A log query method, a relay server cluster and a log query system

Abstract

The embodiment of the application provides a log query method, a relay server cluster and a log query system, relates to the technical field of science and technology finance, and the method comprises the following steps: when receiving an import task sent by a user end, a relay server acquires a to-be-imported log from a message middleware according to attribute information of the to-be-imported log, and the message middleware saves logs collected from an application server. The relay server sends the to-be-imported log to a search server cluster, so that the search server cluster only needs to perform word segmentation on the to-be-imported log to generate an index file, and does not need to save all the logs collected from the application server and perform word segmentation on the logs, thereby saving machine resources of the search server cluster. In addition, the frequency of log query by a user is low, and the user does not need to query all the collected logs, so that an import task is triggered only when the user needs to query, and the to-be-imported log is imported into the search server cluster, thereby improving the utilization rate of machine resources in the search server cluster.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and in particular to a log query method, a relay server cluster, and a log query system. Background Technology

[0002] With the development of computer technology, more and more technologies are being applied in the financial field, and the traditional financial industry is gradually transforming into Fintech. However, due to the security and real-time requirements of the financial industry, higher demands are being placed on technology. Currently, when collecting logs from application hosts, a log collection component collects various logs from the application hosts, compresses them, and centrally sends them to a message middleware. A data collection engine collects the logs from the message middleware and writes them to a search server cluster. A web platform reads the data from the search server cluster and displays it on a web page, allowing operations and maintenance personnel to inspect the log content in full text through the web page. Operations and maintenance personnel can also submit search keywords to search for corresponding logs on the web page. Because the log volume of various systems is very large, and the search server cluster needs to perform word segmentation and build a large number of index files to support full-text search of logs, the log storage places a very high demand on the machine resources of the search server cluster, thereby reducing the utilization rate of machine resources. Summary of the Invention

[0003] Because the data collection engine writes all the logs collected by the message middleware to the search server cluster, and the search server cluster performs word segmentation on the logs to generate a large number of index files, the log storage places excessive demands on the resources of the search server cluster, resulting in low utilization of machine resources. This invention provides a log query method, a relay server cluster, and a log query system.

[0004] On one hand, embodiments of the present invention provide a log query method, including:

[0005] The relay server cluster receives import tasks sent by the user client, and the import tasks include attribute information of the logs to be imported;

[0006] The relay server cluster obtains the log to be imported from the message middleware according to the attribute information of the log to be imported. The message middleware is used to store logs collected from the application server.

[0007] The relay server cluster sends the logs to be imported to the search server cluster, so that the search server cluster can perform word segmentation on the logs to be imported and generate an index file corresponding to the logs to be imported. The index file is used to retrieve the corresponding target logs from the logs to be imported when the user sends search keywords.

[0008] Optionally, a distributed file system is mounted on the message middleware, which provides storage space for the message middleware to store logs.

[0009] Optionally, the message middleware is used to store logs collected from the application server, including:

[0010] The message middleware constructs index tags for the collected logs based on the attribute information of the collected logs, and stores the collected logs according to the index tags.

[0011] Optionally, the relay server cluster obtains the log to be imported from the message middleware based on the attribute information of the log to be imported, including:

[0012] The relay server cluster determines the target index tag corresponding to the log to be imported based on the attribute information of the log to be imported;

[0013] The relay server cluster obtains the log to be imported from the message middleware based on the target index tag.

[0014] Optionally, the import task is triggered on the user's end when the user needs to query the logs.

[0015] On one hand, embodiments of the present invention provide a relay server cluster, including:

[0016] The receiving module is used to receive the import task sent by the user terminal, wherein the import task includes the attribute information of the log to be imported;

[0017] The processing module is used to obtain the log to be imported from the message middleware according to the attribute information of the log to be imported, and the message middleware is used to store logs collected from the application server.

[0018] The sending module is used to send the log to be imported to the search server cluster, so that the search server cluster can perform word segmentation on the log to be imported and generate an index file corresponding to the log to be imported. The index file is used to retrieve the corresponding target log from the log to be imported when the user sends the search keywords.

[0019] Optionally, the processing module is specifically used for:

[0020] The target index tag corresponding to the log to be imported is determined based on the attribute information of the log to be imported;

[0021] The log to be imported is obtained from the message middleware based on the target index label.

[0022] On one hand, embodiments of the present invention provide a log query system, including:

[0023] Message middleware, relay server cluster, search server cluster;

[0024] The message middleware is used to store logs collected from the application server;

[0025] The relay server cluster is used to receive import tasks sent by the user client, the import task including attribute information of the log to be imported; to obtain the log to be imported from the message middleware according to the attribute information of the log to be imported; and to send the log to be imported to the search server cluster.

[0026] The search server cluster is used to segment the logs to be imported into words and generate an index file corresponding to the logs to be imported; receive search keywords sent by the user terminal, obtain the corresponding target logs from the logs to be imported according to the search keywords and the index file, and send the target logs to the user terminal.

[0027] Optionally, a distributed file system is mounted on the message middleware, which provides storage space for the message middleware to store logs.

[0028] Optionally, the message middleware is specifically used for:

[0029] An index label for the collected logs is constructed based on the attribute information of the collected logs, and the collected logs are stored according to the index label.

[0030] Optionally, the relay server cluster is specifically used for:

[0031] The target index tag corresponding to the log to be imported is determined based on the attribute information of the log to be imported;

[0032] The log to be imported is obtained from the message middleware based on the target index label.

[0033] On one hand, embodiments of the present invention provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of a log query method.

[0034] On one hand, embodiments of the present invention provide a computer-readable storage medium storing a computer program executable by a computer device, which, when run on the computer device, causes the computer device to perform the steps of a log query method.

[0035] In this embodiment of the invention, when the relay server receives an import task sent by the user, it retrieves the logs to be imported from the message middleware based on the attribute information of the logs to be imported. The message middleware stores the logs collected from the application server. The relay server sends the logs to be imported to the search server cluster. Therefore, the search server cluster only needs to perform word segmentation on the logs to be imported and generate an index file, without needing to store all the logs collected from the application server and perform word segmentation on them, thus saving machine resources of the search server cluster. Secondly, users query logs infrequently and do not need to query all collected logs. Therefore, the logs to be imported are only imported into the search server cluster when the user triggers the import task on the user's end, so that the search server cluster can generate an index file corresponding to the logs to be imported for the user to query, thereby improving the utilization rate of machine resources in the search server cluster. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 A schematic diagram illustrating an application scenario provided by an embodiment of the present invention;

[0038] Figure 2 A flowchart illustrating a log query method provided in an embodiment of the present invention;

[0039] Figure 3 A flowchart illustrating a log query method provided in an embodiment of the present invention;

[0040] Figure 4 This is a schematic diagram of the structure of a relay server cluster provided in an embodiment of the present invention;

[0041] Figure 5 This is a schematic diagram of the structure of a log query system provided in an embodiment of the present invention;

[0042] Figure 6 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and beneficial effects of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0044] For ease of understanding, the terms used in the embodiments of this invention are explained below.

[0045] ElasticSearch is a search server based on Lucene that provides a distributed, multi-user, full-text search engine based on a RESTful web interface.

[0046] The log query method in this embodiment of the invention can be applied to scenarios involving log analysis of servers in a distributed system architecture, where the servers can be business servers of financial institutions such as banks. For example, in... Figure 1 The application scenario shown includes an application server 101, a message middleware 102, a relay server cluster 103, a search server cluster 104, and a client 105. The application server 101 can be a business server for financial institutions such as banks. A log collection component is deployed on the application server 101, continuously collecting various logs from the application server. During log collection, the log collection component categorizes the logs and adds attribute tags. Categorization can be based on log type, log level, log format, application server IP address, time period, subsystem, etc. The log collection component sends the collected logs to the message middleware 102. The message middleware 102 determines the log's index tag based on its attribute tags and then saves the log according to the index tag. The message middleware 102 mounts a distributed file system, which provides storage space for the logs stored by the message middleware 102. When a user needs to query logs, they can trigger an import task on the client 105. The client 105 sends the import task to the relay server cluster 103, and the import task includes the attribute information of the logs to be imported. The relay server cluster 103 determines the target index tag of the log to be imported based on its attribute information. Then, it retrieves the log from the message middleware 102 based on the target index tag and sends it to the search server cluster 104. The search server cluster 104 performs word segmentation on the log to be imported, generating an index file corresponding to the log. The user enters search keywords on the client 105, which then sends the search keywords to the search server cluster 104. The search server cluster 104 determines the target log from the log to be imported based on the search keywords and the index file, and sends the target log to the client 105.

[0047] based on Figure 1 The application scenario diagram shown illustrates the flow of a log query method provided in this embodiment of the invention. This method can be executed through message middleware, a relay server cluster, a search server cluster, and user-end interaction, as follows: Figure 2 As shown, it includes the following steps:

[0048] Step S201: The relay server cluster receives the import task sent by the user.

[0049] Specifically, the import task can be triggered on the user's end when the user needs to query logs, or it can be triggered by the user at regular intervals. Furthermore, the import task can also be triggered at regular intervals; this embodiment of the invention does not impose specific limitations on this. The import task includes the attribute information of the logs to be imported, which may include the log type, log level, log format, application server IP address, time period, subsystem, etc. It should be noted that existing query methods generally query all collected logs, resulting in low machine resource utilization. In this embodiment of the invention, it is not necessary to query all collected logs; therefore, the import task is triggered only when the user needs to query, importing the logs to be imported into the search server cluster. This allows the search server cluster to generate an index file corresponding to the imported logs for the user to query, thereby improving the utilization of machine resources in the search server cluster.

[0050] For example, when a user needs to query the logs of application server A from 9:00 to 10:00, an import task can be triggered on the user's end. The attribute information of the logs to be imported in the import task is: the IP address of application server A and the time period 9:00-10:00.

[0051] In step S202, the relay server cluster retrieves the logs to be imported from the message middleware based on the attribute information of the logs to be imported.

[0052] Specifically, the message middleware is used to store logs collected from application servers. Log collection components are deployed on each application server, continuously collecting various types of logs and their attribute information. These components send logs and their attribute information to the message middleware in real time. The message middleware constructs index tags for the logs based on their attribute information and stores the collected logs according to these index tags. The message middleware can use sequential storage to save the logs. Optionally, to improve the storage capacity of the message middleware, a distributed file system is mounted on it, providing storage space for the logs.

[0053] In one possible implementation, when the relay server cluster obtains the log to be imported from the message middleware, it can first determine the target index tag corresponding to the log to be imported based on the attribute information of the log to be imported, and then obtain the log to be imported from the message middleware based on the target index tag.

[0054] For example, let's define the attribute information of the logs to be imported as: the IP address of application server A and the time period 9:00-10:00. When the message middleware saves the logs, it uses the time period as the first-level index label and the application server's IP address as the second-level index label. Therefore, the first-level target index label for the logs to be imported is the time period 9:00-10:00, and the second-level target index label is the application server A's IP address. First, query the logs in the message middleware based on the time period 9:00-10:00. Then, further filter the logs using the application server A's IP address to obtain the logs to be imported.

[0055] In step S203, the relay server cluster sends the logs to be imported to the search server cluster.

[0056] Step S204: The search server cluster performs word segmentation on the logs to be imported and generates the corresponding index file for the logs to be imported.

[0057] Specifically, the search server cluster can be an ElasticSearch cluster. This cluster uses an inverted index to segment the logs to be imported, generating an index file. The index file stores the mapping between search keywords and log entries; one search keyword may correspond to one or more log entries. The index file is used to retrieve the corresponding target log from the logs to be imported when a search keyword is received from the user. The target log can be one or more entries.

[0058] Step S205: The search server cluster receives the search keywords sent by the user.

[0059] In step S206, the search server cluster retrieves the corresponding target logs from the logs to be imported based on the search keywords and index files.

[0060] Step S207: The search server cluster sends the target logs to the user terminal.

[0061] For example, the index file is set as shown in Table 1:

[0062] Table 1.

[0063]

[0064]

[0065] When the search server cluster receives a search keyword of keyword 1 from the user, it can determine the target log as log A based on the index file shown in Table 1, and then returns log A to the user. When the search server cluster receives a search keyword of keyword 2 from the user, it can determine the target logs as log A and log B based on the index file shown in Table 1, and then returns log A and log B to the user.

[0066] In this embodiment of the invention, after collecting logs from the application server, the logs are stored in a message middleware. When the relay server receives an import task sent by the user, it retrieves the logs to be imported from the message middleware based on the attribute information of the logs to be imported, and sends the logs to be imported to the search server cluster. Therefore, the search server cluster only needs to perform word segmentation on the logs to be imported and generate corresponding index files, without needing to store all logs collected from the application server and perform word segmentation on the logs, thus saving machine resources of the search server cluster. Secondly, users query logs infrequently and do not need to query all collected logs. Therefore, the import task is triggered only when a user needs to query, importing the logs to be imported into the search server cluster so that the search server cluster can generate the corresponding index files for the logs to be imported and provide them to the user for querying, thereby improving the utilization rate of machine resources in the search server cluster.

[0067] To better explain the embodiments of the present invention, the following describes a log query method provided by the embodiments of the present invention in conjunction with a specific implementation scenario. This method comprises a log collection component, a message middleware, a relay server cluster, a search server cluster, and is executed through user-end interaction. Figure 3 As shown, the method includes the following steps:

[0068] Step S301: The log collection component collects logs and log attribute information from the application server.

[0069] The log collection component is deployed on an application server, which can be a business server of a financial institution such as a bank. The log attribute information includes the application server's IP address, time period, subsystem, etc.

[0070] In step S302, the log collection component sends the logs and their attribute information to the message middleware.

[0071] In step S303, the message middleware constructs the log's index tags based on the log's attribute information.

[0072] Step S304: The message middleware stores logs according to index tags.

[0073] Step S305: The user sends the import task to the relay server cluster.

[0074] When a user needs to query logs, an import task is triggered on the user's end, and the attribute information of the logs to be imported in the import task is configured.

[0075] In step S306, the relay server cluster determines the target index tag corresponding to the log to be imported based on the attribute information of the log to be imported.

[0076] In step S307, the relay server cluster retrieves the logs to be imported from the message middleware based on the target index label.

[0077] The attributes of the logs to be imported are defined as the IP address of application server B, the time period 7:00-8:00, and subsystem M. When saving the logs, the message middleware uses the time period as the first-level index label, the application server's IP address as the second-level index label, and the subsystem as the third-level index label. Therefore, the first-level target index label for the logs to be imported is determined to be the time period 7:00-8:00, the second-level target index label is the application server B's IP address, and the third-level target index label is subsystem M. Then, the logs in the message middleware are queried level by level according to the target index labels to obtain the logs to be imported.

[0078] In step S308, the relay server cluster sends the logs to be imported to the search server cluster.

[0079] Step S309: The search server cluster performs word segmentation on the logs to be imported and generates the index file corresponding to the logs to be imported.

[0080] The index file stores the correspondence between the logs to be imported and the search keywords.

[0081] Step S310: The user sends search keywords to the search server cluster.

[0082] Step S311: The search server cluster retrieves the corresponding target log from the logs to be imported based on the search keywords and index files.

[0083] The search server cluster uses search keywords to query the index file and determine the corresponding target log, which can be one or more logs.

[0084] In step S312, the search server cluster sends the target logs to the user terminal.

[0085] Since users query logs infrequently and do not need to query all collected logs, the import task is triggered only when a user needs to query, importing the logs to be imported into the search server cluster. This allows the search server cluster to generate index files corresponding to the logs to be imported for user querying, instead of sending all collected logs to the search server cluster. This saves machine resources of the search server cluster and improves the utilization rate of machine resources.

[0086] Based on the same technical concept, embodiments of the present invention provide a relay server cluster, such as Figure 4 As shown, the device 400 includes:

[0087] The receiving module 401 is used to receive an import task sent by the user terminal, wherein the import task includes attribute information of the log to be imported;

[0088] Processing module 402 is used to obtain the log to be imported from the message middleware according to the attribute information of the log to be imported, wherein the message middleware is used to store logs collected from the application server;

[0089] The sending module 403 is used to send the log to be imported to the search server cluster, so that the search server cluster can perform word segmentation on the log to be imported and generate an index file corresponding to the log to be imported. The index file is used to obtain the corresponding target log from the log to be imported when the user sends the search keywords.

[0090] Optionally, the processing module 402 is specifically used for:

[0091] The target index tag corresponding to the log to be imported is determined based on the attribute information of the log to be imported;

[0092] The log to be imported is obtained from the message middleware based on the target index label.

[0093] Based on the same technical concept, embodiments of the present invention provide a log query system, such as... Figure 5 As shown, the system 500 includes:

[0094] Message middleware 501, relay server cluster 502, search server cluster 503;

[0095] The message middleware 501 is used to store logs collected from the application server;

[0096] The relay server cluster 502 is used to receive import tasks sent by the user client, the import task including attribute information of the log to be imported; obtain the log to be imported from the message middleware 501 according to the attribute information of the log to be imported; and send the log to be imported to the search server cluster 503.

[0097] The search server cluster 503 is used to segment the logs to be imported into words and generate an index file corresponding to the logs to be imported; receive search keywords sent by the user terminal, obtain the corresponding target logs from the logs to be imported according to the search keywords and the index file, and send the target logs to the user terminal.

[0098] Optionally, a distributed file system is mounted on the message middleware 501, which provides storage space for the message middleware to store logs.

[0099] Optionally, the message middleware 501 is specifically used for:

[0100] An index label for the collected logs is constructed based on the attribute information of the collected logs, and the collected logs are stored according to the index label.

[0101] Optionally, the relay server cluster 503 is specifically used for:

[0102] The target index tag corresponding to the log to be imported is determined based on the attribute information of the log to be imported;

[0103] The log to be imported is obtained from the message middleware based on the target index label.

[0104] Based on the same technical concept, embodiments of the present invention provide a computer device, such as... Figure 6 As shown, it includes at least one processor 601 and a memory 602 connected to at least one processor. In this embodiment of the invention, the specific connection medium between the processor 601 and the memory 602 is not limited. Figure 6 Taking the connection between the processor 601 and the memory 602 via a bus as an example, the bus can be divided into address bus, data bus, control bus, etc.

[0105] In this embodiment of the invention, the memory 602 stores instructions that can be executed by at least one processor 601. By executing the instructions stored in the memory 602, at least one processor 601 can perform the steps included in the aforementioned log query method.

[0106] The processor 601 is the control center of the computer device. It can connect to various parts of the computer device using various interfaces and lines. It collects and queries logs by running or executing instructions stored in the memory 602 and calling data stored in the memory 602. Optionally, the processor 601 may include one or more processing units. The processor 601 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 can be implemented on the same chip; in some embodiments, they can also be implemented on separate chips.

[0107] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0108] Memory 602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 602 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 602 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In embodiments of the present invention, memory 602 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0109] Based on the same technical concept, embodiments of the present invention provide a computer-readable storage medium storing a computer program executable by a computer device, which, when run on the computer device, causes the computer device to perform the steps of a log query method.

[0110] Those skilled in the art will understand that embodiments of the present invention can be provided as methods or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0111] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0112] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0113] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0114] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0115] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A log query method, characterized in that, include: When a user needs to query logs, an import task is triggered on the user's end and sent to the relay server cluster. The import task includes the attribute information of the logs to be imported. The relay server cluster receives the import task, determines the target index tag of the log to be imported based on the attribute information of the log to be imported, and retrieves the log to be imported from the message middleware based on the target index tag. The message middleware is used to construct the index tag of the log based on the attribute information of the log, and stores various types of logs collected from the application server according to the index tag. The various types of logs and the attribute information of the logs are continuously collected by the log collection component and sent to the message middleware in real time. The relay server cluster sends the logs to be imported to the search server cluster, so that the search server cluster performs word segmentation on the logs to be imported, generates an index file corresponding to the logs to be imported, and provides it to the user. The index file stores the correspondence between search keywords and logs, with one search keyword corresponding to one or more logs. The user enters search keywords on the user terminal and sends them to the search server cluster, so that the search server cluster can obtain the corresponding target log from the log to be imported based on the search keywords and the index file, and return the target log to the user terminal.

2. The method as described in claim 1, characterized in that, The message middleware is mounted with a distributed file system, which provides storage space for the message middleware to store logs.

3. The method as described in claim 1, characterized in that, The message middleware is used to store logs collected from the application server, including: The message middleware constructs index tags for the collected logs based on the attribute information of the collected logs, and stores the collected logs according to the index tags.

4. The method as described in claim 3, characterized in that, The relay server cluster obtains the log to be imported from the message middleware based on the attribute information of the log to be imported, including: The relay server cluster determines the target index tag corresponding to the log to be imported based on the attribute information of the log to be imported; The relay server cluster obtains the log to be imported from the message middleware based on the target index tag.

5. A relay server cluster, characterized in that, include: The receiving module is used to receive an import task triggered on the user's end when the user needs to query logs. The import task includes attribute information of the logs to be imported. The processing module is used to determine the target index tag of the log to be imported based on the attribute information of the log to be imported, and to obtain the log to be imported from the message middleware based on the target index tag. The message middleware is used to construct the index tag of the log based on the attribute information of the log, and to store various types of logs collected from the application server according to the index tag. The various types of logs and the attribute information of the logs are continuously collected by the log collection component and sent to the message middleware in real time. The sending module is used to send the logs to be imported to the search server cluster, so that the search server cluster can perform word segmentation on the logs to be imported, generate an index file corresponding to the logs to be imported and provide it to the user, and obtain the corresponding target logs from the logs to be imported according to the search keywords entered by the user on the user terminal and the index file, and return the target logs to the user terminal; the index file stores the correspondence between search keywords and logs, and one search keyword corresponds to one or more logs.

6. The relay server cluster as described in claim 5, characterized in that, The processing module is specifically used for: The target index tag corresponding to the log to be imported is determined based on the attribute information of the log to be imported; The log to be imported is obtained from the message middleware based on the target index label.

7. A log query system, characterized in that, include: Message middleware, relay server cluster, search server cluster; The message middleware is used to construct log index tags based on log attribute information and store various types of logs collected from the application server according to the index tags; the various types of logs and log attribute information are continuously collected by the log collection component and sent to the message middleware in real time. The relay server cluster is used to receive import tasks triggered on the user's end when the user needs to query logs. The import task includes attribute information of the logs to be imported. The target index tag of the log to be imported is determined based on the attribute information of the log to be imported, and the log to be imported is obtained from the message middleware based on the target index tag; Send the logs to be imported to the search server cluster; The search server cluster is used to segment the logs to be imported into words, generate an index file corresponding to the logs to be imported and provide it to the user, and retrieve the corresponding target logs from the logs to be imported based on the search keywords entered by the user on the user terminal and the index file, and return the target logs to the user terminal. The index file stores the correspondence between search keywords and logs, with one search keyword corresponding to one or more logs.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method according to any one of claims 1 to 4.

9. A computer-readable storage medium, characterized in that, It stores a computer program executable by a computer device, which, when run on the computer device, causes the computer device to perform the steps of the method according to any one of claims 1 to 4.

10. A computer program product, characterized in that, The computer program product includes a computer program stored on a computer-readable storage medium, the computer program including program instructions that, when executed by a computer device, cause the computer device to perform the steps of the method as described in any one of claims 1 to 4.

Images