, the target field also includes: a business processing log field within the current transfer node.

[0081] In some optional embodiments, the device also includes: a first storage module, used to store the business processing log field and the corresponding field content within the flow node into a first type storage module; a second storage module, used to store other fields in the target field and the corresponding field content into a second type storage module.

[0082] In some optional embodiments, the device also includes: a third acquisition module, used to obtain the log display format configuration template corresponding to the business processing log field; a third generation module, used to generate target log data of the business processing log field according to the format corresponding to the log display format configuration template according to the log content corresponding to the business processing log field.

[0083] In some optional implementations, the target field also includes: a service identification field used by each transfer node to implement the node function and a service identification field used by other transfer nodes with an associated relationship.

[0084] The business log analysis device provided in the embodiment of the present disclosure can execute the business log analysis method provided in any embodiment of the present disclosure, and has the functional modules and beneficial effects corresponding to the execution method. The further functional description of each of the above modules and units is the same as that of the corresponding embodiment above, and will not be repeated here.

[0085] Figure 6 A schematic structural diagram of an electronic device provided in an embodiment of the present disclosure.

[0086] The following specific reference Figure 6 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure. The electronic device may include a processor (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a memory 508 into a random access memory (RAM) 503. Various programs and data required for the operation of the electronic device are also stored in the RAM 503. The processor 501, ROM 502, and RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0087] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all of the devices shown, and more or fewer devices may be implemented or possessed instead.

[0088] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the memory 508, or installed from the ROM 502. When the computer program is executed by the processor 501, the above-mentioned functions defined in the business log analysis method of the embodiment of the present disclosure are performed.

[0089] Figure 6The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0090] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the business log analysis method shown in the above embodiment is implemented.

[0091] A portion of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the form in which the computer program instruction exists in a computer-readable medium includes but is not limited to a source file, an executable file, an installation package file, etc. Accordingly, the way in which the computer program instruction is executed by the computer includes but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium that can be accessed by the computer.

[0092] Although the embodiments of the present disclosure have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A business log analysis method, characterized in that: The method comprises: In response to receiving a call operation for the log aggregation and analysis function, generating target log data including target fields based on relevant log data of each flow node in the business creation flow process, wherein the target fields include: an identification field of the current flow node, an identification field representing the association relationship between the current flow node and other flow nodes in the business creation flow process, and a target log content field corresponding to the current flow node; Creating an index for the target field in a search engine; When a query service for target field content is received, the target log content associated with the target field content is aggregated and fed back to the query end.

2. The method according to claim 1, characterized in that The method further comprises: Get the constructed log collection configuration template; The target field is obtained from the fields included in the target acquisition configuration template.

3. The method according to claim 1, characterized in that The method further comprises: When any flow node includes multiple sub-flow nodes, target log data containing target fields is generated based on the relevant log data corresponding to each sub-flow node. The field content corresponding to the identification field in the target field that represents the association relationship between the current flow node and other flow nodes in the business creation flow process includes the identification of the upstream flow node or upstream sub-flow node corresponding to the sub-flow process where the current sub-flow node is located.

4. The method according to claim 1, wherein The target field also includes: an identification field of the business model adopted by the current flow node during the business creation flow and an identification field of the business model adopted by other associated flow nodes. The business model represents the model adopted by the corresponding flow node to realize the node function.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Responding to a receiving operation of the target field content to be queried input through the interactive interface; When receiving multiple target field contents to be queried, merging the multiple target field contents to be queried; The query service is generated based on the combined processing result and the query result is displayed through the interactive interface.

6. The method according to claim 1, characterized in that The target field also includes: a business processing log field within the current flow node.

7. The method according to claim 6, characterized in that The method further comprises: Storing the business processing log fields and corresponding field contents within the transfer node into a first type storage module; The other fields in the target field and the corresponding field contents are stored in the second type storage module.

8. The method according to claim 6, characterized in that The method further comprises: Obtaining a log display format configuration template corresponding to the business processing log field; The log content corresponding to the business processing log field is generated into target log data for the business processing log field according to the format corresponding to the log display format configuration template.

9. The method according to claim 1, characterized in that The target field also includes: a service identification field used by each transfer node to implement the node function and a service identification field used by other transfer nodes with associated relationships.

10. A business log analysis device, characterized in that: The device comprises: A first generation module is configured to, in response to receiving a call operation for a log aggregation and analysis function, generate target log data including target fields based on relevant log data of each flow node in the business creation flow process, wherein the target fields include: an identification field of the current flow node, an identification field representing an association relationship between the current flow node and other flow nodes in the business creation flow process, and a target log content field corresponding to the current flow node; A creation module, configured to create an index for the target field in a search engine; The aggregation module is used to aggregate the target log content associated with the target field content when receiving a query service for the target field content and feed it back to the query end.

11. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the business log analysis method according to any one of claims 1 to 9 by executing the computer instructions.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the business log analysis method according to any one of claims 1 to 9.

13. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the business log analysis method according to any one of claims 1 to 9.

Images