Log query method, device and storage medium

Abstract

An embodiment of the present application provides a log query method and apparatus, wherein a log query method includes: receiving a query instruction, the query instruction including a log path, an input time, and an input keyword; dividing the logs under the log path to obtain multiple log blocks, the logs under the log path being sorted in chronological order of timestamps, each of the multiple log blocks including logs within a time period; searching a target log block for a log that meets the query criteria to obtain a target log, the target log block being a log block in the multiple log blocks corresponding to a time period that overlaps with the input time, the query criteria being generated based on the input keyword; and outputting the target log. By searching the target log block for logs that meet the query criteria, the embodiment of the present application avoids processing a large number of logs and improves the efficiency of log queries.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a log query method, device, and storage medium. Background Art

[0002] Log files include kernel system logs, user logs, and program logs. These logs record a variety of information, including user operations and various events during program execution. With the development of internet technology, logs are playing an increasingly important role in system monitoring, querying, and security auditing. Currently, log query methods rely on servers to query each log entry in a large volume of logs one by one in chronological order. This method is slow and inefficient, making it difficult to quickly and efficiently retrieve target log content. Therefore, an effective log query method is urgently needed. Summary of the Invention

[0003] In view of the above problems, the present application is proposed to provide a log query method, device and storage medium that overcome the above problems or at least partially solve the above problems.

[0004] In a first aspect, an embodiment of the present application provides a log query method, which may include:

[0005] Receive a query instruction, wherein the query instruction includes a log path, an input time, and an input keyword;

[0006] Dividing the logs under the log path to obtain a plurality of log blocks, wherein the logs under the log path are sorted in chronological order according to timestamps, and each of the plurality of log blocks includes logs within a time period;

[0007] Searching for a log meeting a query condition in a target log block to obtain a target log, wherein the target log block is a log block corresponding to a time period that overlaps with the input time among the multiple log blocks, and the query condition is generated based on the input keyword;

[0008] Output the target log.

[0009] In one possible implementation, the input time includes a start time and an end time of the input time, and searching a target log block for a log that meets the query condition to obtain the target log includes:

[0010] Execute N query processes, where i is a positive integer not greater than N, and N is a positive integer. The i-th query process includes:

[0011] Searching for logs that meet the query condition in the i-th target log block to obtain the i-th log set, wherein the target log includes the log set;

[0012] When the target log block includes the i+1th target log block, executing the next query process;

[0013] The first target log block is the log block where the start time is located, and the i+1th target log block is the log block closest to the time of the i-th target log block after the time of the i-th target log block.

[0014] In one possible implementation, the first query process further includes:

[0015] Determine the timestamp of the log at the middle position of the plurality of log blocks as the time to be determined;

[0016] Determine the relationship between the start time and the time to be determined;

[0017] If the to-be-determined time is equal to the start time, the log block where the to-be-determined time is located is determined as the first target log block.

[0018] If the to-be-determined time is less than the start time, the timestamp of the log in the middle position between the log block containing the start time and the last log block of the multiple log blocks is determined as the to-be-determined time, and the determination of the relationship between the start time and the to-be-determined time is continued until the to-be-determined time is equal to the start time;

[0019] If the to-be-determined time is greater than the starting time, the timestamp of the log at the middle position between the first log block of the multiple log blocks and the log block where the starting time is located is determined as the to-be-determined time, and the judgment of the size relationship between the starting time and the to-be-determined time is continued until the to-be-determined time is equal to the starting time.

[0020] In a possible implementation, searching for a log meeting the query condition in the i-th target log block includes:

[0021] Processing the i-th target log block according to a memory mapping function to obtain an i-th mapping log block, wherein the i-th mapping log block has a mapping relationship with the i-th target log block;

[0022] Search the i-th mapping log block for logs that meet the query condition to obtain the i-th log set.

[0023] In a possible implementation, the log block includes multiple logs, each of the multiple logs includes a timestamp, and the i-th query process further includes:

[0024] If the end time is after the timestamp of the first log entry in the (i+1)th target log block, the target log block includes the (i+1)th target log block.

[0025] In a possible implementation, the query instruction further includes a query mode, and the query condition is determined by the query mode and the input keyword.

[0026] In a possible implementation, when the query mode is a fuzzy query, the log meeting the query condition is the log including the input keyword in the target log block.

[0027] Through the method of the first aspect, the embodiment of the present application can first receive a query instruction, the query instruction includes a log path, an input time, and an input keyword, divide the logs under the log path, and obtain multiple log blocks. The logs under the log path are sorted according to the order of timestamps. Each log block in the multiple log blocks includes logs within a time period. Then, the target log block is searched for logs that meet the query conditions to obtain a target log. The target log block is a log block in the multiple log blocks that corresponds to a time period that overlaps with the input time. The query condition is generated based on the input keyword. Finally, the target log is output. The embodiment of the present application can avoid processing a large number of logs by searching for logs that meet the query conditions in the target log block, thereby improving the efficiency of log queries.

[0028] In a second aspect, an embodiment of the present application provides a log query device.

[0029] A receiving unit, configured to receive a query instruction, wherein the query instruction includes a log path, an input time, and an input keyword;

[0030] a partitioning unit, configured to partition the logs under the log path to obtain a plurality of log blocks, wherein the logs under the log path are sorted in chronological order according to timestamps, and each of the plurality of log blocks includes logs within a time period;

[0031] a query unit, configured to search a target log block for a log meeting a query condition, thereby obtaining a target log, wherein the target log block is a log block corresponding to a time period overlapping with the input time in the plurality of log blocks, and the query condition is generated based on the input keyword;

[0032] An output unit, configured to output the target log.

[0033] In the third aspect, the embodiment of the present application provides a log query device, including a storage component, a processing component and a communication component, wherein the storage component is used to store computer programs, and the communication component is used to interact with external devices; the processing component is configured to call the computer program and execute the method described in the first aspect, which will not be repeated here.

[0034] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method of the first aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the background technology, the drawings required for use in the embodiments of the present application or the background technology will be described below.

[0036] Figure 1 This is a schematic diagram of a log query system architecture provided by an embodiment of the present application;

[0037] Figure 2 This is a schematic diagram of a log query method process provided by an embodiment of the present application;

[0038] Figure 3 This is a structural diagram of a log query device provided by an embodiment of the present application;

[0039] Figure 4 This is a structural diagram of another log query device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] The embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0041] The terms "first," "second," and "third," etc. in the specification, claims, and drawings of this application are used to distinguish between different objects, not to describe a particular order. Furthermore, the terms "including," "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements, but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, product, or apparatus.

[0042] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0043] As used in this application, the terms "server," "unit," "system," and the like are used to refer to computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a server may be, but is not limited to, a processor, a data processing platform, a computing device, a computer, two or more computers, and the like.

[0044] First, one of the log query system architectures based on the embodiment of this application is described. Figure 1 , Figure 1 1 is a schematic diagram of a log query system architecture provided by an embodiment of the present application, comprising: a log query device 101 and a user device 102.

[0045] The log query device 101 may include, but is not limited to, a backend server, a component server, a data processing server, etc. When the log query device 101 is a server, the server may communicate with the user device via the Internet. The server also needs to run corresponding server-side programs to provide corresponding log query services, such as database services, data calculations, decision execution, etc. For example, the server may receive a query instruction, which includes a log path, an input time, and an input keyword; divide the logs under the log path to obtain multiple log blocks, and sort the logs under the log path in order of timestamps, each of the multiple log blocks including logs within a time period; search the target log block for logs that meet the query conditions to obtain a target log, which is a log block in the multiple log blocks corresponding to a time period that overlaps with the input time, and the query conditions are generated based on the input keyword; and output the target log.

[0046] The user device 102 can install and run related applications. An application refers to a program that corresponds to a server and provides local services to customers. Here, the local service may include but is not limited to: obtaining query instructions, sending query instructions to the log query device 101, so that the log query device 101 server can receive the query instructions to perform log queries. The user device in the embodiment of this scheme may include but is not limited to any electronic product based on an intelligent operating system, which can interact with the user through input devices such as keyboards, virtual keyboards, touchpads, touch screens, and voice control devices, such as smart phones, tablet computers, personal computers, etc. Among them, the intelligent operating system includes but is not limited to any operating system that enriches the device functions by providing various mobile applications to mobile devices, such as: Android (Android TM ), iOS TM 、Windows Phone TM wait.

[0047] It is also understandable that Figure 1The log query system architecture is only a partial exemplary implementation in the embodiments of this application.

[0048] In another case, the system architecture can also be a log query device 101, and this log query device 101 can be a local terminal, which can install and run related applications. Application refers to a program that corresponds to a server and provides local services to customers. For example, the terminal can receive a query instruction, and the query instruction includes a log path, input time, and input keywords; the logs under the log path are divided to obtain multiple log blocks, and the logs under the log path are sorted in order of timestamps, and each log block in the multiple log blocks includes logs within a time period; the logs that meet the query conditions are searched in the target log block to obtain the target log. The terminal in the embodiment of this scheme may include but is not limited to any electronic product based on an intelligent operating system, which can interact with the user through input devices such as keyboards, virtual keyboards, touchpads, touch screens, and voice control devices for human-computer interaction, such as smart phones, tablet computers, personal computers, etc. Among them, the intelligent operating system includes but is not limited to any operating system that enriches the functions of the device by providing various mobile applications to mobile devices, such as Android (Android TM ), iOS TM 、Windows Phone TM wait.

[0049] The log query system architecture in the embodiments of the present application includes but is not limited to the above log query system architecture.

[0050] Reference Attachment Figure 2 , Figure 2 This is a schematic diagram of a log query method process provided by an embodiment of the present application. Figure 1 The system in the following will be combined Figure 2 The description is made from the perspective of the log query device 101. The method may include the following steps S201 to S204.

[0051] Step S201: receiving a query instruction, which includes a log path, input time, and input keywords.

[0052] The log query device receives a query instruction, which includes a log path, an input time, and a query condition. The input time includes a start time and an end time of the input time. For example, the input time can be a time period of 9:00 to 10:00, wherein the start time of the input time is 9:00 and the end time is 10:00.

[0053] The log query device can provide a configuration modification interface to initialize the log query device. Specifically, after receiving a query instruction, the log query device first calls the configuration modification interface to modify the configuration parameters of the log query device. For example, it can modify the log path set by the log query device and increase or decrease the log content. It should be noted that because this interface is called, there is no need for staff to manually modify the configuration file, and the log query device does not need to be restarted for the configuration to take effect.

[0054] Step S202: Divide the logs under the log path to obtain multiple log blocks.

[0055] Specifically, the log query device first obtains the logs under the log path, wherein each log under the log path is sorted in chronological order according to the timestamp, and then divides the logs under the log path to obtain multiple log blocks, wherein each log block includes logs within a time period.

[0056] Among them, the logs under the log path may include multiple logs, each log corresponding to a timestamp. It is understandable that the timestamp of each log is a time value used to indicate the time when the log was generated. The logs are stored in the order in which the logs were generated, that is, each log under the log path is sorted according to the order of the timestamps. It should be noted that the log query device divides the logs under the log path according to the pre-set division rules without changing the log order, thereby obtaining multiple log blocks. Specifically, the logs under the log path can be divided into log blocks of equal size according to the pre-set division rules. For example, the original log can be divided into log blocks of 128 megabytes in size. It is understandable that during the division process, the log query device does not change the log order. The multiple log blocks generated are sorted according to the order of time, and the multiple logs in each log block are sorted according to the order of the timestamps.

[0057] Step S203 , searching the target log block for a log meeting the query condition to obtain the target log. The target log block is a log block corresponding to a time period that overlaps with the input time among multiple log blocks. The query condition is generated based on the input keyword.

[0058] Specifically, the log query device executes one or more query processes to obtain a target log. If there is only one log block among multiple log blocks that corresponds to a time period that overlaps with the input time, that is, there is only one target log block, then the log query device only executes one query process, and the target log is the first log set obtained by the first query process. If there is more than one log block among multiple log blocks that corresponds to a time period that overlaps with the input time, that is, there are multiple target log blocks, then the log query device executes multiple query processes, and the target log includes each log set obtained by the multiple query processes.

[0059] In one implementation, if the order in which the log query device reads logs is based on the timestamp order, the first query process determines the log block where the start time is located as the first target log block. Specifically, the log query device performs N query processes, i is a positive integer not greater than N, N is a positive integer, and the i-th query process includes: searching for logs that meet the query conditions in the i-th target log block to obtain the i-th log set, and the target log includes the log set; when the target log block includes the i+1-th target log block, executing the next query process; wherein, the first target log block is the log block where the start time is located, and the i+1-th target log block is the log block that is closest to the time of the i-th target log block after the time of the i-th target log block.

[0060] The first query process can determine the first target log block based on the binary search method, and then search for logs that meet the query conditions in the first target log block to obtain the first log set. When the log query device completes the first query process, it determines whether there is a next target log block and whether to continue the next query process. It should be noted that if the log query device reads logs in reverse order based on timestamps, the log block where the end time is located is determined as the first target log block, which will not be further explained here.

[0061] Specifically, if the log query device reads a log with a timestamp greater than the end time while querying the first target log block, for example, if the end time is 10:00, and the log query finds a log with a timestamp of 10:01, the log query ends. It will be understood that at this point, the log corresponding to the time period that overlaps with the input time exists in the first target log block, so there is only one target log block.

[0062] If the log query device has not read a log entry with a time greater than the end time when it completes its query for the first target log block, it will continue to read the next target log block in timestamp order until it reaches a log entry with a timestamp greater than the end time, at which point the log query ends. It will be understood that when the log blocks are sorted, they are sorted according to timestamp order. Therefore, the log block next to the first target log block is the log block closest in time to the target log block. It should be noted that if the log query device reads logs in reverse timestamp order, the log block immediately preceding the first target log block is the log block closest in time to the target log block. It will be understood that the log block containing a log entry with a timestamp equal to the end time is the last target log block, i.e., if the end time is after the timestamp of the first log entry in the log block, then this log block is the target log block. It will be understood that the log blocks corresponding to the time period that overlaps with the input time are the log blocks between the first and last target log blocks.

[0063] The log query device determines the first target log block based on the start time or end time. Specifically, it can query the first timestamp t0 of the first log block and the last timestamp t1 of the last log block among multiple log blocks, where T0 is the start time or end time. The log query device first determines whether the log under the log path contains the log to be queried by judging the relationship between t0, t1, and T0. If it is determined that a log block corresponding to a time period that overlaps with the input time exists among the multiple log blocks, the first target log block is determined by binary search.

[0064] (1) If T0 is greater than t1, the time when the log query device is to query the log is not between t0 and t1, and the log query device may indicate that the log to be queried does not exist;

[0065] (2) If T0 is less than t1, the time when the log query device needs to query the log is between t0 and t1, and the log query device can use binary search to find the target log block.

[0066] Specifically, the log query device can query the time of the location of (t0+t1) / 2, and determine the size relationship between the time of the location of (t0+t1) / 2 and T0. If the time of the location of (t0+t1) / 2 is equal to T0, then the location is the target location, and the log block where the target location is located is the target log block. If the time of the location is greater than T0, then the target location is between t0 and (t0+t1) / 2, and (t0+t1) / 2 is determined to be t1, and the query is continued. The time at the location of (t0+t1) / 2 is determined, and the relationship between the time at (t0+t1) / 2 and T0 is determined. If the time at this location is less than T0, the target location is between (t0+t1) / 2 and t1. (t0+t1) / 2 is determined to be t0, and the query for the time at the location of (t0+t1) / 2 is continued. The relationship between the time at (t0+t1) / 2 and T0 is determined until the time at (t0+t1) / 2 equals T0. It can be understood that after locating the log block through binary search, only the log block needs to be opened to read the content for querying, which greatly reduces the time of log query and improves the efficiency of log query.

[0067] For example, the step of determining the log block where the start time is located according to the binary search method may include some or all of the following steps:

[0068] Determine the timestamp at the middle position of the multiple log blocks as the time to be determined; determine the size relationship between the start time and the time to be determined; if the time to be determined is equal to the start time, determine the log block where the time to be determined is located as the first target log block; if the time to be determined is less than the start time, determine the timestamp at the middle position between the log block where the start time is located and the last log block of the multiple log blocks as the time to be determined, and continue to determine the size relationship between the start time and the time to be determined until the time to be determined is equal to the start time; if the time to be determined is greater than the start time, determine the timestamp at the middle position between the first log block of the multiple log blocks and the log block where the start time is located as the time to be determined, and continue to determine the size relationship between the start time and the time to be determined until the time to be determined is equal to the start time.

[0069] The log query device searches for logs that meet the query conditions in the target log block. Specifically, when determining a target log block, the log query device may process the target log block according to a memory mapping (mmap) function to obtain a mapped log block, and then search for logs that meet the query conditions in the mapped log block to obtain a log set.

[0070] Specifically, the log query device first creates a virtual mapping area, and then creates a mapping relationship between the target log block and the virtual mapping area. Specifically, the log query device determines the virtual address area according to the library function, and then structures the virtual address area to obtain the structured virtual address area, initializes the structured virtual address area to obtain the virtual mapping area, and then creates a mapping relationship between the original log and the virtual mapping area, that is, mapping the target log block to the virtual mapping area to obtain the mapping log. It can be understood that since a mapping relationship is established between the target log block in the physical disk and the mapping log block in the virtual mapping area, there is no need to copy the log file in the physical disk to the memory. The mapping log block in the virtual mapping area can be directly queried, and the query of the log file in the physical disk can be realized, which improves the efficiency of querying the log.

[0071] The query instruction also includes a query mode. The query conditions are determined by the query mode and the input keyword. When the query mode is a fuzzy query, the logs that meet the query conditions are those that include the input keyword in the target log block. Specifically, the log query device can first parse the input keyword, convert the input keyword into a logical language, and then perform the query based on the original system rules, imitating a range search expression.

[0072] In one implementation, the log query device may first split the log into a field (title): content (content) format, and then perform a query based on a query pattern. The query patterns may include A AND B, A>1, and A:1 patterns, where A and B represent input keywords. For example, the A>1 pattern is a fuzzy query pattern. Specifically, A may or may not include a field, where the “>” represents the similarity between characters. The degree of similarity is related to the numerical value and can be represented by a fuzzy coefficient [0-1]. For example, test~0.5 can search for words such as text or tests.

[0073] Step S204: output the target log.

[0074] Specifically, the log query device may output a log set at the end of each query process in step S204, or may output and display all log sets after step S204 is completed, and all log sets are target logs.

[0075] The embodiment of the present application can receive a query instruction, the query instruction including a log path, an input time, and an input keyword; divide the logs under the log path to obtain multiple log blocks, the logs under the log path are sorted in chronological order according to the timestamps, and each of the multiple log blocks includes logs within a time period; search for logs that meet the query conditions in the target log block to obtain a target log, the target log block being a log block corresponding to a time period that overlaps with the input time in the multiple log blocks, and the query conditions are generated based on the input keywords; and output the target log. The embodiment of the present application can avoid processing a large number of logs by searching for logs that meet the query conditions in the target log block, thereby improving the efficiency of log queries.

[0076] The above describes the method of the embodiment of the present application in detail. The following provides a log query device related to the embodiment of the present application. Figure 3 , Figure 3 1 is a schematic diagram of a log query device according to an embodiment of the present invention. The log query device 10 may include a receiving unit 301 , a dividing unit 302 , a query unit 303 and an output unit 304 .

[0077] The receiving unit 301 is configured to receive a query instruction, wherein the query instruction includes a log path, an input time, and an input keyword;

[0078] A partitioning unit 302 is configured to partition the logs under the log path to obtain a plurality of log blocks, wherein the logs under the log path are sorted in chronological order according to timestamps, and each of the plurality of log blocks includes logs within a time period;

[0079] A query unit 303 is configured to search a target log block for a log that meets a query condition, thereby obtaining a target log. The target log block is a log block corresponding to a time period that overlaps with the input time in the multiple log blocks. The query condition is generated based on the input keyword.

[0080] The output unit 304 is configured to output the target log.

[0081] In a possible implementation, the input time includes a start time and an end time of the input time, and the query unit 303 is specifically configured to:

[0082] Execute N query processes, where i is a positive integer not greater than N, and N is a positive integer. The i-th query process includes:

[0083] Searching for logs that meet the query condition in the i-th target log block to obtain the i-th log set, wherein the target log includes the log set;

[0084] When the target log block includes the i+1th target log block, executing the next query process;

[0085] The first target log block is the log block where the start time is located, and the i+1th target log block is the log block closest to the time of the i-th target log block after the time of the i-th target log block.

[0086] In one possible implementation, the query unit 303 is specifically configured to:

[0087] Determine the timestamp of the log at the middle position of the plurality of log blocks as the time to be determined;

[0088] Determine the relationship between the start time and the time to be determined;

[0089] If the to-be-determined time is equal to the start time, the log block where the to-be-determined time is located is determined as the first target log block.

[0090] If the to-be-determined time is less than the start time, the timestamp of the log in the middle position between the log block containing the start time and the last log block of the multiple log blocks is determined as the to-be-determined time, and the determination of the relationship between the start time and the to-be-determined time is continued until the to-be-determined time is equal to the start time;

[0091] If the to-be-determined time is greater than the starting time, the timestamp of the log at the middle position between the first log block of the multiple log blocks and the log block where the starting time is located is determined as the to-be-determined time, and the judgment of the size relationship between the starting time and the to-be-determined time is continued until the to-be-determined time is equal to the starting time.

[0092] In one possible implementation, the query unit 303 is specifically configured to:

[0093] Processing the i-th target log block according to a memory mapping function to obtain an i-th mapping log block, wherein the i-th mapping log block has a mapping relationship with the i-th target log block;

[0094] Search the i-th mapping log block for logs that meet the query condition to obtain the i-th log set.

[0095] In one possible implementation, the query unit 303 is specifically configured to:

[0096] If the end time is after the timestamp of the first log entry in the (i+1)th target log block, the target log block includes the (i+1)th target log block.

[0097] In a possible implementation, the query instruction further includes a query mode, and the query condition is determined by the query mode and the input keyword.

[0098] In a possible implementation, when the query mode is a fuzzy query, the log meeting the query condition is the log including the input keyword in the target log block.

[0099] It should be noted that the implementation of each operation can also refer to Figure 2 The corresponding description of the method embodiment shown is not repeated here.

[0100] like Figure 4 As shown, Figure 4 4 is a schematic diagram of the structure of another log query device provided by an embodiment of the present application. The device 20 includes at least one processor 401, at least one memory 402, and at least one communication interface 403. In addition, the device may also include common components such as an antenna, which will not be described in detail here.

[0101] The processor 401 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the above program.

[0102] The communication interface 403 is used to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), core network, Wireless Local Area Networks (WLAN), etc.

[0103] The memory 402 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via a bus. The memory may also be integrated with the processor.

[0104] The memory 402 is used to store application code for executing the above solution, and the execution is controlled by the processor 401. The processor 401 is used to execute the application code stored in the memory 402.

[0105] The code stored in the memory 402 can execute the above Figure 2 The provided log query method, for example, when the device 20 is a log query device, receives a query instruction, the query instruction includes a log path, an input time, and an input keyword; divides the log under the log path to obtain multiple log blocks, the logs under the log path are sorted in order of timestamps, and each of the multiple log blocks includes logs within a time period; searches for logs that meet the query conditions in the target log block to obtain a target log, the target log block being a log block corresponding to a time period that overlaps with the input time in the multiple log blocks, and the query condition is generated based on the input keyword; and outputs the target log.

[0106] It should be noted that the functions of the various functional units in the log query device described in the embodiment of the present application can refer to Figure 2 The corresponding description of the method embodiment shown is not repeated here.

[0107] In this application, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of this application.

[0108] In addition, the functional components in the various embodiments of the present application can be integrated into one component, or each component can exist physically separately, or two or more components can be integrated into one component. The above-mentioned integrated components can be implemented in the form of hardware or in the form of software functional units.

[0109] If the integrated components are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or partly contributed to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0110] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present application, and such modifications or substitutions should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0111] It should be understood that in the various embodiments of the present application, the order of the sequence numbers of the above-mentioned processes does not mean the order of execution. The order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. Although the present application is described herein in conjunction with various embodiments, those skilled in the art can understand and implement other variations of the disclosed embodiments in the process of the present application claimed in the embodiments.

Claims

1. A log query method, characterized in that: include: Receive a query instruction, wherein the query instruction includes a log path, an input time, and an input keyword; Dividing the logs under the log path to obtain multiple log blocks, the logs under the log path are sorted in order of timestamps, each of the multiple log blocks includes logs within a time period, the input time includes a start time and an end time of the input time, the multiple log blocks are sorted in order of including the time period, and the multiple logs in each log block are sorted in order of timestamps; Searching for a log meeting a query condition in a target log block to obtain a target log, wherein the target log block is a log block corresponding to a time period that overlaps with the input time among the multiple log blocks, and the query condition is generated based on the input keyword; Outputting the target log; The step of searching the target log block for a log that meets the query condition to obtain the target log includes: Execute N query processes, where i is a positive integer not greater than N, and N is a positive integer. The i-th query process includes: searching for logs that meet the query condition in the i-th target log block to obtain the i-th log set, where the target logs include the log set; when the target log blocks include the i+1-th target log block, execute the next query process; wherein the i-th target log block is the log block where the start time is located, and the i+1-th target log block is the log block that is closest to the time of the i-th target log block after the time of the i-th target log block; Among them, executing the first query process also includes: determining the timestamp of the log at the middle position of the multiple log blocks as the time to be determined; judging the size relationship between the start time and the time to be determined; if the time to be determined is equal to the start time, determining the log block where the time to be determined is located as the first target log block; if the time to be determined is less than the start time, determining the timestamp of the log at the middle position between the log block where the start time is located and the last log block of the multiple log blocks as the time to be determined, and continuing to judge the size relationship between the start time and the time to be determined until the time to be determined is equal to the start time; if the time to be determined is greater than the start time, determining the timestamp of the log at the middle position between the first log block of the multiple log blocks and the log block where the start time is located as the time to be determined, and continuing to judge the size relationship between the start time and the time to be determined until the time to be determined is equal to the start time.

2. The method according to claim 1, characterized in that The step of searching for a log meeting the query condition in the i-th target log block includes: Processing the i-th target log block according to a memory mapping function to obtain an i-th mapping log block, wherein the i-th mapping log block has a mapping relationship with the i-th target log block; Search the i-th mapping log block for logs that meet the query condition to obtain the i-th log set.

3. The method according to claim 1, characterized in that The log block includes a plurality of logs, each of the plurality of logs includes a timestamp, and the i-th query process further includes: If the end time is after the timestamp of the first log entry in the (i+1)th target log block, the target log block includes the (i+1)th target log block.

4. The method according to claim 1, characterized in that The query instruction further includes a query mode, and the query condition is determined by the query mode and the input keyword.

5. The method according to claim 4, characterized in that: When the query mode is a fuzzy query, the log meeting the query condition is the log including the input keyword in the target log block.

6. A log query device, the device being used to execute the method according to any one of claims 1 to 5, characterized in that: include: A receiving unit, configured to receive a query instruction, wherein the query instruction includes a log path, an input time, and an input keyword; a partitioning unit, configured to partition the logs under the log path to obtain a plurality of log blocks, wherein the logs under the log path are sorted in chronological order according to timestamps, and each of the plurality of log blocks includes logs within a time period; a query unit, configured to search a target log block for a log meeting a query condition, thereby obtaining a target log, wherein the target log block is a log block corresponding to a time period overlapping with the input time in the plurality of log blocks, and the query condition is generated based on the input keyword; An output unit, configured to output the target log.

7. A log query device, characterized in that: The invention comprises a processing component, a storage component and a communication module component, wherein the processing component, the storage component and the communication component are interconnected, wherein the storage component is used to store computer programs, and the communication component is used to interact with external devices; the processing component is configured to call the computer program and execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method according to any one of claims 1 to 5.

Images