Log data processing method, device, storage medium and electronic device

Abstract

This application discloses a log data processing method, device, storage medium, and electronic device, relating to the field of financial technology. The method comprises: obtaining multiple target log data; grouping the multiple target log data according to characteristic information to obtain multiple groups of target log data; determining target group target log data from the multiple groups of target log data based on the characteristic information and identification information, and determining the abnormal matching type of the target group target log data; determining the alarm information corresponding to the target group target log data based on the abnormal matching type, and outputting the target group target log data and the alarm information corresponding to the target group target log data. This application solves the problem in related technologies of being unable to promptly detect log data that incorrectly matches scan data.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and specifically, to a method, device, storage medium, and electronic device for processing log data. Background Art

[0002] In many industries, business vouchers need to be generated after a transaction is completed. The voucher image index information is scanned and entered into the system for the business log corresponding to the transaction. The collected voucher image index information is matched one by one with the relevant information recorded in one or more host (platform) logs by a computer, thereby matching the voucher image and log information for a unified business. When the image index information successfully matches at least one log information, the transaction log can be located on the system using the feature information, and the transaction voucher image corresponding to the log can be displayed.

[0003] In the related art, when matching voucher images and log information, it is required to match when all the characteristic information of the two (transaction date, area code, branch number, teller number, serial number) is exactly the same. However, in some special cases, such as incomplete log loading, irregular file data registration, etc., the image index information is not matched with all the logs that should be matched. However, due to the influence of a large amount of data in the database, the system cannot find the unmatched voucher images and log information. The unmatched problem will only be exposed when the user queries the wrong data. At the same time, there will be situations where the voucher image and log information should not be matched, but are incorrectly matched. The system has the risk of incomplete or incorrect query results, and the management efficiency is low.

[0004] Currently, no effective solution has been proposed to the problem in related technologies that log data that does not match scan data correctly cannot be discovered in a timely manner. Summary of the Invention

[0005] The present application provides a log data processing method, device, storage medium, and electronic device to solve the problem in the related art that log data that does not match scan data correctly cannot be discovered in a timely manner.

[0006] According to one aspect of the present application, a method for processing log data is provided. The method includes: obtaining multiple target log data, wherein the target log data is log data that has been matched with scan data, and the target log data includes at least the following information: characteristic information and identification information, wherein the identification information is used to indicate whether the target log data successfully matches the scan data; grouping the multiple target log data according to the characteristic information to obtain multiple groups of target log data; determining target group target log data from the multiple groups of target log data based on the characteristic information and the identification information, and determining an abnormal matching type of the target group target log data, wherein the target group target log data is at least one group of target log data in the multiple groups of target log data that has an abnormal matching type with the scan data; determining alarm information corresponding to the target group target log data based on the abnormal matching type, and outputting the target group target log data and the alarm information corresponding to the target group target log data.

[0007] Optionally, the characteristic information includes first characteristic information and second characteristic information, the first characteristic information is more important than the second characteristic information, and multiple target log data are grouped according to the characteristic information to obtain multiple groups of target log data, including: grouping target log data with the same first characteristic information into one group to obtain multiple groups of target log data.

[0008] Optionally, based on the characteristic information and the identification information, the target group target log data is determined from multiple groups of target log data, and the abnormal matching type of the target group target log data is determined, including: obtaining multiple groups of target log data with the same first characteristic information to obtain multiple groups of first target log data, obtaining each group of first target log data in which the identification information of each log data in the group indicates an unsuccessful match, obtaining first-category target group target log data, and determining the abnormal matching type of the first-category target group target log data as the first type, wherein the first type is used to indicate that the scanning process of the scanned data is executed abnormally; obtaining multiple groups of target log data with the same first characteristic information and second characteristic information to obtain multiple groups of second target log data, obtaining each log data in the group that simultaneously includes information indicating a successful match The identification information and each group of second target log data indicating unsuccessful matching are obtained to obtain the second type of target group target log data, and the abnormal matching type of the second type of target group target log data is determined to be the second type, wherein the second type includes at least one of the following: the log data is not imported or the matching execution is abnormal; multiple groups of target log data with the same first feature information and different second features are obtained to obtain multiple groups of third target log data, and each group of third target log data in each log data in the group that simultaneously includes the identification information indicating successful matching and the identification information indicating unsuccessful matching is obtained to obtain the third type of target group target log data, and the abnormal matching type of the third type of target group target log data is set to the third type, wherein the third type is used to indicate log registration abnormality.

[0009] Optionally, before obtaining multiple target log data, the method also includes: obtaining log data from multiple log files to obtain multiple first log data, and filtering the multiple first log data according to preset time conditions to obtain historical log data; matching the historical log data with the scan data to obtain target log data, and setting identification information corresponding to each target log data according to the matching result, and storing the target log data in a database, wherein the identification information of the target log data that is successfully matched is set to matched, and the identification information of the target log data that fails to match is set to unmatched.

[0010] Optionally, after generating identification information corresponding to each target log data, the method further includes: determining whether multiple log files include second log data, and if multiple log files include second log data, determining whether each second log data meets a preset time condition; storing the second log data that meets the preset time condition in a database; obtaining the log file name corresponding to the second log data that meets the preset time condition, obtaining the target log file name, and changing the attribute information of all log data corresponding to the target log file name in the database to timeout completion import; determining that the attribute information in the database is the target log data other than timeout completion, obtaining the log data to be changed, and changing the attribute information of the log data to be changed to completed import.

[0011] Optionally, determining the abnormal matching type of the second-category target group target log data as the second type includes: obtaining the log data with attribute information of the second-category target group target log data as completed import, obtaining the first sub-category target group target log data, and determining the abnormal matching type of the first sub-category target group target log data as matching execution exception; obtaining the log data with attribute information of the second-category target group target log data as completed import with timeout, obtaining the second sub-category target group target log data, and setting the abnormal matching type of the second sub-category target group target log data to log data not completed import.

[0012] Optionally, after determining the abnormal matching type of the second-category target group target log data as the second type, the method further includes: re-matching each log data in the second-category target group target log data with the scan data to obtain multiple matching results; updating the identification information of the log data according to each matching result to obtain updated target log data, re-executing the step of grouping the target log data according to the feature information to obtain multiple groups of target log data, and determining whether each group of updated target log data has a matching abnormality; in the case of a matching abnormality, determining the matching abnormality type of each group of updated target log data.

[0013] According to another aspect of the present application, a log data processing device is provided. The device includes: a first acquisition unit, configured to acquire a plurality of target log data, wherein the target log data is log data that has been matched with scan data, and the target log data includes at least the following information: characteristic information and identification information, wherein the identification information is used to indicate whether the target log data successfully matches the scan data; a first grouping unit, configured to group the plurality of target log data according to the characteristic information to obtain a plurality of groups of target log data; a first determination unit, configured to determine target group target log data from the plurality of groups of target log data based on the characteristic information and the identification information, and to determine an abnormal matching type of the target group target log data, wherein the target group target log data is at least one group of target log data in the plurality of groups of target log data that has an abnormal matching type with the scan data; and a second determination unit, configured to determine alarm information corresponding to the target group target log data based on the abnormal matching type, and output the target group target log data and the alarm information corresponding to the target group target log data.

[0014] According to another aspect of an embodiment of the present invention, a computer storage medium is provided. The computer storage medium includes a stored program. When the program is executed, the device where the computer storage medium is located is controlled to execute a method for processing log data.

[0015] According to another aspect of an embodiment of the present invention, an electronic device is provided, comprising one or more processors and a memory; the memory stores computer-readable instructions, and the processor is used to run the computer-readable instructions, wherein a method for processing log data is executed when the computer-readable instructions are run.

[0016] Through the present application, the following steps are adopted: obtaining multiple target log data, wherein the target log data is log data that has been matched with the scan data, and the target log data includes at least the following information: characteristic information, identification information, wherein the identification information is used to characterize whether the target log data is successfully matched with the scan data; grouping the multiple target log data according to the characteristic information to obtain multiple groups of target log data; determining the target group target log data from the multiple groups of target log data based on the characteristic information and the identification information, and determining the abnormal matching type of the target group target log data, wherein the target group target log data is at least one group of target log data in the multiple groups of target log data that is abnormally matched with the scan data; determining the alarm information corresponding to the target group target log data through the abnormal matching type, and outputting the target group target log data and the alarm information corresponding to the target group target log data, thereby solving the problem in the related art that log data that is incorrectly matched with the scan data cannot be discovered in a timely manner. By grouping according to feature information, filtering out abnormal log data based on different feature information and identification information, and determining the abnormal type of each group of abnormal log data based on different feature information and identification information, and then determining the alarm information corresponding to each type of abnormal log data based on the abnormal type, and feeding back the abnormal log data and the corresponding alarm information, it is achieved to timely discover the incorrect match between log information and scan data, and accurately determine the type of incorrect match. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0018] Figure 1 This is a flow chart of a method for processing log data according to an embodiment of the present application;

[0019] Figure 2 is a schematic diagram of a log data processing device provided according to an embodiment of the present application;

[0020] Figure 3 A schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0022] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0025] It should be noted that the log data processing methods, devices, storage media and electronic devices determined in the present disclosure can be used in the field of financial technology, and can also be used in any field other than the field of financial technology. The application fields of the log data processing methods, devices, storage media and electronic devices determined in the present disclosure are not limited.

[0026] According to an embodiment of the present application, a method for processing log data is provided.

[0027] Figure 1 This is a flow chart of a method for processing log data according to an embodiment of the present application. Figure 1 As shown, the method includes the following steps:

[0028] Step S101, obtaining multiple target log data, wherein the target log data is the log data matched with the scan data, and the target log data includes at least the following information: feature information, identification information, wherein the identification information is used to indicate whether the target log data is successfully matched with the scan data.

[0029] Specifically, the log data refers to one or more log data items input into the system after scanning each business voucher. The log data may include characteristic information, identification information, and other information. The characteristic information is used to match the log data with the image index information corresponding to the business voucher image, thereby establishing a correspondence between the log data and the voucher image. The identification information can be used to mark the matching result between the log data and the business voucher image. For example, the identification information can be 1 for a successful match and 0 for an unsuccessful match. After acquiring multiple target log data items, the system sends the target log data items to a data table for storage and categorizes them according to the log file names in the target log data items, thereby generating a data table storing the target log data items. The target log data items may be log data items that have been successfully matched with the scan data items. The scan data items may be image index information in the business voucher image obtained after scanning the business voucher, and may be stored in an image index information table. The image index information table can be generated by extracting image index information from multiple business voucher images after scanning the business voucher and using all the image index information.

[0030] Step S102 : Grouping multiple target log data according to feature information to obtain multiple groups of target log data.

[0031] Specifically, the characteristic information may be one or more characteristic information shared by the target log data and the image index information. The target log data and the image index information can be matched based on the characteristic information. The characteristic information may include transaction date, teller number, region number, branch number, transaction serial number, etc. All target log data in the data table can be grouped based on one or more characteristic information. For example, the target log data can be grouped based on the five characteristic information described above, or based on four of the characteristic information, to obtain multiple groups of target log data.

[0032] Step S103: Determine target group target log data from multiple groups of target log data based on feature information and identification information, and determine the abnormal matching type of the target group target log data, wherein the target group target log data is at least one group of target log data in the multiple groups of target log data that has an abnormal match with the scan data.

[0033] Specifically, after obtaining multiple groups of target log data, the multiple groups of target log data can be classified according to two dimensions: whether some feature information in the feature information is the same and whether the identification information in the same group is unified, and the multiple groups of target log data that meet the abnormality judgment conditions are set as multiple target group target log data. Then, the abnormal matching type of each target group is determined according to the feature information and identification information of the target log data in the target group, and the abnormal matching type corresponding to each target group is obtained.

[0034] For example, Table 1 is a partial data table obtained after grouping according to the four feature information in the feature information, where the four feature information are transaction date, teller number, area code, and transaction serial number. As shown in Table 1, the abnormal matching type can be determined according to the consistency of the identification information of the same group in each target group. For example, all target log data in the fourth group are 1, which indicates that the target log data and the image index information have been successfully matched. At this time, it is judged that the target log data of the target group does not meet the abnormal judgment condition; the four feature information of the two target log data in the third group are the same, but the identification information is 0, that is, it is characterized that the target log data and the image index information are not successfully matched, then the target log data of the target group meets the abnormal judgment condition, and according to the abnormal type of "the four feature information of the two target log data are the same, but the identification information is 0", the target log data of the target group is determined to be the first type of abnormality.

[0035] Table 1

[0036] Serial number Group Transaction Code Area Code Branch Number teller Transaction Date serial number Identification information 1 Group 1 2713 200 121 98096 20211125 145231768928 1 2 Group 1 2713 200 121 98096 20211125 145231768928 1 3 Group 1 2713 200 500 98096 20211125 145231768928 0 4 Group 2 2949 1201 3 98001 20211125 55002 1 5 Group 2 2949 1201 35 98001 20211125 55002 0 6 Group 3 1100 200 121 98096 20211125 55004 0 7 Group 3 1100 200 121 98096 20211125 55004 0 8 Group 4 7654 200 41 98049 20211125 55005 1 9 Group 5 7654 1600 4 94091 20211125 55003 1 10 Group 5 7654 1600 4 94091 20211125 55003 0

[0037] Step S104: determine the alarm information corresponding to the target group target log data according to the abnormal matching type, and output the target group target log data and the alarm information corresponding to the target group target log data.

[0038] Specifically, after the target group target log data is determined to be a first-class anomaly, the alarm information of the target group target log data is confirmed through the alarm information corresponding to the first-class anomaly, and the alarm information and the target group target log data are sent to the operation and maintenance personnel together, so that the operation and maintenance personnel can process the log data in a timely manner according to the alarm information and the target group target log data, and promptly handle the situation where the target log data and the image index information are incorrectly matched.

[0039] For example, if the first type of anomaly corresponds to an alarm message indicating a missed or incorrectly scanned business credential image, the target group's target log data will be identified as a missing or incorrectly scanned business credential image, resulting in no image index information. This alarm message, along with the target group's target log data, will be sent to operations personnel, allowing them to search the business credential images and determine whether any were missed or incorrectly scanned.

[0040] The log data processing method provided by the embodiment of the present application obtains multiple target log data, wherein the target log data is log data that has been matched with the scan data, and the target log data includes at least the following information: characteristic information, identification information, wherein the identification information is used to characterize whether the target log data is successfully matched with the scan data; the multiple target log data are grouped according to the characteristic information to obtain multiple groups of target log data; based on the characteristic information and the identification information, the target group target log data is determined from the multiple groups of target log data, and the abnormal matching type of the target group target log data is determined, wherein the target group target log data is at least one group of target log data in the multiple groups of target log data that is abnormally matched with the scan data; the alarm information corresponding to the target group target log data is determined according to the abnormal matching type, and the target group target log data and the alarm information corresponding to the target group target log data are output, thereby solving the problem in the related art that log data that does not match the scan data incorrectly cannot be discovered in a timely manner. By grouping according to feature information, filtering out abnormal log data based on different feature information and identification information, and determining the abnormal type of each group of abnormal log data based on different feature information and identification information, and then determining the alarm information corresponding to each type of abnormal log data based on the abnormal type, and feeding back the abnormal log data and the corresponding alarm information, it is achieved to timely discover the incorrect match between log information and scan data, and accurately determine the type of incorrect match.

[0041] Optionally, in the log data processing method provided in an embodiment of the present application, the characteristic information includes first characteristic information and second characteristic information, the first characteristic information is more important than the second characteristic information, and multiple target log data are grouped according to the characteristic information to obtain multiple groups of target log data, including: grouping target log data with the same first characteristic information into one group to obtain multiple groups of target log data.

[0042] Specifically, the first characteristic information can be the transaction date, teller number, area code, and transaction serial number among the five characteristic information, and the second characteristic information can be the branch number. When grouping, the target log data can be grouped by the characteristic information, wherein the characteristic information may include: transaction date, teller number, area code, branch number, transaction serial number, etc. However, in order to avoid excessive grouping that causes the target log data that should be grouped in one group to be divided into two groups, thereby affecting the result judgment, the target log data can be grouped according to the first characteristic information, for example, classified according to the transaction date, teller number, area code, and transaction serial number, without considering the second characteristic information of less importance.

[0043] For example, Table 2 shows an optional target characteristic information grouped according to the first characteristic information. As shown in Table 2, the network point numbers of the three target characteristic information in the first group are not all the same, but the four characteristic information in the first characteristic information are all the same. In this case, the three target characteristic information can be combined to obtain the target group target characteristic information. This embodiment classifies the target log data according to the four characteristic information, thereby avoiding the situation where the target log data that can be classified into one group is mistakenly divided into two groups.

[0044] Table 2

[0045] Serial number Group Transaction Code Area Code Branch Number teller Transaction Date serial number Check mark 1 Group 1 2713 200 121 98096 20211125 145231768928 1 2 Group 1 2713 200 121 98096 20211125 145231768928 1 3 Group 1 2713 200 500 98096 20211125 145231768928 0

[0046] Optionally, in the log data processing method provided in the embodiment of the present application, target group target log data is determined from multiple groups of target log data based on feature information and identification information, and the abnormal matching type of the target group target log data is determined, including: obtaining multiple groups of target log data with the same first feature information to obtain multiple groups of first target log data, obtaining each group of first target log data whose identification information of each log data in the group indicates an unsuccessful match, obtaining first-category target group target log data, and determining the abnormal matching type of the first-category target group target log data as the first type, wherein the first type is used to indicate that the scanning process of the scanned data is executed abnormally; obtaining multiple groups of target log data with the same first feature information and second feature information to obtain multiple groups of second target log data, obtaining each group of first target log data in the group At the same time, each group of second target log data including identification information indicating successful matching and identification information indicating unsuccessful matching is obtained to obtain second-category target group target log data, and the abnormal matching type of the second-category target group target log data is determined to be the second type, wherein the second type includes at least one of the following: log data import is not completed or matching execution is abnormal; multiple groups of target log data with the same first feature information and different second features are obtained to obtain multiple groups of third target log data, each group of third target log data including identification information indicating successful matching and identification information indicating unsuccessful matching in each log data in the group is obtained to obtain third-category target group target log data, and the abnormal matching type of the third-category target group target log data is set to the third type, wherein the third type is used to indicate log registration abnormality.

[0047] Specifically, in order to determine whether each group of target log data is a target group of target log data with matching exceptions, it can be determined based on the status of the feature information and the identification information.

[0048] Table 3 is an optional target characteristic information grouped according to the first characteristic information, wherein the first characteristic information is the transaction date, teller number, area code, and transaction serial number. As shown in Table 3, multiple groups of target log data with the same first characteristic information and the identification information of each log data in the group indicating unsuccessful matching can be set as target group target log data, and all such target group target log data are set as first-class abnormal matching target group target log data. For example, in the third group of target log data in Table 3, the first characteristic information is the same, and the identification information is all 0, that is, all are unsuccessful matches, then the third group of target log data is set as first-class abnormal matching target group target log data, and the first-class abnormality can be set as missed or incorrect scanning of the business voucher image.

[0049] At the same time, multiple groups of target log data in which the first feature and the second feature information are the same and the identification information of each log data in the group includes both successful matching and unsuccessful matching situations can be set as target group target log data, and all such target group target log data can be set as second-category abnormal matching target group target log data. For example, in the fifth group of target log data in Table 3, the first feature information and the second feature information are the same, and the identification information of the target log data with sequence number 9 in the group is 1, and the identification information of the target log data with sequence number 10 is 0, that is, it includes both successful matching and unsuccessful matching situations. Then, the fifth group of target log data is set as second-category abnormal matching target group target log data, and the second-category abnormality can be set as log data incomplete import or matching execution abnormality.

[0050] It should be noted that multiple groups of target log data with the same first feature information and different second features, and the identification information of each log data in the group includes both successful matching and unsuccessful matching, can also be set as target group target log data, and all such target group target log data can be set as third-category abnormal matching target group target log data. For example, in the first and second groups of target log data in Table 3, the first feature information is the same and the second feature is different, and the identification information of the target log data with sequence numbers 1 and 2 in the first group is 1, the identification information of the target log data with sequence number 3 is 0, the identification information of the target log data with sequence number 4 in the second group is 1, and the identification information of the target log data with sequence number 5 is 0, that is, it includes both successful matching and unsuccessful matching. In this case, the first and second groups of target log data are set as third-category abnormal matching target group target log data, and the third type of abnormality can be set as incorrect log registration. This embodiment achieves the effect of quickly obtaining the error matching type and error matching cause of log data and scan data by determining the matching abnormality type and corresponding alarm information of each group of target log data.

[0051] Table 3

[0052] Serial number Group Transaction Code Area Code Branch Number teller Transaction Date serial number Identification information 1 Group 1 2713 200 121 98096 20211125 145231768928 1 2 Group 1 2713 200 121 98096 20211125 145231768928 1 3 Group 1 2713 200 500 98096 20211125 145231768928 0 4 Group 2 2949 1201 3 98001 20211125 55002 1 5 Group 2 2949 1201 35 98001 20211125 55002 0 6 Group 3 1100 200 121 98096 20211125 55004 0 7 Group 3 1100 200 121 98096 20211125 55004 0 8 Group 4 7654 200 41 98049 20211125 55005 1 9 Group 5 7654 1600 4 94091 20211125 55003 1 10 Group 5 7654 1600 4 94091 20211125 55003 0

[0053] Optionally, in the log data processing method provided in the embodiment of the present application, before obtaining multiple target log data, the method also includes: obtaining log data from multiple log files to obtain multiple first log data, and filtering the multiple first log data according to preset time conditions to obtain historical log data; matching the historical log data with the scan data to obtain target log data, and setting identification information corresponding to each target log data according to the matching result, and storing the target log data in a database, wherein the identification information of the target log data that is successfully matched is set to matched, and the identification information of the target log data that fails to match is set to unmatched.

[0054] Specifically, the preset time condition can be set in the form of a table. For example, if it is currently necessary to match all business voucher images generated on a certain day with all corresponding log data, it is necessary to obtain all image index information and log information of that day. All image index information of that day can be obtained from the image index information table, and the transaction code information in all image index information can be extracted. Then, through the preset transaction code and log file name relationship table, the historical log information of the day of the transaction code information can be obtained from each log file.

[0055] All historical log information is matched against the image index information, and after matching, identification information for each historical log information is set. For example, the identification information of a successfully matched historical log information is set to 1, and the identification information of an unmatched historical log information is set to 0. After the configuration is complete, the target log information is obtained and all target log information is stored in the database. This embodiment achieves the effect of accurately obtaining the log data that needs to be matched and determining the matching result of each log data by setting identification information.

[0056] Optionally, in the log data processing method provided in the embodiment of the present application, after generating identification information corresponding to each target log data, the method also includes: determining whether multiple log files include second log data, and if multiple log files include second log data, determining whether each second log data meets the preset time condition; storing the second log data that meets the preset time condition in a database; obtaining the log file name corresponding to the second log data that meets the preset time condition, obtaining the target log file name, and changing the attribute information of all log data corresponding to the target log file name in the database to timeout completion import; determining that the attribute information in the database is the target log data other than timeout completion, obtaining the log data to be changed, and changing the attribute information of the log data to be changed to completed import.

[0057] Specifically, to avoid the situation where not all log information for the day is obtained, a second set of log data is obtained after the first set of target log data is obtained. The second set of log data is obtained from multiple log files based on the first set of target log data, rather than being re-acquired. After obtaining the second set of log data, a determination is made as to whether the second log file contains log data corresponding to the transaction code information for the day. If log data corresponding to the transaction code information for the day is present, the log data is directly stored in the database, the identification information for the log data is set to 0, and the target log file name for the log information is recorded.

[0058] It should be noted that after the log data is stored in the database and the identification information of the log data is set to 0, the log data becomes the target log data and is stored in the database together with the remaining target log data. Afterwards, the attribute information of all target log information in the database whose log file name is the target log file name is changed to "import completed after timeout", and the attribute information of the remaining target log data in the database is all changed to "import completed after timeout". When the attribute information of all target log data in the database is "import completed after timeout" or "import completed", the target log data acquisition is completed and the step of grouping by feature information is started. This embodiment avoids the omission of log information by acquiring the second log data from multiple log files again after acquiring the first log data, and distinguishes the two acquired log data by attribute information, thereby marking the unmatched log information due to omission, so that it can be distinguished and matched again.

[0059] Optionally, in the log data processing method provided in the embodiment of the present application, determining the abnormal matching type of the second-category target group target log data as the second type includes: obtaining the log data whose attribute information in the second-category target group target log data is completed import, obtaining the first sub-category target group target log data, and determining the abnormal matching type of the first sub-category target group target log data as a matching execution exception; obtaining the log data whose attribute information in the second-category target group target log data is completed import with timeout, obtaining the second sub-category target group target log data, and setting the abnormal matching type of the second sub-category target group target log data to the log data not completed import.

[0060] Specifically, after setting multiple groups of target log data as the second category exception matching target group target log data, the second category exception matching target group target log data can be further classified according to the attribute information, and the second category exception matching target group target log data with attribute information that has been imported can be set as the first subcategory exception matching target group target log data in the second category, and the first subcategory exception can be set as a matching execution exception.

[0061] It should be noted that the second-category abnormal matching target group target log data with attribute information of timed-out import completion can also be set as the second subcategory abnormal matching target group target log data in the second category, and the first subcategory abnormality can be set as the log data import not completed. This embodiment achieves the effect of more accurately determining the abnormal cause of the target log data of the second-category matching abnormality.

[0062] Optionally, in the log data processing method provided in the embodiment of the present application, after determining the abnormal matching type of the second-category target group target log data as the second type, the method further includes: re-matching each log data in the second-category target group target log data with the scan data to obtain multiple matching results; updating the identification information of the log data according to each matching result to obtain updated target log data, re-executing the step of grouping the target log data according to the feature information to obtain multiple groups of target log data, and determining whether each group of updated target log data has a matching abnormality; in the case of a matching abnormality, determining the matching abnormality type of each group of updated target log data.

[0063] Specifically, after setting multiple groups of target log data as the second type of abnormal matching target group target log data, the identification information of all information in the second type of abnormal matching target group target log data can be modified to 0, and the matching step with the business credential image is repeated. After the matching is completed, the data is grouped again according to the characteristic information, and the multiple groups of target log data obtained after grouping are subjected to abnormal matching judgment to obtain target group target log data of multiple abnormal matching types. This embodiment can re-match the target log data with matching abnormalities caused by accidental mismatches in the second type of abnormal matching target group target log data, thereby achieving the effect of improving the accuracy of the matching judgment result.

[0064] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0065] The present application also provides a log data processing device. It should be noted that the log data processing device of the present application can be used to execute the log data processing method provided in the present application. The following describes the log data processing device provided in the present application.

[0066] Figure 2 Schematic diagram of a log data processing device according to an embodiment of the present application. Figure 2 As shown, the device includes:

[0067] A first acquisition unit 10 is configured to acquire a plurality of target log data, wherein the target log data is log data that has been matched with the scan data, and the target log data includes at least the following information: feature information and identification information, wherein the identification information is used to indicate whether the target log data is successfully matched with the scan data;

[0068] The first grouping unit 20 is configured to group the plurality of target log data according to the characteristic information to obtain a plurality of groups of target log data;

[0069] a first determining unit 30 for determining target group target log data from the multiple groups of target log data based on the feature information and the identification information, and determining an abnormal matching type of the target group target log data, wherein the target group target log data is at least one group of target log data in the multiple groups of target log data that has an abnormal match with the scan data;

[0070] The second determining unit 40 is configured to determine the alarm information corresponding to the target group target log data according to the abnormal matching type, and output the target group target log data and the alarm information corresponding to the target group target log data.

[0071] The log data processing device provided in the embodiment of the present application obtains multiple target log data through a first acquisition unit 10, wherein the target log data is log data that has been matched with the scan data, and the target log data includes at least the following information: feature information, identification information, wherein the identification information is used to characterize whether the target log data is successfully matched with the scan data; the first grouping unit 20 groups the multiple target log data according to the feature information to obtain multiple groups of target log data; the first determination unit 30 determines the target group target log data from the multiple groups of target log data based on the feature information and the identification information, and determines the abnormal matching type of the target group target log data, wherein the target group target log data is at least one group of target log data in the multiple groups of target log data that has an abnormal match with the scan data; the second determination unit 40 determines the alarm information corresponding to the target group target log data according to the abnormal matching type, and outputs the target group target log data and the alarm information corresponding to the target group target log data, thereby solving the problem in the related art that log data that incorrectly matches the scan data cannot be discovered in a timely manner. By grouping according to feature information, filtering out abnormal log data based on different feature information and identification information, and determining the abnormal type of each group of abnormal log data based on different feature information and identification information, and then determining the alarm information corresponding to each type of abnormal log data based on the abnormal type, and feeding back the abnormal log data and the corresponding alarm information, it is achieved to timely discover the incorrect match between log information and scan data, and accurately determine the type of incorrect match.

[0072] Optionally, in the log data processing device provided in the embodiment of the present application, the characteristic information includes first characteristic information and second characteristic information, the first characteristic information is more important than the second characteristic information, and the first grouping unit 20 includes: a first grouping module, used to group target log data with the same first characteristic information into a group to obtain multiple groups of target log data.

[0073] Optionally, in the log data processing device provided in the embodiment of the present application, the first determination unit 30 includes: a first determination module, used to obtain multiple groups of target log data with the same first characteristic information, obtain multiple groups of first target log data, obtain the identification information of each log data in the group indicating that the match was not successful, obtain the first type of target group target log data, and determine the abnormal matching type of the first type of target group target log data as the first type, wherein the first type is used to indicate that the scanning process of the scan data is abnormal; a second determination module, used to obtain multiple groups of target log data with the same first characteristic information and second characteristic information, obtain multiple groups of second target log data, obtain the identification information and indication information of each log data in the group that simultaneously indicate a successful match. Each group of second target log data with identification information that was not successfully matched obtains the second type of target group target log data, and determines the abnormal matching type of the second type of target group target log data as the second type, wherein the second type includes at least one of the following: the log data is not imported or the matching execution is abnormal; a third determination module is used to obtain multiple groups of target log data with the same first feature information and different second features to obtain multiple groups of third target log data, obtain each group of third target log data in each log data in the group that simultaneously includes identification information indicating a successful match and identification information indicating an unsuccessful match, obtain the third type of target group target log data, and set the abnormal matching type of the third type of target group target log data to the third type, wherein the third type is used to indicate log registration abnormality.

[0074] Optionally, in the log data processing device provided in the embodiment of the present application, the device also includes: a second acquisition unit, used to acquire log data from multiple log files to obtain multiple first log data, and filter the multiple first log data according to preset time conditions to obtain historical log data; a first matching unit, used to match the historical log data with the scan data to obtain target log data, and set the identification information corresponding to each target log data according to the matching result, and store the target log data in a database, wherein the identification information of the target log data that is successfully matched is set to matched, and the identification information of the target log data that fails to match is set to unmatched.

[0075] Optionally, in the log data processing device provided in the embodiment of the present application, the device also includes: a first judgment unit, used to judge whether the second log data is included in multiple log files, and when the second log data is included in multiple log files, judge whether each second log data meets the preset time condition; a first storage unit, used to store the second log data that meets the preset time condition in a database; a third acquisition unit, used to obtain the log file name corresponding to the second log data that meets the preset time condition, obtain the target log file name, and change the attribute information of all log data corresponding to the target log file name in the database to timeout completion import; a third determination unit, used to determine that the attribute information in the database is the target log data other than timeout completion, obtain the log data to be changed, and change the attribute information of the log data to be changed to completed import.

[0076] Optionally, in the log data processing device provided in the embodiment of the present application, the second acquisition module includes: a first acquisition sub-module, used to obtain the log data whose attribute information in the second-category target group target log data is completed import, obtain the first sub-category target group target log data, and determine the abnormal matching type of the first sub-category target group target log data as a matching execution abnormality; a second acquisition sub-module, used to obtain the log data whose attribute information in the second-category target group target log data is completed import with timeout, obtain the second sub-category target group target log data, and set the abnormal matching type of the second sub-category target group target log data to incomplete import of log data.

[0077] Optionally, in the log data processing device provided in the embodiment of the present application, the device also includes: a second matching unit, used to re-match each log data in the target log data of the second type target group with the scan data to obtain multiple matching results; a first execution unit, used to update the identification information of the log data according to each matching result, obtain updated target log data, re-execute the step of grouping the target log data according to the feature information to obtain multiple groups of target log data, and determine whether each group of updated target log data has a matching exception; a fourth determination unit, used to determine the matching exception type of each group of updated target log data in the case of a matching exception.

[0078] The above-mentioned log data processing device includes a processor and a memory. The above-mentioned first acquisition unit 10, first grouping unit 20, first determination unit 30, second determination unit 40, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0079] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set. By adjusting the kernel parameters, the problem of the related art of not being able to timely detect log data that does not match the scan data is solved.

[0080] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0081] An embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the method for processing log data is implemented.

[0082] An embodiment of the present invention provides a processor, which is used to run a program, wherein the method for processing log data is executed when the program is running.

[0083] like Figure 3 As shown, an embodiment of the present invention provides an electronic device. The electronic device 50 includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are performed: obtaining multiple target log data, wherein the target log data is log data that has been matched with scan data, and the target log data includes at least the following information: characteristic information and identification information, wherein the identification information is used to indicate whether the target log data successfully matches the scan data; grouping the multiple target log data according to the characteristic information to obtain multiple groups of target log data; determining target group target log data from the multiple groups of target log data based on the characteristic information and identification information, and determining an abnormal matching type of the target group target log data, wherein the target group target log data is at least one group of target log data in the multiple groups of target log data that has an abnormal matching type with the scan data; determining alarm information corresponding to the target group target log data based on the abnormal matching type, and outputting the target group target log data and the alarm information corresponding to the target group target log data. The device herein can be a server, a PC, a PAD, a mobile phone, etc.

[0084] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialized program having the following method steps: obtaining multiple target log data, wherein the target log data is log data that has been matched with the scan data, and the target log data includes at least the following information: characteristic information, identification information, wherein the identification information is used to characterize whether the target log data is successfully matched with the scan data; grouping the multiple target log data according to the characteristic information to obtain multiple groups of target log data; determining the target group target log data from the multiple groups of target log data based on the characteristic information and the identification information, and determining the abnormal matching type of the target group target log data, wherein the target group target log data is at least one group of target log data in the multiple groups of target log data that has an abnormal match with the scan data; determining the alarm information corresponding to the target group target log data through the abnormal matching type, and outputting the target group target log data and the alarm information corresponding to the target group target log data.

[0085] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0086] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0087] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0088] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0089] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0090] Memory may include non-permanent memory in a computer storage medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0091] Computer storage media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0092] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0093] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0094] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for processing log data, characterized in that: include: Acquire multiple target log data, wherein the target log data is log data that has been matched with the scan data, and the target log data includes at least the following information: feature information and identification information, wherein the identification information is used to indicate whether the target log data successfully matches the scan data; Grouping the plurality of target log data according to the characteristic information to obtain a plurality of groups of target log data; Determining target group target log data from the multiple groups of target log data based on the feature information and the identification information, and determining an abnormal matching type of the target group target log data, wherein the target group target log data is at least one group of target log data in the multiple groups of target log data that has an abnormal match with the scan data; Determine the alarm information corresponding to the target group target log data according to the abnormal matching type, and output the target group target log data and the alarm information corresponding to the target group target log data; The characteristic information includes first characteristic information and second characteristic information, the first characteristic information is more important than the second characteristic information, and grouping the plurality of target log data according to the characteristic information to obtain the plurality of groups of target log data includes: grouping the target log data having the same first characteristic information into one group to obtain the plurality of groups of target log data; Wherein, determining target group target log data from multiple groups of target log data according to the feature information and the identification information, and determining the abnormal matching type of the target group target log data includes: Acquire multiple groups of target log data with the same first feature information to obtain multiple groups of first target log data, obtain each group of the first target log data in which the identification information of each log data in the group indicates that the match was unsuccessful to obtain first-category target group target log data, and determine the abnormal matching type of the first-category target group target log data as a first type, wherein the first type is used to indicate that the scanning process of the scanned data is executed abnormally; Acquire multiple groups of target log data having the same first characteristic information and second characteristic information to obtain multiple groups of second target log data, acquire each group of the second target log data in each log data group that includes both the identification information indicating a successful match and the identification information indicating an unsuccessful match to obtain target log data of a second type of target group, and determine the abnormal matching type of the target log data of the second type of target group as a second type, wherein the second type includes at least one of the following: incomplete import of log data or abnormal matching execution; Acquire multiple groups of target log data with the same first feature information and different second features to obtain multiple groups of third target log data, obtain each group of the third target log data in each log data in the group that simultaneously includes the identification information indicating a successful match and the identification information indicating an unsuccessful match, obtain the third type of target group target log data, and set the abnormal matching type of the third type of target group target log data to the third type, wherein the third type is used to indicate log registration abnormality.

2. The method according to claim 1, characterized in that Before acquiring the plurality of target log data, the method further includes: Obtaining log data from a plurality of log files to obtain a plurality of first log data, and filtering the plurality of first log data according to a preset time condition to obtain historical log data; Match the historical log data with the scan data to obtain the target log data, and set the identification information corresponding to each target log data according to the matching result, and store the target log data in a database, wherein the identification information of the target log data that is successfully matched is set to matched, and the identification information of the target log data that is unmatched is set to unmatched.

3. The method according to claim 2, characterized in that After generating the identification information corresponding to each target log data, the method further includes: determining whether the plurality of log files include second log data, and if the plurality of log files include second log data, determining whether each second log data meets a preset time condition; storing the second log data that meets the preset time condition in a database; Obtaining the log file name corresponding to the second log data that meets the preset time condition, obtaining a target log file name, and changing the attribute information of all log data corresponding to the target log file name in the database to timeout completion import; Determine that the attribute information in the database is the target log data other than the target log data that has been timed out, obtain the log data to be changed, and change the attribute information of the log data to be changed to the target log data that has been imported.

4. The method according to claim 3, characterized in that Determining the abnormal matching type of the target log data of the second target group as the second type includes: Obtaining the attribute information of the second-category target group target log data as the log data that has been imported, obtaining the first subcategory target group target log data, and determining the abnormal matching type of the first subcategory target group target log data as a matching execution abnormality; Obtain the log data whose attribute information in the second-category target group target log data is the log data whose import is completed with timeout, obtain the second-subcategory target group target log data, and set the abnormal matching type of the second-subcategory target group target log data to the log data is not completed import.

5. The method according to claim 1, wherein After determining the abnormal matching type of the second-type target group target log data as the second type, the method further includes: Re-matching each log data in the second target group target log data with the scan data to obtain multiple matching results; updating the identification information of the log data according to each matching result to obtain updated target log data, re-performing the step of grouping the target log data according to the characteristic information to obtain multiple groups of target log data, and determining whether each group of the updated target log data has a matching anomaly; In the case of a matching exception, a matching exception type of each set of the updated target log data is determined.

6. A log data processing device, characterized in that: include: A first acquiring unit is configured to acquire a plurality of target log data, wherein the target log data is log data that has been matched with the scan data, and the target log data includes at least the following information: feature information and identification information, wherein the identification information is used to indicate whether the target log data successfully matches the scan data; a first grouping unit, configured to group the plurality of target log data according to the characteristic information to obtain a plurality of groups of target log data; the characteristic information includes first characteristic information and second characteristic information, the first characteristic information being more important than the second characteristic information; a first determining unit, configured to determine a target group of target log data from the multiple groups of target log data based on the feature information and the identification information, and determine an abnormal matching type of the target group of target log data, wherein the target group of target log data is at least one group of target log data in the multiple groups of target log data that has an abnormal matching with the scan data; A second determining unit is configured to determine the alarm information corresponding to the target group target log data according to the abnormal matching type, and output the target group target log data and the alarm information corresponding to the target group target log data; The first grouping unit includes: a first grouping module, configured to group the target log data having the same first characteristic information into one group, to obtain the multiple groups of target log data; Wherein, the first determination unit includes: a first determination module, used to obtain multiple groups of target log data with the same first characteristic information, obtain multiple groups of first target log data, obtain each group of the first target log data in which the identification information of each log data in the group indicates an unsuccessful match, obtain first-category target group target log data, and determine the abnormal matching type of the first-category target group target log data as a first type, wherein the first type is used to indicate that the scanning process of the scan data is executed abnormally; a second determination module, used to obtain multiple groups of target log data with the same first characteristic information and second characteristic information, obtain multiple groups of second target log data, obtain each group of the log data in the group that includes both the identification information indicating a successful match and the identification information indicating an unsuccessful match. The second target log data is grouped to obtain the second type of target group target log data, and the abnormal matching type of the second type of target group target log data is determined to be the second type, wherein the second type includes at least one of the following: the log data is not imported or the matching is executed abnormally; a third determination module is used to obtain multiple groups of target log data with the same first feature information and different second features to obtain multiple groups of third target log data, obtain each group of the third target log data in each log data in the group that simultaneously includes the identification information indicating a successful match and the identification information indicating an unsuccessful match, obtain the third type of target group target log data, and set the abnormal matching type of the third type of target group target log data to the third type, wherein the third type is used to indicate a log registration abnormality.

7. A computer storage medium, characterized in that The computer storage medium includes a stored program, wherein when the program is run, the device where the computer storage medium is located is controlled to execute the log data processing method according to any one of claims 1 to 5.

8. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the log data processing method described in any one of claims 1 to 5.

Images