Event log merging method, device, equipment and storage medium

Abstract

The present application provides a method, device, equipment and storage medium for merging event logs. The method includes: starting from the initial log merge line number, increasing in sequence, based on the log merge sequence of the event log file under the current merge line number and the adjacent line logs of the log merge sequence, determining the log merge sequence of the event log file under the next merge line number, so as to obtain the log merge sequence of the event log file under each merge line number; according to the log merge sequence of the event log file under each merge line number, merging each line of log in the event log file accordingly. The present application adopts the method of increasing the merge line number and searching the log merge sequence under each merge line number layer by layer, reducing the computational overhead of the log merge sequence of the event log file under each merge line number, improving the merging efficiency of the event log, realizing the automatic merging of each line of log in the event log file, and ensuring the accurate merging of multiple lines of log in the event log file.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data processing technology, and in particular to a method, apparatus, device, and storage medium for merging event logs. Background Art

[0002] When various business events are executed within a business system, corresponding log files are generated to record the specific execution information of the business event. In the past, log analysis was mostly focused on basic software and hardware, where a single line of log output per event was sufficient to fully describe the event. However, with the increasing complexity of event execution within business applications, a single event often generates multiple log lines to fully record the same event. Therefore, when using logs to analyze the execution of individual events, it is necessary to merge multiple log lines belonging to the same event object.

[0003] Currently, merging multiple log lines belonging to the same event object typically involves manually analyzing each log line after automatically parsing it to see if there are strong connections between them. This allows for merging the multiple log lines belonging to each event object. However, since manual analysis of connections between log lines requires high log parsing skills, merging multiple log lines is labor-intensive and cannot guarantee the accuracy of merging multiple log lines belonging to the same event object. Summary of the Invention

[0004] The present application provides a method, apparatus, device and storage medium for merging event logs, which uses an increasing number of merged lines to search layer by layer for log merge sequences under each merged line number, thereby realizing the automatic merging of each line of log in the event log file. On the basis of ensuring the accurate merging of multiple lines of log in the event log file, the computational overhead of event log merging is reduced, and the efficiency of event log merging is improved.

[0005] In a first aspect, an embodiment of the present application provides a method for merging event logs, the method comprising:

[0006] Starting from the initial log merge row number, the log merge sequence of the event log file under the next merge row number is determined based on the log merge sequence of the event log file under the current merge row number and the adjacent row logs of the log merge sequence, so as to obtain the log merge sequence of the event log file under each merge row number;

[0007] According to the log merging sequence of the event log file under each merged line number, each line of log in the event log file is merged accordingly.

[0008] Furthermore, the method starts incrementing from the initial number of log merge rows and sequentially determines the log merge sequence of the event log file under the next number of merge rows based on the log merge sequence of the event log file under the current number of merge rows and the adjacent row logs of the log merge sequence, including:

[0009] Taking the initial log merge row number as the current merge row number, determining the log merge sequence of the event log file under the current merge row number;

[0010] Determine, based on each log merge sequence of the event log file under the current merge row number and adjacent row logs of the log merge sequence, a log merge sequence of the event log file under the next merge row number after the current merge row number is incremented;

[0011] The next merged row number is used as the new current merged row number, and the log merge sequence of the event log file under the new next merged row number is continuously determined until the log merge sequence of the event log file under the next merged row number is empty.

[0012] Furthermore, the step of using the initial log merge row number as the current merge row number and determining the log merge sequence of the event log file under the current merge row number includes:

[0013] For each optional log merge sequence of the event log file under the initial log merge row number, calculating the merging influence of each log element in the optional log merge sequence on the optional log merge sequence;

[0014] Performing a weighted summation of the merging influences of the log elements in the optional log merging sequence on the optional log merging sequence to obtain a merging support of the optional log merging sequence;

[0015] The optional log merging sequences whose merging support exceeds a preset threshold are combined to obtain a log merging sequence of the event log file under the initial number of log merging rows.

[0016] Furthermore, determining the log merge sequence of the event log file at the next merge row number after the current merge row number is incremented based on each log merge sequence of the event log file at the current merge row number and the adjacent row logs of the log merge sequence includes:

[0017] For each log merge sequence of the event log file under the current merge row number, merge the log merge sequence with the adjacent row log of the log merge sequence in the event log file to obtain an optional log merge sequence of the event log file under the next merge row number;

[0018] For each optional log merge sequence of the event log file under the next merge row number, calculating the merge influence of the adjacent row log elements in the optional log merge sequence on the optional log merge sequence as the merge support of the optional log merge sequence;

[0019] The optional log merging sequences whose merging support exceeds a preset threshold are combined to obtain a log merging sequence of the event log file under the next number of merged rows.

[0020] Furthermore, the merging influence of any log element in the optional log merging sequence on the optional log merging sequence is obtained in the following manner:

[0021] According to the first occurrence number of the optional log merge sequence in the event log file and the second occurrence number of any log element in the optional log merge sequence in the event log file, the merging influence degree of the log element in the optional log merge sequence on the optional log merge sequence is calculated.

[0022] Furthermore, the step of merging the log lines in the event log file according to the log merging sequence under each merged line number of the event log file includes:

[0023] From the maximum number of merged rows to the initial number of merged log rows, the target row log pointed to by each log merge sequence under each number of merged rows in the event log file is merged in reverse order.

[0024] In a second aspect, an embodiment of the present application provides a device for merging event logs, the device comprising:

[0025] A log merge sequence determination module is configured to determine the log merge sequence of the event log file under the next merge row number, starting from the initial log merge row number and based on the log merge sequence of the event log file under the current merge row number and the adjacent row logs of the log merge sequence, so as to obtain the log merge sequence of the event log file under each merge row number;

[0026] The log merging module is used to merge the log lines in the event log file according to the log merging sequence under each merged line number of the event log file.

[0027] In a third aspect, an embodiment of the present application provides an electronic device, the electronic device comprising:

[0028] A processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute the event log merging method provided in the first aspect of the present application.

[0029] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program enables a computer to execute the event log merging method provided in the first aspect of the present application.

[0030] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program / instruction, characterized in that when the computer program / instruction is executed by a processor, it implements the event log merging method provided in the first aspect of the present application.

[0031] The embodiments of the present application provide a method, apparatus, device and storage medium for merging event logs, which starts from an initial log merge line number and increases incrementally. For each merge line number, the log merge sequence of the event log file under the next merge line number is determined based on the log merge sequence of the event log file under the current merge line number and the adjacent line logs of the log merge sequence, thereby obtaining the log merge sequence of the event log file under each merge line number. At this time, the log merge sequence under each merge line number is further searched layer by layer on the basis of the log merge sequence determined under the previous merge line number by increasing the merge line number, thereby reducing the computational overhead of the log merge sequence of the event log file under each merge line number and improving the merging efficiency of the event log; then, according to the log merge sequence of the event log file under each merge line number, each line of log in the event log file is merged accordingly, thereby realizing automatic merging of each line of log in the event log file and ensuring accurate merging of multiple lines of log in the event log file. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 This is a flow chart of a method for merging event logs shown in an embodiment of the present application;

[0034] Figure 2 This is a flowchart of another method for merging event logs according to an embodiment of the present application;

[0035] Figure 3 This is a functional block diagram of a device for merging event logs according to an embodiment of the present application;

[0036] Figure 4 It is a schematic block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0038] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way are interchangeable where appropriate so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0039] Taking into account the problem that merging multiple lines of logs belonging to the same event object in a log file will consume a lot of manpower and cannot guarantee the accuracy of log merging, the embodiment of the present application designs an automated multi-line log merging method, which starts from a preset initial log merging line number and then increases incrementally. Then, for each merged line number, the log lines under the merged line number in the event log file are analyzed in turn to see whether they belong to the same event object, thereby obtaining the log merging sequence of the event log file under each merged line number, and merging each line of log in the event log file according to the log merging sequence of the event log file under each merged line number, thereby realizing the automatic merging of each line of log in the event log file and ensuring the accurate merging of multiple lines of log in the event log file.

[0040] Figure 1 This is a flow chart of a method for merging event logs shown in an embodiment of the present application. Figure 1 , the method may specifically include the following steps:

[0041] S110, starting from the initial log merge line number, based on the log merge sequence of the event log file under the current merge line number and the adjacent line log of the log merge sequence, determine the log merge sequence of the event log file under the next merge line number to obtain the log merge sequence of the event log file under each merge line number.

[0042] The event log file in this application is a multi-line log file that describes the specific execution information of each business event after a business application system executes it. This event log file contains multiple lines of log output for each business event executed by the business application system. To analyze the specific execution information of each business event, it is necessary to merge multiple lines of logs belonging to the same event object within the event log file.

[0043] Taking into account the complexity of the execution of each business event, the number of log lines output to fully describe the event execution information varies. Therefore, there are many situations in which the number of merged lines is required when merging multiple lines of logs belonging to the same event object in the event log file. For example, a business event outputs two lines of logs, while another business event outputs five lines of logs, which together constitute an event log file. When merging the logs belonging to the same event object in the event log file, the two lines of logs and the five lines of logs will be merged separately.

[0044] Therefore, in order to ensure the comprehensiveness of multi-line log merging in the event log file, this application will set an initial log merging line number, which is the minimum number of merged lines required for multi-line log merging in the event log file. For example, at least two log lines will be merged in the event log file. Then, starting from the initial log merging line number, the application will increase the number of merged lines, and for each merged line number that exists after each increase, the application will analyze layer by layer whether the log lines under the merged line number in the event log file belong to the same event object and need to be merged, thereby realizing the layer-by-layer search iteration of log merging in the event log file and ensuring the comprehensiveness of multi-line log merging in the event log file.

[0045] As an optional implementation scheme in an embodiment of the present application, starting from the initial log merge line number, multiple log lines under the initial log merge line number are analyzed in the event log file to determine whether they belong to the same event object, to determine whether the multiple log lines under each initial log merge line number can be merged, thereby obtaining a log merge sequence in the event log file that can be formed by merging multiple logs under the initial log merge line number. Then, the log merge sequence under the initial log merge line number in the event log file is used as the starting value for reference in subsequent analysis of the log merge sequence under each merge line number that exists after each increment.

[0046] That is, each time the number of merged log lines is incremented starting from the initial number, a new number of merged lines can be obtained, and the log merge sequence of the event log file under the new number of merged lines can be analyzed.

[0047] At this point, considering that for multi-line logs belonging to the same event object, it can be deduced that if any subset sequence of a certain type of multi-line log does not belong to the same event object, then the multi-line logs of that type must also not belong to the same event object. Therefore, when starting from the initial log merge line number and analyzing the log merge sequence of the event log file under the new merge line number after each increment, the log merge sequence under the current merge line number can be referenced. By adding a new log to each log merge sequence under the current merge line number, the log merge sequence under the next merge line number after the current merge line number increment can be obtained. Therefore, when analyzing the log merge sequence under the next merge line number, it is only necessary to determine whether the log merge sequence belongs to the same event object as the new log based on each log merge sequence under the current merge line number and merge it. There is no need to perform a global merge search under each merge log. By using the incrementing merge line number, the log merge sequence under each incremented merge line number can be further searched layer by layer based on the log merge sequence determined under the current merge line number, thereby reducing the computational overhead of the log merge sequence under each merge line number of the event log file and improving the efficiency of event log merging.

[0048] Moreover, since multiple lines of logs belonging to the same event object exist continuously in the event log file, when merging by judging whether the newly added logs belong to the same event object on the basis of each log merge sequence under the current merge line number, the newly added logs of each log merge sequence under the current merge line number are the adjacent line logs of the log merge sequence in the event log file, including the previous line log and the next line log located in the log merge sequence. Thus, based on each log merge sequence under the current merge line number, it is judged whether the log merge sequence and the adjacent line logs of the log merge sequence belong to the same event object and need to be merged, so as to obtain the log merge sequence of the event log file under the next merge line number. At this time, after each increment starting from the initial log merge line number, the same steps are performed once to obtain the log merge sequence of the event log file under each merge line number.

[0049] S120 , merging each line of log in the event log file according to the log merging sequence under each merging line number of the event log file.

[0050] After obtaining the log merge sequence for each merge line number in the event log file, it can be determined that each log element contained in each log merge sequence belongs to the same event object and needs to be merged. Therefore, for each log merge sequence under each merge line number, the log elements contained in the log merge sequence can be found in the event log file, and then each log element can be merged, thereby merging the log lines in the event log file that belong to the same event object.

[0051] It should be noted that, given that log merge sequences with different merge row counts may have log inclusion relationships between upper and lower layers, the same multiple log rows may be merged under different merge row counts. For example, in log merge sequences AB and ABC, logs A and B will both be merged. Therefore, to eliminate multi-row log merge redundancy caused by log inclusion relationships between log merge sequences with different merge row counts, this application will merge the target row logs pointed to in the event log file for each log merge sequence with each merge row count in reverse order, from the maximum merge row count to the initial log merge row count.

[0052] That is, each merged row number is traversed in reverse order from the maximum merged row number to the initial log merged row number, so as to find the log elements contained in each log merge sequence under each merged row number from the event log file, thereby obtaining the target row log pointed to by the log merge sequence in the event log file, and merging each target row log pointed to by each log merge sequence. At this time, for log merge sequences with log inclusion relationships, a log merge operation with a high merged row number is performed once. For example, in log merge sequences AB and ABC, when logs A, B, and C are merged according to log merge sequence ABC, the log merge under log merge sequence AB is simultaneously implemented, thereby eliminating the problem of redundant multi-row log merges.

[0053] The technical solution provided by the embodiment of the present application starts to increase from the initial log merge line number, and for each merge line number, determines the log merge sequence of the event log file under the next merge line number based on the log merge sequence of the event log file under the current merge line number and the adjacent line logs of the log merge sequence, thereby obtaining the log merge sequence of the event log file under each merge line number. At this time, the log merge sequence under each merge line number is further searched layer by layer on the basis of the log merge sequence determined under the previous merge line number by increasing the merge line number, thereby reducing the computational overhead of the log merge sequence of the event log file under each merge line number and improving the merging efficiency of the event log; then, according to the log merge sequence of the event log file under each merge line number, the log lines in the event log file are merged accordingly, thereby realizing the automatic merging of the log lines in the event log file and ensuring the accurate merging of multiple log lines in the event log file.

[0054] As an optional implementation scheme in the embodiment of the present application, in order to ensure the accuracy of the log merge sequence of the event log file at each merge line number, the present application provides a detailed description of the specific determination process of the log merge sequence of the event log file at each merge line number.

[0055] Figure 2This is a flow chart of another method for merging event logs shown in an embodiment of the present application. Figure 2 As shown, the method may specifically include the following steps:

[0056] S210 , using the initial log merge row number as the current merge row number, and determining the log merge sequence of the event log file under the current merge row number.

[0057] In this application, starting from the initial log merge line number, when analyzing the log merge sequence of the event log file under each merge line number in sequence, the initial log merge line number will first be used as the current merge line number, and then the event log file will be analyzed to see whether the multiple lines of logs under the current merge line number belong to the same event object, to determine whether the multiple lines of logs under each initial log merge line number can be merged, thereby obtaining the log merge sequence in the event log file that can be merged by the multiple lines of logs under the current merge line number.

[0058] For example, since the log merge sequence under the initial log merge line number is the loop starting value when analyzing the log merge sequence under each merge line number, it cannot be determined by referring to the log merge sequence under the previous merge line number. Therefore, the present application will determine from the event log file the various optional log merge sequences that can constitute the initial log merge line number. The optional log merge sequence is a log sequence in the event log file that can be composed of multiple consecutive log lines under the initial log merge line number. There may be a situation where the log elements contained in the log sequence do not belong to the same event object. Then, the log elements contained in each optional log merge sequence are analyzed to see whether they belong to the same event object and merge them.

[0059] Correspondingly, the steps for determining the log merge sequence of the event log file under the initial log merge line number may specifically include: for each optional log merge sequence of the event log file under the initial log merge line number, calculating the merge influence of each log element in the optional log merge sequence on the optional log merge sequence; performing weighted summation of the merge influence of each log element in the optional log merge sequence on the optional log merge sequence to obtain the merge support of the optional log merge sequence; combining the optional log merge sequences whose merge support exceeds a preset threshold to obtain the log merge sequence of the event log file under the initial log merge line number.

[0060] Taking into account that multiple lines of logs belonging to the same event object usually appear simultaneously and continuously in the event log file, and there is almost no situation where a line of log appears alone, when analyzing whether the log elements in each optional log merge sequence need to be merged, the present application can set a corresponding merge impact degree for each log element in each optional log merge sequence, which is used to analyze whether each log element in the optional log merge sequence always appears together with the optional log merge sequence in the event log file, so as to indicate the degree of influence on whether the optional log merge sequence really needs to be merged.

[0061] At this time, for each optional log merge sequence in the event log file under the initial log merge line number, by analyzing the frequency with which each log element in the optional log merge sequence appears in the event log file along with the optional log merge sequence, the merging influence of each log element in the optional log merge sequence on the optional log merge sequence can be calculated.

[0062] Then, since each optional log merge sequence is composed of multiple log elements under the initial log merge row number, for each optional log merge sequence, the merge support of the optional log merge sequence can be obtained by weighted summing up the merge influence of each log element in the optional log merge sequence on the optional log merge sequence. The merge support indicates the possibility that the log elements contained in the optional log merge sequence belong to the same event object and need to be merged.

[0063] Furthermore, from each optional log merge sequence under the initial number of log merge rows, an optional log merge sequence whose merge support exceeds a preset threshold can be screened out, and the screened optional log merge sequences are combined to obtain the log merge sequence that the event log file actually needs to merge under the initial number of log merge rows.

[0064] S220 , determining a log merge sequence of the event log file at the next merge row number after the current merge row number is incremented based on each log merge sequence of the event log file at the current merge row number and the adjacent row logs of the log merge sequence.

[0065] After taking the initial log merge line number as the current merge line number and determining the log merge sequence of the event log file under the current merge line number, the system will continue to determine whether the log merge sequence and the adjacent line logs of the log merge sequence belong to the same event object based on each log merge sequence of the event log file under the current merge line number, so as to add the adjacent line logs belonging to the same event object to the log merge sequence, thereby obtaining the log merge sequence of the event log file under the next merge line number after the current merge line number is incremented.

[0066] Exemplarily, the steps for determining the log merge sequence of the event log file at each merge row number after the initial log merge row number increases may specifically include: for each log merge sequence of the event log file at the current merge row number, merging the log merge sequence and the adjacent row logs of the log merge sequence in the event log file to obtain the optional log merge sequence of the event log file at the next merge row number; for each optional log merge sequence of the event log file at the next merge row number, calculating the merge influence of the adjacent row log elements in the optional log merge sequence on the optional log merge sequence as the merge support of the optional log merge sequence; combining the optional log merge sequences whose merge support exceeds a preset threshold to obtain the log merge sequence of the event log file at the next merge row number.

[0067] Specifically, after obtaining each log merge sequence for the event log file under the current merge row number, the adjacent row logs of each log merge sequence can be found in the event file. Then, according to the adjacent position of the adjacent row logs in the log merge sequence, such as the previous row or the next row, the adjacent row logs are merged into the log merge sequence. By performing the same steps above for each log merge sequence under the current merge row number, the optional log merge sequences for the event log file under the next merge row number after the current merge row number is incremented can be obtained.

[0068] Then, since each optional log merge sequence under the next merge row number after the current merge row number is incremented is obtained by adding a new log to a certain log merge sequence under the current merge row number, and each log merge sequence under the current merge row number has been determined to be really in need of merging, it will not affect whether each optional log merge sequence under the next merge row number really needs to be merged. Therefore, for each optional log merge sequence under the next merge row number of the event log file, the present application can directly calculate the merge influence of the adjacent row logs in the optional log merge sequence on the optional log merge sequence by analyzing the frequency of the adjacent row logs in the optional log merge sequence appearing in the event log file with the optional log merge sequence, and then directly use the merge influence of the adjacent row logs in each optional log merge sequence on the optional log merge sequence as the merge support of the optional log merge sequence.

[0069] Finally, in the same manner as described above under the initial number of log merge rows, the optional log merge sequences whose merge support exceeds the preset threshold are filtered out from the various optional log merge sequences under the next number of merge rows, and the filtered optional log merge sequences are combined to obtain the log merge sequences that the event log file actually needs to merge under the next number of merge rows.

[0070] It should be noted that the merge impact of the corresponding log element in the optional log merge sequence on the optional log merge sequence is calculated at the initial number of log merge rows and at each merge row number incremented from the initial number of log merge rows. Therefore, the merge impact of any log element in the optional log merge sequence on the optional log merge sequence can be calculated in the following manner: based on the first occurrence number of the optional log merge sequence in the event log file and the second occurrence number of any log element in the optional log merge sequence in the event log file, the merge impact of the log element in the optional log merge sequence on the optional log merge sequence is calculated.

[0071] That is, for each optional log merge sequence under each merge row number, the first occurrence count of the optional log merge sequence in the event log file and the second occurrence count of the log element in the optional log merge sequence in the event log file are determined. Then, the ratio between the first occurrence count and the second occurrence count is calculated as the merge influence of the log element in the optional log merge sequence on the optional log merge sequence.

[0072] For example, if an event log file is: AB CCABDABED, taking the initial log merge line number as two lines, we can first determine that the optional log merge sequences under the two-line merge can include 8 cases: AB, BC, CC, CA, BD, DA, BE and ED.

[0073] At this time, the merging influence of each log element in each optional log merging sequence on the optional log merging sequence can be divided into the following proportions:

[0074] A→AB: 3 / 3=1.0 B→BC: 1 / 3=0.33 C→CC: 1 / 2=0.5 C→CA: 1 / 2=0.5 B→AB: 3 / 3=1.0 C→BC: 1 / 2=0.5 C→CC: 1 / 2=0.5 A→CA: 1 / 3=0.33 B→BD: 1 / 3=0.33 D→DA: 1 / 2=0.5 B→BE: 1 / 3=0.33 E→ED: 1 / 1=1.0 D→BD: 1 / 2=0.5 A→DA: 1 / 3=0.33 E→BE: 1 / 1=1.0 D→ED: 1 / 2=0.5

[0075] S230, determining whether the log merge sequence of the event log file under the next merge row number is empty, if so, executing S250; if not, executing S240.

[0076] Each time the log merge sequence for the event log file at the next merge row number after the current merge row number is incremented is determined, it is necessary to determine whether the log merge sequence for the event log file at the next merge row number is empty. If it is empty, it means that the event log file can no longer perform multiple log merges upward, and the log merge sequence for each merge row tree of the event log file is thus obtained. However, if the log merge sequence for the event log file at the next merge row number is not empty, it is necessary to continue incrementing the current merge row number to continue analyzing the log merge sequence at the new next merge row number.

[0077] S240 , taking the next merged row number as the new current merged row number, returning to S220 , and continuing to determine the log merge sequence of the event log file under the new next merged row number.

[0078] When the log merge sequence of the event log file under the next merge row number is not empty, the current merge row number will continue to be incremented to obtain the next merge row number, and the next merge row number will be used as the new current merge row number. The operation in S220 will continue to be executed to calculate the log merge sequence of the event log file under the new next merge row number, and the cycle will be repeated until the log merge sequence of the event log file under the next merge row number is empty, thereby obtaining the log merge sequence of the event log file under each merge row number.

[0079] S250: Obtain a log merge sequence of the event log file at each merge row number.

[0080] S260 , merging each line of log in the event log file according to the log merging sequence under each merging line number of the event log file.

[0081] The technical solution provided by the embodiment of the present application starts to increase from the initial log merge line number, and for each merge line number, determines the log merge sequence of the event log file under the next merge line number based on the log merge sequence of the event log file under the current merge line number and the adjacent line logs of the log merge sequence, thereby obtaining the log merge sequence of the event log file under each merge line number. At this time, the log merge sequence under each merge line number is further searched layer by layer on the basis of the log merge sequence determined under the previous merge line number by increasing the merge line number, thereby reducing the computational overhead of the log merge sequence of the event log file under each merge line number and improving the merging efficiency of the event log; then, according to the log merge sequence of the event log file under each merge line number, the log lines in the event log file are merged accordingly, thereby realizing the automatic merging of the log lines in the event log file and ensuring the accurate merging of multiple log lines in the event log file.

[0082] Figure 3 This is a principle block diagram of an event log merging device shown in an embodiment of the present application. Figure 3As shown, the apparatus 300 may include:

[0083] The log merge sequence determination module 310 is configured to determine the log merge sequence of the event log file at the next merge row number, starting from the initial log merge row number and based on the log merge sequence of the event log file at the current merge row number and the adjacent row logs of the log merge sequence, so as to obtain the log merge sequence of the event log file at each merge row number;

[0084] The log merging module 320 is configured to merge the log lines in the event log file according to the log merging sequence under each merged line number of the event log file.

[0085] Furthermore, the log merging sequence determination module 310 may specifically include:

[0086] A first sequence determining unit is configured to use the initial log merge row number as the current merge row number and determine a log merge sequence for the event log file under the current merge row number;

[0087] A second sequence determining unit is configured to determine, based on each log merge sequence of the event log file under the current merge row number and adjacent row logs of the log merge sequence, a log merge sequence of the event log file under the next merge row number after the current merge row number is incremented;

[0088] The merging cycle unit is used to take the next merged row number as the new current merged row number and continue to determine the log merge sequence of the event log file under the new next merged row number until the log merge sequence of the event log file under the next merged row number is empty.

[0089] Furthermore, the first sequence determination unit may be specifically configured to:

[0090] For each optional log merge sequence of the event log file under the initial log merge row number, calculating the merging influence of each log element in the optional log merge sequence on the optional log merge sequence;

[0091] Performing a weighted summation of the merging influences of the log elements in the optional log merging sequence on the optional log merging sequence to obtain a merging support of the optional log merging sequence;

[0092] The optional log merging sequences whose merging support exceeds a preset threshold are combined to obtain a log merging sequence of the event log file under the initial number of log merging rows.

[0093] Furthermore, the second sequence determination unit may be specifically configured to:

[0094] For each log merge sequence of the event log file under the current merge row number, merge the log merge sequence with the adjacent row log of the log merge sequence in the event log file to obtain an optional log merge sequence of the event log file under the next merge row number;

[0095] For each optional log merge sequence of the event log file under the next merge row number, calculating the merge influence of the adjacent row log elements in the optional log merge sequence on the optional log merge sequence as the merge support of the optional log merge sequence;

[0096] The optional log merging sequences whose merging support exceeds a preset threshold are combined to obtain a log merging sequence of the event log file under the next number of merged rows.

[0097] Furthermore, the merging influence of any log element in the optional log merging sequence on the optional log merging sequence is determined by the following influence calculation unit:

[0098] The impact calculation unit is used to calculate the merge impact of the log element in the optional log merge sequence on the optional log merge sequence based on the first occurrence number of the optional log merge sequence in the event log file and the second occurrence number of any log element in the optional log merge sequence in the event log file.

[0099] Furthermore, the log merging module 320 may be specifically configured to:

[0100] From the maximum number of merged rows to the initial number of merged log rows, the target row log pointed to by each log merge sequence under each number of merged rows in the event log file is merged in reverse order.

[0101] In an embodiment of the present application, starting from the initial number of log merged lines, for each merged line number, the log merged sequence of the event log file under the next merged line number is determined based on the log merged sequence of the event log file under the current merged line number and the adjacent line logs of the log merged sequence, thereby obtaining the log merged sequence of the event log file under each merged line number. At this time, the log merged sequence under each merged line number is further searched layer by layer on the basis of the log merged sequence determined under the previous merged line number by increasing the number of merged lines, thereby reducing the computational overhead of the log merged sequence of the event log file under each merged line number and improving the merging efficiency of the event log; then, according to the log merged sequence of the event log file under each merged line number, each line of log in the event log file is merged accordingly, thereby realizing the automatic merging of each line of log in the event log file and ensuring the accurate merging of multiple lines of log in the event log file.

[0102] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here. Specifically, Figure 3 The device 300 shown can execute any method embodiment provided in the present application, and the aforementioned and other operations and / or functions of each module in the device 300 are respectively for implementing the corresponding processes in each method of the embodiment of the present application. For the sake of brevity, they will not be repeated here.

[0103] The above describes the device 300 of the embodiment of the present application from the perspective of functional modules in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. Optionally, the software module can be located in a mature storage medium in the art such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps in the above method embodiment in conjunction with its hardware.

[0104] Figure 4 It is a schematic block diagram of an electronic device 400 provided in an embodiment of the present application.

[0105] like Figure 4 As shown, the electronic device 400 may include:

[0106] The memory 410 and the processor 420 are configured to store computer programs and transmit the program code to the processor 420. In other words, the processor 420 can call and run the computer program from the memory 410 to implement the method in the embodiment of the present application.

[0107] For example, the processor 420 may be configured to execute the above method embodiments according to instructions in the computer program.

[0108] In some embodiments of the present application, the processor 420 may include but is not limited to:

[0109] General-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.

[0110] In some embodiments of the present application, the memory 410 includes but is not limited to:

[0111] Volatile memory and / or non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0112] In some embodiments of the present application, the computer program may be divided into one or more modules, which are stored in the memory 410 and executed by the processor 420 to implement the method provided by the present application. The one or more modules may be a series of computer program instruction segments capable of implementing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device.

[0113] like Figure 4 As shown, the electronic device may further include:

[0114] The transceiver 430 may be connected to the processor 420 or the memory 410 .

[0115] The processor 420 may control the transceiver 430 to communicate with other devices. Specifically, the processor 420 may send information or data to other devices or receive information or data sent by other devices. The transceiver 430 may include a transmitter and a receiver. The transceiver 430 may further include one or more antennas.

[0116] It should be understood that the various components in the electronic device are connected via a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus and a status signal bus.

[0117] The present application also provides a computer storage medium having a computer program stored thereon, which, when executed by a computer, enables the computer to perform the method of the above-mentioned method embodiment. In other words, the present application also provides a computer program product containing instructions, which, when executed by a computer, enables the computer to perform the method of the above-mentioned method embodiment.

[0118] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (DVD)), or a semiconductor medium (e.g., a solid state drive (SSD)).

[0119] Those skilled in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0120] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the modules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0121] Modules described as separate components may or may not be physically separate, and components displayed as modules may or may not be physical modules, i.e., they may be located in one place or distributed across multiple network elements. Some or all of the modules may be selected based on actual needs to achieve the purpose of the present embodiment. For example, the functional modules in the various embodiments of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into a single module.

[0122] The above are only specific embodiments of the present application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for merging event logs, characterized in that: include: Starting from the initial log merge row number, the log merge sequence of the event log file under the next merge row number is determined based on the log merge sequence of the event log file under the current merge row number and the adjacent row logs of the log merge sequence, so as to obtain the log merge sequence of the event log file under each merge row number; Merge each line of log in the event log file according to the log merging sequence under each merge line number of the event log file; The log merge sequence of the event log file under the current number of merged rows is the log merge sequence of the event log file when the initial number of merged rows is used as the current number of merged rows; The log merge sequence of the event log file under the current number of merged rows is obtained as follows: For each optional log merge sequence of the event log file under the initial log merge row number, calculating the merging influence of each log element in the optional log merge sequence on the optional log merge sequence; Performing a weighted summation of the merging influences of the log elements in the optional log merging sequence on the optional log merging sequence to obtain a merging support of the optional log merging sequence; Combining the optional log merging sequences whose merging support exceeds a preset threshold, to obtain the log merging sequence of the event log file under the initial number of log merging rows; The step of merging each line of log in the event log file according to the log merging sequence under each merged line number of the event log file includes: From the maximum number of merged rows to the initial number of merged log rows, the target row log pointed to by each log merge sequence under each number of merged rows in the event log file is merged in reverse order.

2. The method according to claim 1, characterized in that The method starts incrementing from the initial number of log merged rows and sequentially determines the log merged sequence of the event log file under the next number of merged rows based on the log merged sequence of the event log file under the current number of merged rows and the adjacent row logs of the log merged sequence, including: Determine, based on each log merge sequence of the event log file under the current merge row number and adjacent row logs of the log merge sequence, a log merge sequence of the event log file under the next merge row number after the current merge row number is incremented; The next merged row number is used as the new current merged row number, and the log merge sequence of the event log file under the new next merged row number is continuously determined until the log merge sequence of the event log file under the next merged row number is empty.

3. The method according to claim 2, characterized in that The determining, based on each log merge sequence of the event log file under the current merge row number and adjacent row logs of the log merge sequence, a log merge sequence of the event log file under the next merge row number after the current merge row number is incremented, includes: For each log merge sequence of the event log file under the current merge row number, merge the log merge sequence with the adjacent row log of the log merge sequence in the event log file to obtain an optional log merge sequence of the event log file under the next merge row number; For each optional log merge sequence of the event log file under the next merge row number, calculating the merge influence of the adjacent row log elements in the optional log merge sequence on the optional log merge sequence as the merge support of the optional log merge sequence; The optional log merging sequences whose merging support exceeds a preset threshold are combined to obtain a log merging sequence of the event log file under the next number of merged rows.

4. The method according to claim 3, characterized in that The merging influence of any log element in the optional log merging sequence on the optional log merging sequence is obtained in the following way: According to the first occurrence number of the optional log merge sequence in the event log file and the second occurrence number of any log element in the optional log merge sequence in the event log file, the merging influence degree of the log element in the optional log merge sequence on the optional log merge sequence is calculated.

5. An event log merging device, characterized in that: include: A log merge sequence determination module is configured to determine the log merge sequence of the event log file under the next merge row number, starting from the initial log merge row number and based on the log merge sequence of the event log file under the current merge row number and the adjacent row logs of the log merge sequence, so as to obtain the log merge sequence of the event log file under each merge row number; A log merging module, configured to merge the log lines in the event log file according to the log merging sequence under each merged line number of the event log file; The log merge sequence of the event log file under the current number of merged rows is the log merge sequence of the event log file when the initial number of merged rows is used as the current number of merged rows; The log merging sequence determination module includes a first sequence determination unit, which is specifically configured to: For each optional log merge sequence of the event log file under the initial log merge row number, calculating the merging influence of each log element in the optional log merge sequence on the optional log merge sequence; Performing a weighted summation of the merging influences of the log elements in the optional log merging sequence on the optional log merging sequence to obtain a merging support of the optional log merging sequence; Combining the optional log merging sequences whose merging support exceeds a preset threshold, to obtain the log merging sequence of the event log file under the initial number of log merging rows; The log merging module is specifically used to: From the maximum number of merged rows to the initial number of merged log rows, the target row log pointed to by each log merge sequence under each number of merged rows in the event log file is merged in reverse order.

6. An electronic device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program stored in the memory to execute the event log merging method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that Used to store a computer program, wherein the computer program enables a computer to execute the event log merging method according to any one of claims 1 to 4.

8. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the event log merging method according to any one of claims 1 to 4 is implemented.

Images