Log analysis and processing method and its device, equipment, and medium

Abstract

The present application discloses a log analysis and processing method and its apparatus, equipment, and medium, the method comprising: responding to an application exception instruction pushed by a user terminal, obtaining a target exception type and application log corresponding to the application exception instruction; querying a target log analysis model corresponding to the target exception type from a log model pool, wherein the log analysis model has multiple tree module chains, wherein the tree module chain includes a clipping module, a translation module, or an error detection module; calling the target log analysis model, and using the tree module chain included in the target log analysis model to perform log analysis on the application log to obtain a corresponding exception log. The automated analysis of the present application helps developers analyze application logs, quickly identify the abnormal problem, promptly respond to users, and fix the abnormality, saving time and labor costs in resolving abnormalities.

Description

Technical Field

[0001] The present application relates to the field of application anomalies, and in particular to a log analysis and processing method, as well as corresponding devices, equipment, and non-volatile storage media for the method. Background Art

[0002] Existing Internet platforms provide platform applications to platform users so that users can use their platform applications to browse the platform content owned by their platforms and use related online services. However, platform users may encounter corresponding abnormal problems when using the applications, which may cause them to be unable to use the corresponding online services normally. For example, when users use online live broadcast applications, they may encounter abnormal problems such as being unable to push public screen messages or being unable to browse the live stream of the live broadcast room. After encountering abnormal problems, users can use the platform's abnormality reporting service to report the abnormal problems they encountered and application logs to the platform, and the platform's personnel will determine the event that caused the abnormality through the application logs.

[0003] However, after receiving application logs, today's platforms need developers to manually analyze complex application logs to determine the cause of the exception, respond to users in a timely manner, and perform targeted repairs. However, for some repeated exceptions, developers need to spend a lot of time manually analyzing application logs each time, and the efficiency of exception repair is slow. In addition, different developers have different levels of familiarity with the business. When users report different exceptions, developers who are not familiar with the exception often find it difficult to determine the cause of the exception, resulting in the inability to respond to users in a timely manner and quickly repair the exception.

[0004] In view of the problems existing in the existing application exception repair, the applicant has made corresponding explorations in order to solve the problem. Summary of the Invention

[0005] The purpose of this application is to provide a log analysis and processing method to meet user needs. In addition, it also relates to corresponding devices, equipment, non-volatile storage media and computer program products of this method.

[0006] In order to achieve the purpose of this application, the following technical solutions are adopted:

[0007] A log analysis and processing method proposed for the purpose of this application includes the following steps:

[0008] Respond to the application exception instruction pushed by the user end, and obtain the target exception type and application log corresponding to the application exception instruction;

[0009] Querying a target log analysis model corresponding to the target exception type from a log model pool, wherein the log analysis model has a plurality of tree module chains, each of which includes a clipping module, a translation module, or an error detection module;

[0010] The target log analysis model is called, and the tree module chain included in the target log analysis model is used to perform log analysis on the application log to obtain the corresponding exception log.

[0011] In a further embodiment, the step of responding to the application exception instruction pushed by the user terminal and obtaining the target exception type and application log pointed to by the application exception instruction includes the following steps:

[0012] Parsing the application exception instruction to obtain the user exception text contained in the application exception instruction;

[0013] Calling the abnormality type recognition model that has been trained to convergence, and determining the semantic similarity probability value corresponding to the user abnormal text and each abnormality type according to the semantic features of the user abnormal text;

[0014] The exception type with the largest semantic similarity probability value is used as the target exception type corresponding to the user exception text.

[0015] In a further embodiment, the log analysis model has a plurality of tree-shaped module chains, and the steps of including a clipping module, a translation module, or an error detection module in the tree-shaped module chain include the following steps:

[0016] Traversing the application log, querying the target start identifier and the target end identifier in the application log;

[0017] The log field between each target start identifier and the target end identifier is intercepted, and the log field is used as the log to be analyzed corresponding to the target log analysis model.

[0018] In a further embodiment, the log analysis model has a plurality of tree-shaped module chains, and the steps of including a clipping module, a translation module, or an error detection module in the tree-shaped module chain include the following steps:

[0019] Calling the log filter, traversing the log to be analyzed according to the matching expression of the log filter, and matching the log fields in the log to be analyzed that have the characters contained in the matching expression;

[0020] Calling a preset result matching rule to match the result field contained in the log field;

[0021] The translation output field corresponding to the result matching rule is obtained, the replacement field corresponding to the translation output field is replaced with the result field, and the translation output field after the replacement is completed is stored in the exception log.

[0022] In a further embodiment, the log analysis model has a plurality of tree-shaped module chains, and the steps of including a clipping module, a translation module, or an error detection module in the tree-shaped module chain include the following steps:

[0023] Call the preset error detection field matching rule to obtain the target error detection log field with the error detection key character in the log to be analyzed, and obtain the error detection focus field contained in the target error detection log field and store it in the focus result pool;

[0024] Call the standard result pool and error detection relationship pool corresponding to the error detection field matching rule, and determine whether the error detection focus field currently being checked in the focus result pool and the corresponding standard focus field in the standard result pool conform to the relationship represented by the corresponding relationship identifier in the error detection relationship pool;

[0025] When any error detection concern field and its corresponding standard concern field do not conform to the relationship represented by the corresponding relationship identifier in the error detection relationship pool, the error detection log field to which the error detection concern field belongs is stored in the exception log as an exception log field.

[0026] In a further embodiment, the log analysis model has a plurality of tree-shaped module chains, and the steps of including a clipping module, a translation module, or an error detection module in the tree-shaped module chain include the following steps:

[0027] Calling a preset positive output matching rule to detect whether there is a log field corresponding to the regular expression of the positive output matching rule in the log to be analyzed; if not, storing the error field corresponding to the positive output matching rule as an abnormal log field in the abnormal log;

[0028] The preset negative output matching rule is called to detect whether there is a log field corresponding to the regular expression of the negative output matching rule in the log to be analyzed. If so, the log field is stored in the exception log as an exception log field.

[0029] In a further embodiment, the step of performing log analysis on the application log according to the tree model chain included in the target log analysis model to obtain the corresponding abnormal log includes the following steps:

[0030] Calling the root node in the target log analysis model to filter out the logs to be analyzed in the application logs;

[0031] Calling the first tree module chain under the root node to perform log analysis on the log to be analyzed, and storing the log fields matched during the analysis process in the exception log;

[0032] If the log to be analyzed has an exception log field corresponding to the first tree module chain, the exception log field is stored in the exception log; if the exception log field does not exist, backtrack to the root node to call the next tree module chain to perform log analysis on the log to be analyzed.

[0033] A log analysis and processing device is proposed to meet the purpose of this application, comprising:

[0034] The exception instruction response module is used to respond to the application exception instruction pushed by the user end and obtain the target exception type and application log corresponding to the application exception instruction;

[0035] An analysis model query module is used to query a target log analysis model corresponding to the target exception type from a log model pool, wherein the log analysis model has multiple tree module chains, each of which includes a clipping module, a translation module, or an error detection module;

[0036] The abnormal log acquisition module is used to call the target log analysis model and use the tree module chain included in the target log analysis model to perform log analysis on the application log to obtain the corresponding abnormal log.

[0037] In a further embodiment, the abnormal instruction response module includes:

[0038] The abnormal instruction parsing submodule is used to parse the application abnormal instruction and obtain the user abnormal text contained in the application abnormal instruction;

[0039] A type similarity determination submodule is used to call the abnormal type recognition model trained to convergence, and determine the semantic similarity probability value corresponding to the user abnormal text and each abnormal type according to the semantic features of the user abnormal text;

[0040] The target exception type determination submodule is used to take the exception type with the largest semantic similarity probability value as the target exception type corresponding to the user exception text.

[0041] In a further embodiment, the analysis model query module includes:

[0042] A target identifier query submodule is used to traverse the application log and query the target start identifier and the target end identifier in the application log;

[0043] The to-be-analyzed log acquisition submodule is configured to intercept the log field between each of the target start identifiers and the target end identifiers, and use the log field as the to-be-analyzed log corresponding to the target log analysis model.

[0044] In a preferred embodiment, the analysis model query module further includes:

[0045] The filter calling submodule is used to call the log filter, traverse the log to be analyzed according to the matching expression of the log filter, and match the log fields in the log to be analyzed that have the characters contained in the matching expression;

[0046] A result field matching submodule is used to call a preset result matching rule to match the result field contained in the log field;

[0047] The translation output field replacement submodule is used to obtain the translation output field corresponding to the result matching rule, replace the corresponding replacement field in the translation output field with the result field, and store the replaced translation output field in the exception log.

[0048] In a preferred embodiment, the analysis model query module further includes:

[0049] The error detection log field acquisition submodule is used to call the preset error detection field matching rules, obtain the target error detection log field with the error detection key character in the log to be analyzed, and obtain the error detection focus field contained in the target error detection log field and store it in the focus result pool;

[0050] The error detection log field verification submodule is used to call the standard result pool and the error detection relationship pool corresponding to the error detection field matching rule, and determine whether the error detection focus field currently verified in the focus result pool and the corresponding standard focus field in the standard result pool conform to the relationship represented by the corresponding relationship identifier in the error detection relationship pool;

[0051] The abnormal log field determination submodule is used to store the error detection log field to which the error detection focus field belongs as the abnormal log field in the abnormal log when any error detection focus field and its corresponding standard focus field do not conform to the relationship represented by the corresponding relationship identifier in the error detection relationship pool.

[0052] In a preferred embodiment, the analysis model query module further includes:

[0053] A positive output matching detection submodule is used to call a preset positive output matching rule to detect whether there is a log field corresponding to the regular expression of the positive output matching rule in the log to be analyzed; if not, the error field corresponding to the positive output matching rule is stored as an abnormal log field in the abnormal log;

[0054] The negative output matching detection submodule is used to call the preset negative output matching rule to detect whether there is a log field corresponding to the regular expression of the negative output matching rule in the log to be analyzed. If so, the log field is stored as an abnormal log field in the abnormal log.

[0055] In a further embodiment, the abnormal log acquisition module includes:

[0056] A submodule for filtering logs to be analyzed, configured to call the root node in the target log analysis model and filter out logs to be analyzed in the application logs;

[0057] The log parsing submodule to be analyzed is used to call the first tree module chain under the root node to perform log analysis on the log to be analyzed, and store the log fields matched during the analysis process in the exception log;

[0058] The module chain traversal sub-module is used to store the exception log field corresponding to the first tree-shaped module chain in the exception log if the log to be analyzed has the exception log field; if the exception log field does not exist, backtrack to the root node to call the next tree-shaped module chain to perform log analysis on the log to be analyzed.

[0059] In order to solve the above technical problems, an embodiment of the present application also provides a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the above-mentioned log analysis and processing method.

[0060] In order to solve the above technical problems, an embodiment of the present application further provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the above-mentioned log analysis and processing method.

[0061] In order to solve the above technical problems, an embodiment of the present application further provides a computer program product, including a computer program and computer instructions. When the computer program and computer instructions are executed by a processor, the processor executes the steps of the above-mentioned log analysis and processing method.

[0062] Compared with the prior art, the advantages of this application are as follows:

[0063] The application can automatically analyze the application logs reported by users and quickly determine the cause of the exception for developers. After the server receives the exception type and related application log reported by the user, it can call the log analysis model corresponding to the exception type and call the tree module chain contained in the log analysis model to perform log analysis on the application log, so as to determine the relevant exception log fields in the application log that cause the exception through the respective log analysis strategies of the tree module chains, and record or output these exception log fields as exception logs, so that developers can quickly determine the cause of the exception, reply to users immediately, and repair the exceptions triggered by users based on the relevant exception log fields in the exception log. It can be understood that this application can save manpower for developers to repeatedly check exception feedback. For customer service personnel who are not familiar with application logs, they can also quickly determine the location of the exception problem and reply to users in time based on the relevant Chinese translation results of the exception log fields in the exception log, and it is convenient for testers to eliminate exception problems and conduct relevant tests based on the exception logs to cooperate with developers to comprehensively repair exceptions.

[0064] Secondly, the cropping module, translation module and error detection module of this application are not limited to the log analysis of a single application. Developers can reuse the cropping module, translation module and error detection module to configure the corresponding tree module chain to develop a new log analysis module, and then apply it to other applications or other exception types. There is no need to develop a new log analysis module for log analysis, which saves a lot of development time for developers, improves the exception repair efficiency of the application and comprehensively enhances the robustness of the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0066] Figure 1 A schematic diagram of a typical network deployment architecture for implementing the technical solution of this application;

[0067] Figure 2 This is a flowchart of a typical embodiment of the log analysis and processing method of the present application;

[0068] Figure 3 A flowchart of a specific implementation method for determining an exception type corresponding to an application exception instruction in this application;

[0069] Figure 4 This is a flowchart of a specific implementation method of the clipping module intercepting the log to be analyzed in this application;

[0070] Figure 5 This is a flowchart of a specific implementation method for translating log fields by the translation module in this application;

[0071] Figure 6 This is a flow chart of a specific implementation method of the error detection module performing comparison and verification of the relationship between the fields of interest in this application;

[0072] Figure 7 This is a flow chart of a specific implementation method of the positive and negative error detection module performing positive and negative verification in this application;

[0073] Figure 8 A flow chart showing a specific implementation method of log analysis performed by a log analysis module in this application;

[0074] Figure 9 This is a principle block diagram of a typical embodiment of the log analysis and processing device of the present application;

[0075] Figure 10 This is a basic structural block diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0076] The following describes in detail embodiments of the present application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application and are not to be construed as limiting the present application.

[0077] It will be understood by those skilled in the art that, unless expressly stated otherwise, the singular forms "a", "an", "said" and "the" used herein may also include the plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, "connected" or "coupled" as used herein may include wireless connections or wireless couplings. The term "and / or" used herein includes all or any units and all combinations of one or more associated listed items.

[0078] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art and will not be interpreted in an idealized or overly formal sense unless specifically defined as herein.

[0079] As will be understood by those skilled in the art, the terms "client," "terminal," and "terminal device" as used herein include both devices that are wireless signal receivers, i.e., devices that only have wireless signal receivers without transmission capabilities, and devices that have receiving and transmitting hardware capable of two-way communication over a two-way communication link. Such devices may include: cellular or other communication devices such as personal computers and tablet computers, which have single-line displays, multi-line displays, or cellular or other communication devices without multi-line displays; PCS (Personal Communications Service), which may combine voice, data processing, fax, and / or data communication capabilities; PDA (Personal Digital Assistant), which may include a radio frequency receiver, a pager, Internet / Intranet access, a web browser, a notepad, a calendar, and / or a GPS (Global Positioning System) receiver; and conventional laptop and / or palmtop computers or other devices, which have and / or include a radio frequency receiver. As used herein, the terms "client," "terminal," or "terminal device" may be portable, transportable, or installed in a vehicle (air, sea, and / or land), or may be adapted and / or configured to operate locally and / or in a distributed manner at any other location on Earth and / or in space. As used herein, the terms "client," "terminal," or "terminal device" may also refer to a communication terminal, an Internet terminal, or a music / video playback terminal, such as a PDA, an MID (Mobile Internet Device), and / or a mobile phone with music / video playback capabilities, or may include a smart TV, a set-top box, or other device.

[0080] The hardware referred to by names such as "server", "client", and "work node" in this application is essentially an electronic device with capabilities equivalent to those of a personal computer. It is a hardware device that has the necessary components revealed by the von Neumann principle, such as a central processing unit (including an arithmetic unit and a controller), a memory, an input device, and an output device. Computer programs are stored in its memory, and the central processing unit calls the program stored in the external memory into the internal memory for execution, executes the instructions in the program, and interacts with the input and output devices to complete specific functions.

[0081] It should be noted that the concept of "server" referred to in this application can also be extended to server clusters. Based on the network deployment principles understood by those skilled in the art, the servers described should be logically divided. In physical space, these servers can be independent of each other but callable through interfaces, or integrated into a single physical computer or a computer cluster. Those skilled in the art should understand this flexibility and should not use it to constrain the implementation of the network deployment method of this application.

[0082] See also Figure 1 , the hardware foundation required for the implementation of the relevant technical solutions of this application can be deployed according to the architecture shown in the figure. The server 80 referred to in this application is deployed in the cloud. As an online server, it can be responsible for further connecting relevant data servers and other servers that provide relevant support, etc., to form a logically related service cluster to provide services for relevant terminal devices such as the smartphone 81 and personal computer 82 shown in the figure or a third-party server (not shown). The smartphone and personal computer can both access the Internet through a well-known network access method and establish a data communication link with the server 80 in the cloud to run terminal applications related to the services provided by the server.

[0083] For the server, the application is usually constructed as a service process, opening the corresponding program interface for remote calls by applications running on various terminal devices. The relevant technical solutions in this application that are suitable for running on the server can be implemented in the server in this way.

[0084] The application mentioned above refers to an application running on a server or terminal device. This application implements the relevant technical solutions of the present application in a programming manner. Its program code can be stored in a non-volatile storage medium that can be recognized by the computer in the form of computer-executable instructions, and can be loaded into the memory by the central processing unit for execution. The relevant device of the present application is constructed by the operation of this application on the computer.

[0085] For the server, the application is usually constructed as a service process, opening the corresponding program interface for remote calls by applications running on various terminal devices. The relevant technical solutions in this application that are suitable for running on the server can be implemented in the server in this way.

[0086] Those skilled in the art should be aware that although the various methods of this application are described based on the same concept and thus exhibit commonality, unless otherwise specified, these methods can be independently executed. Similarly, the various embodiments disclosed in this application are all based on the same inventive concept. Therefore, concepts with the same expression, as well as concepts that are appropriately transformed for convenience despite different expression, should be understood as equivalent.

[0087] See also Figure 2 In a typical embodiment of the present application, a log analysis and processing method includes the following steps:

[0088] Step S11: respond to the application exception instruction pushed by the user terminal and obtain the target exception type and application log corresponding to the application exception instruction:

[0089] The server receives the application exception instruction pushed by the user terminal in the platform, responds to the application exception instruction, and obtains the target exception type and application log called by the application exception instruction.

[0090] The application exception instruction is generally triggered and pushed by the user terminal when an application exception occurs while the user terminal is running the application. For example, when the user terminal is running an application for live broadcasting and is unable to push public screen chat messages after entering a certain live broadcast room page, the user terminal can push an application exception instruction to the server indicating that the public screen chat messages cannot be pushed in the live broadcast room.

[0091] The application exception instruction generally points to the corresponding exception type, such as the above-mentioned application exception instruction that cannot push public screen chat messages in the live broadcast room. The exception type corresponding to the application exception instruction will be the inability to push public screen chat messages. The exception type can generally be selected by the user terminal that pushes the above-mentioned application exception instruction in the corresponding exception reporting control, or the above-mentioned user terminal customizes the corresponding exception text in the exception reporting control. The server performs keyword matching based on the exception text to determine the exception type corresponding to the exception text. For example, the exception text edited by the user terminal is "Unable to push public screen chat messages in the live broadcast room". After receiving the exception text, the server will query the exception type pool based on the keywords in the exception text, such as keywords: "public screen chat message", "push", "live broadcast room" to find the exception type with these keywords. The exception type can generally be "Unable to push public screen chat messages", and the exception type will be used as the target exception type corresponding to the above-mentioned application exception instruction.

[0092] In one embodiment, after the server obtains the abnormal text edited by the user terminal, it can call an abnormal type recognition model that has been trained to convergence. The abnormal type recognition model is a neural network model to extract the semantic features of the abnormal text, and determine the semantic similarity probability values ​​corresponding to the user abnormal text and each abnormal type in the abnormal type pool based on the semantic features, and then use the abnormal type with the largest semantic similarity probability value as the target abnormal type corresponding to the user abnormal text.

[0093] The application log records in real time the operations performed by the user terminal when running the application and the related events triggered in response when performing the operations, and at the same time records the running status of each control and component in the application when the application triggers the corresponding event, so that the server can automatically analyze the application log in the future to determine the abnormal triggering events such as user operations, related program events and running status of component controls corresponding to the abnormal type corresponding to the application abnormal instruction pushed by the user terminal, and then repair the application abnormality triggered by the user terminal based on these abnormal triggering events.

[0094] Step S12: Query the target log analysis model corresponding to the target exception type from the log model pool. The log analysis model has multiple tree module chains, each of which includes a clipping module, a translation module, or an error detection module:

[0095] After the server obtains the target exception type corresponding to the application exception instruction, it will query the target log analysis model corresponding to the target exception type from the log model pool. The log model pool stores multiple log analysis models, and each log analysis model has an exception type identifier that represents the exception type to which it corresponds, so that the server can query the log analysis model with the exception type identifier of the target exception type in the log model pool and use the log analysis model as the target log analysis model.

[0096] The log analysis model has multiple tree-shaped module chains, and the tree-shaped module chain is composed of one or more cropping modules, translation modules or error detection modules. The log analysis module analyzes the application log through the tree-shaped module chain it has. It crops the application log through the cropping module to obtain the log to be analyzed in the application log, matches the corresponding log field through the translation module for translation processing so that the test or repair personnel can browse it, and detects the log field in the application log that triggers the target exception type through the error detection module and records it as an exception log field.

[0097] The log analysis model performs different log analysis processing on the application log through the multiple tree module chains it possesses, so that the log analysis model analyzes the log fields of the application log through the multiple tree module chains, and analyzes the events triggered by the exception types corresponding to the log analysis when the application is running. For example, for the log analysis module with the exception type of "unable to output public screen chat message", it generally has a tree model chain for analyzing whether the user terminal successfully pushes the public screen chat message, a tree module chain for analyzing whether the pushed public screen chat message has been output to the public screen chat control, and a tree module chain for analyzing whether the running status of the public screen chat control is normal, and then analyzes the application log from different angles and constitutes corresponding exception logs for output, thereby solving the exceptions triggered by the user terminal running the application.

[0098] It should be noted that the nodes in the tree module chain of the log analysis module are generally composed of one or more modules of different types, so that the nodes in the tree module chain comprehensively analyze the application log. For example, in the tree module chain of the application analysis of whether the public screen chat message pushed has been output to the public screen chat control, the tree module chain generally includes a first node for judging whether the public screen chat message pushed by the server has been received, a second node for judging whether the user terminal pushes the public screen chat message, a third node for judging whether the public screen chat message pushed by the user is processed normally, and a fourth node for judging whether the public screen chat message executes the output logic when the public screen chat message pushed by the server is received. It can be understood that the log analysis logic of different nodes generally cannot be executed by relying on only one module. Therefore, the nodes of the tree module chain will generally be combined by multiple modules to construct the corresponding log analysis logic.

[0099] The clipping module generally traverses the application log and queries the target start identifier and target end identifier in the application log. The target start identifier and target end identifier generally correspond to the exception type of the log analysis model to which the clipping module belongs. For example, when the exception type corresponding to the log analysis model is: "unable to output live stream", the clipping module of the log analysis model has a target start identifier of "join channels success (enter the live room successfully)" and a target end identifier of "leave channel (leave the live room)", so that the log analysis model intercepts the log field between entering the live room and leaving the live room in the application log through the clipping module, and uses the log field as the log to be analyzed corresponding to the log analysis model.

[0100] In one embodiment, the cropping module has cropping identifiers with different execution orders. For example, when the exception type of the log analysis module is "unable to output live stream", the cropping module has a first execution cropping identifier of "appstarted (start application)", and the second execution cropping identifier is generally a cropping identifier pair, that is, a start identifier and an end identifier, wherein the start identifier is "join channelsuccess (enter the live broadcast room successfully)", and the end identifier is "leave channel (leave the live broadcast room)", then the cropping module will first intercept all log fields after the application is opened in the application log, and then intercept the log fields between entering the live broadcast room and leaving the live broadcast room, so as to use the log fields as the log to be analyzed corresponding to the log analysis model.

[0101] The translation module generally has a corresponding log filter to obtain the log field in the application log that the translation module needs to translate, and has a corresponding result matching rule to obtain the result field in the log field obtained by the log filter, and then replace the corresponding replacement field in the translation output field with the result field and record it. Specifically, the translation module calls the log filter, and according to the matching expression of the log filter, traverses the log to be analyzed intercepted by the clipping module, matches the log field in the log to be analyzed that has the characters contained in the matching expression, calls the preset result matching rule, matches the result field contained in the log field, and then obtains the translation output field corresponding to the result matching rule, replaces the corresponding replacement field in the translation output field with the result field, and stores the replaced translation output field in the exception log.

[0102] In one embodiment, the translation module has a preset translation text field. This type of translation module matches the log field in the application log that has the characters contained in the matching expression through the matching expression in its log filter, and the translation text of the log field will be its preset translation text field. For example, the log field matched by the matching expression of the translation module is "ChannelChat Message", and the preset translation text field of the translation module is "Public Screen Chat Message", then the translation text of the log field "ChannelChat Message" is the "Public Screen Chat Message" of the translation text field.

[0103] The error detection module generally obtains the corresponding log field in the application log through a preset error detection field matching rule for error detection processing. Specifically, the error detection module obtains the target error detection log field with the error detection keyword in the log to be analyzed intercepted by the cropping module through the error detection field matching rule, and obtains the error detection focus field contained in the target error detection log field and stores it in the focus result pool, so as to call the standard result pool and the error detection relationship pool corresponding to the error detection field matching rule, and judge whether each of the error detection focus fields in the focus result pool and the corresponding standard focus field in the standard result pool are consistent with the relationship represented by the corresponding relationship identifier in the error detection relationship pool, that is, perform standard verification. When any of the error detection focus fields and its corresponding standard focus field do not meet the relationship represented by the corresponding relationship identifier in the error detection relationship pool, it indicates that the error detection log field to which the error detection focus field belongs represents the exception triggered by the application. The error detection log field to which the error detection focus field belongs is stored in the exception log as an exception log field, so that it can be output and displayed to the developer later, so that the developer can repair the exception of the application represented by the exception log field.

[0104] In one embodiment, the error detection module further includes a positive output error detection module and a negative output error detection module, wherein the positive output error detection module is used to detect whether there is a log field in the application log that represents its normal operation, and correspondingly, the negative output error detection module is used to detect whether there is a log field in the application log that represents its abnormal operation. Specifically, the positive output error detection module calls a preset positive output matching rule to detect whether there is a log field corresponding to the regular expression of the positive output matching rule in the log to be analyzed. If not, the preset error field corresponding to the positive output matching rule is stored as an abnormal log field in the abnormal log; correspondingly, the negative output error detection module calls a preset negative output matching rule to detect whether there is a log field corresponding to the regular expression of the negative output matching rule in the log to be analyzed. If so, the log field is stored as an abnormal log field in the abnormal log; wherein, the error field is generally a pre-set translation text for developers to view.

[0105] Step S13: calling the target log analysis model, and using the tree module chain included in the target log analysis model to perform log analysis on the application log to obtain the corresponding exception log.

[0106] After the server queries the corresponding target log analysis module, it uses the tree module chains included in the target log analysis module to perform log analysis on the application log to obtain the exception log generated by analyzing the application log.

[0107] The exception log has log fields intercepted or generated by analyzing the application log through one or more tree module chains of the target log analysis module. These log fields include the original log field intercepted into the application log and the translation text field corresponding to the original log field. The translation text field is generally generated by the translation module, and the exception log field in the application log that represents the exception event related to the exception type corresponding to the application exception instruction is detected by the error detection module. The exception log field and its corresponding translation text field are generally copied in text so that the exception log field and its corresponding translation text can be output as the focus when the exception log is output.

[0108] Each log field stored in the exception log will have a corresponding time stamp, and these log fields will be sorted in descending or ascending order in the exception log according to their time stamps, and these time stamps generally correspond to the associated log fields in the application log, that is, when the log analysis module analyzes the application log, the log field matched from the application log through the tree module chain will simultaneously record the execution time corresponding to the log field in the application log, and record the execution time as the time stamp corresponding to the matched log field in the exception log.

[0109] The server calls the root node in the target log analysis model and uses the clipping module of the root node to intercept the log to be analyzed in the application log. The root node is the node connected to each tree module chain in the target log analysis module, and then calls the first tree module chain under the root node to perform log analysis on the log to be analyzed, and stores the log fields matched in the analysis process in the exception log. If the log to be analyzed has an exception log field corresponding to the first tree module chain, the exception log field is stored in the exception log. At this time, the call to the target log analysis module to perform log analysis on the application log is stopped, and the exception log is analyzed. Output, if the exception log field corresponding to the first tree module chain does not exist, then backtrack to the root node to call the next tree module chain to perform log analysis on the log to be analyzed, and so on, complete the log analysis of the application log for the target exception type, generate the corresponding exception log for output or store it in the corresponding database, of course, after analyzing that there is an exception log field corresponding to any tree module chain in the log to be analyzed, you can also continue to execute the next tree module chain to process the log to be analyzed, so as to analyze the exception events that cause the target exception type during the operation of the application, so as to facilitate developers to comprehensively repair the application.

[0110] It can be seen from the typical embodiments of this method that this method can automatically analyze the application logs reported by users and quickly determine the cause of the exception for developers. After the server receives the exception type and related application log reported by the user, it can call the log analysis model corresponding to the exception type and call the tree module chain contained in the log analysis model to perform log analysis on the application log, so as to determine the relevant exception log fields in the application log that cause the exception through the respective log analysis strategies of the tree module chains, and record or output these exception log fields as exception logs, so that developers can quickly determine the cause of the exception, reply to users immediately, and repair the exceptions triggered by users based on the relevant exception log fields in the exception log. It can be understood that this method can save the manpower of developers to repeatedly check exception feedback. For customer service personnel who are not familiar with application logs, they can also quickly determine the exception problem and reply to users in time based on the relevant Chinese translation results of the exception log fields in the exception log, and facilitate testers to eliminate exception problems and conduct relevant tests based on the exception logs to cooperate with developers to comprehensively repair exceptions.

[0111] Secondly, the cropping module, translation module and error detection module of this method are not limited to the log analysis of a single application. Developers can reuse the cropping module, translation module and error detection module to configure the corresponding tree module chain to develop a new log analysis module, and then apply it to other applications or other exception types. There is no need to develop a new log analysis module for log analysis, which saves a lot of development time for developers, improves the exception repair efficiency of the application, and comprehensively enhances the robustness of the application.

[0112] The above exemplary embodiments and their variations fully disclose the implementation scheme of the log analysis and processing method of the present application. However, various variations of the method can be derived by changing and expanding some technical means. Other embodiments are briefly described below:

[0113] In one embodiment, please refer to Figure 3 The step of responding to the application exception instruction pushed by the user terminal and obtaining the target exception type and application log pointed to by the application exception instruction includes the following steps:

[0114] Step S111: parse the application exception instruction and obtain the user exception text contained in the application exception instruction:

[0115] The server receives the application exception instruction pushed by the user terminal, parses the application exception instruction, and obtains the user exception text edited by the user contained in the application exception instruction.

[0116] Step S112: Call the abnormality type recognition model that has been trained to convergence, and determine the semantic similarity probability value corresponding to the user abnormal text and each abnormality type according to the semantic features of the user abnormal text:

[0117] The server calls the abnormal type recognition model that has been trained to convergence. The abnormal type recognition model is a neural network model, which generally has a corresponding convolutional layer or fully connected layer to calculate the semantic features of the user abnormal text and the semantic similarity probability values ​​of each abnormal type. The semantic features of the user abnormal text are generally corresponding feature vectors or feature matrices. The abnormal type recognition model calculates its semantic similarity with each abnormal type by inputting the semantic features of the user class text into the corresponding convolutional layer or fully connected layer, and determines the semantic similarity probability values ​​corresponding to the user abnormal text and each abnormal type with the help of a normalization algorithm. The sum of the semantic similarity probability values ​​of each abnormal type is generally 1.

[0118] Step S113: The exception type with the largest semantic similarity probability value is used as the target exception type corresponding to the user exception text:

[0119] The server uses the abnormal type with the largest semantic similarity probability value with the user abnormal text as the target semantic type.

[0120] In this embodiment, users can edit the exceptions they encounter when running applications and submit them to the server's exception type recognition model for exception type recognition, thereby improving the convenience and freedom of users when using the exception reporting service.

[0121] In one embodiment, please refer to Figure 4 The log analysis model has multiple tree-shaped module chains, and the tree-shaped module chains include the following steps:

[0122] Step S121: traverse the application log and query the target start identifier and target end identifier in the application log:

[0123] The clipping logic of the clipping module generally corresponds to the exception type of the log analysis model to which it belongs. Specifically, the target start identifier and the target end identifier in the clipping module will correspond to the exception type of the log analysis model to which it belongs. For example, when the exception type corresponding to the log analysis model is: "unable to output live stream", the clipping module of the log analysis model has a target start identifier of "join channel success (successful entry into the live broadcast room)" and a target end identifier of "leave channel (leave the live broadcast room)", so that the log analysis model intercepts the log field between entering the live broadcast room and leaving the live broadcast room in the application log through the clipping module, and uses the log field as the log to be analyzed corresponding to the log analysis model.

[0124] In one embodiment, the cropping module has cropping identifiers with different execution orders. For example, when the exception type of the log analysis module is "unable to output live stream", the cropping module has a first execution cropping identifier of "appstarted (start application)", and the second execution cropping identifier is generally a cropping identifier pair, that is, a start identifier and an end identifier, wherein the start identifier is "join channelsuccess (enter the live broadcast room successfully)", and the end identifier is "leave channel (leave the live broadcast room)", then the cropping module will first intercept all log fields after the application is opened in the application log, and then intercept the log fields between entering the live broadcast room and leaving the live broadcast room, so as to use the log fields as the log to be analyzed corresponding to the log analysis model.

[0125] Step S122: intercept the log field between each target start identifier and the target end identifier, and use the log field as the log to be analyzed corresponding to the target log analysis model:

[0126] The corresponding clipping module intercepts the log field between the target start identifier and the target end identifier in the application log, and uses the log field as the log to be analyzed corresponding to the log analysis model to which it belongs, so that the log analysis model can subsequently perform log analysis on the log to be analyzed through its own tree-shaped module chain.

[0127] In this embodiment, the clipping module extracts the log fields in the start identifier and end identifier corresponding to the exception type to be processed in the application log, and uses the log fields as the log fields required for log analysis by the log analysis model, thereby effectively improving the analysis efficiency of the log analysis model.

[0128] In one embodiment, please refer to Figure 5The log analysis model has multiple tree-shaped module chains, and the tree-shaped module chains include the following steps:

[0129] Step S121', calling the log filter, traversing the log to be analyzed according to the matching expression of the log filter, and matching the log fields in the log to be analyzed that have the characters contained in the matching expression:

[0130] The translation module calls its own log filter, traverses the log to be analyzed intercepted by the clipping module, and matches the log field in the log to be analyzed that has the characters contained in the matching expression. The log field will be used as the target translation log field of the translation model.

[0131] Step S122', calling the preset result matching rule to match the result field contained in the log field:

[0132] After the translation module matches the log field containing the characters included in the matching expression, it calls the sub-pattern matching rule of the original result matching rule to match the result field included in the log field. For example, when the log field is "chatTable frame is{(0, -34), (277, 244)}", the matched result field will be ((0, -34), (277, 244)).

[0133] Step S123', obtaining the translation output field corresponding to the result matching rule, replacing the corresponding replacement field in the translation output field with the result field, and storing the replaced translation output field in the exception log:

[0134] After the translation module matches the result field, the replacement field in the translation output field corresponding to the result matching rule is replaced with the result field. For example, when the translation output field is the public screen frame {% S} and the result field is ((0, -34), (277, 244)), the replacement translation output field is the public screen frame {(0, -34), (277, 244)}.

[0135] In this embodiment, the translation module matches the corresponding target translation log field, and then uses the sub-pattern to match the result field in the target translation log field to replace the replacement field in the preset translation output field, and then stores the translation output field after the replacement translation in the exception log. The translation efficiency is high, and there is no need to use other translation tools for translation. It has a high degree of recognition, which improves the browsing experience of developers when browsing exception logs.

[0136] In one embodiment, please refer to Figure 6 The log analysis model has multiple tree-shaped module chains, and the tree-shaped module chains include the following steps:

[0137] In step S121, the preset error detection field matching rule is called to obtain the target error detection log field with the error detection key character in the log to be analyzed, and the error detection focus field contained in the target error detection log field is obtained and stored in the focus result pool:

[0138] The error detection module calls the preset error detection field matching rule to obtain the target error detection log field with the error detection keyword in the log to be analyzed, and stores the error detection focus field contained in the target error detection log field into the focus result pool. For example, when the target error detection log field matched by the error detection module is "[main-thread][ChannelChat]-[ChannelCore onSendChatResult:]code:7", the 7 in "code:7" is the error detection focus field, which will be stored in the focus result pool.

[0139] Step S122, call the standard result pool and error detection relationship pool corresponding to the error detection field matching rule, and judge whether the error detection focus field currently checked in the focus result pool and the corresponding standard focus field in the standard result pool conform to the relationship represented by the corresponding relationship identifier in the error detection relationship pool:

[0140] The characterization result pool stores one or more standard attention fields for verifying whether the error detection attention field contained in the corresponding error detection log field is an abnormal field, that is, it stores the standard attention fields for verifying whether the error detection attention field stored in the attention result pool is an abnormal field. Correspondingly, the error detection relationship pool stores relationship identifiers for verifying whether the error detection attention field satisfies the relationship of the corresponding standard attention field. For example, when the error detection attention field group stored in the attention result pool is [7,900,5], the standard attention field group stored in the standard result pool is [6,900,4], and the relationship identifier group stored in the error detection relationship pool is [>=,==,<=], the following relationship judgment logic will be performed:

[0141] match_result[0]<=result[0], i.e., judging whether the error detection focus field "7" is greater than or equal to the standard focus field "6";

[0142] match_result[1] == result[1], i.e., judging whether the error detection focus field "900" is equal to the standard focus field "900";

[0143] match_result[2]<=result[2], that is, it is determined whether the error detection focus field "5" is less than or equal to the standard focus field "4".

[0144] In step S123, when any error detection concern field and its corresponding standard concern field do not conform to the relationship represented by the corresponding relationship identifier in the error detection relationship pool, the error detection log field to which the error detection concern field belongs is stored in the exception log as an exception log field.

[0145] It can be understood that the error detection attention field "5" in the relationship judgment logic described in step S122 is not less than or equal to the standard attention field "4". At this time, the error detection log field to which the error detection attention field "5" belongs is stored in the exception log as the exception log field.

[0146] In this embodiment, by judging whether the error detection field and the standard field meet the preset relationship, it is determined whether the matched error detection log field is an abnormal log field, and the abnormal log field is automatically detected and labeled and output through the relationship comparison rules to quickly identify the abnormalities represented in the log.

[0147] In one embodiment, please refer to Figure 7 The log analysis model has multiple tree-shaped module chains, and the tree-shaped module chains include the following steps:

[0148] Step S121', call the preset positive output matching rule to detect whether there is a log field corresponding to the regular expression of the positive output matching rule in the log to be analyzed. If not, the error field corresponding to the positive output matching rule is stored as an abnormal log field in the abnormal log:

[0149] The error detection module with the positive output matching rule is a positive output error detection module. The positive output detection module will call the positive output matching rule to detect whether there is a log field with the characters or fields specified by the positive output matching rule in the log to be analyzed intercepted by the cropping module. If so, it indicates that the log to be analyzed has a log field that represents its normal operation, that is, the application has passed the error detection check of the positive output error detection module. For example, when the log field required to be matched by the positive output matching rule is represented as "public screen chat message received", if the log field can be matched from the log to be analyzed, it indicates that the application has normally received the public screen chat message. If it does not exist, it indicates that the application cannot receive the public screen chat message. At this time, the "public screen chat message not received" in the normal output matching rule is stored in the exception log as the abnormal log field and its error detection time.

[0150] Step S122', calling the preset negative output matching rule, detecting whether there is a log field corresponding to the regular expression of the negative output matching rule in the log to be analyzed, and if so, storing the log field as an abnormal log field in the abnormal log:

[0151] Correspondingly, the error detection module with the negative output matching rule is a positive output error detection module. The negative output detection module will call the negative output matching rule to detect whether there is a log field with the characters or fields specified by the negative output matching rule in the log to be analyzed intercepted by the cropping module. If so, it indicates that the log to be analyzed has a log field that indicates its abnormal operation, that is, the application does not pass the error detection check of the negative output error detection module. For example, when the log field required to be matched by the negative output matching rule is characterized as "live stream push disconnected", if the log field can be matched from the log to be analyzed, it indicates that an abnormality has occurred in the live stream push of the application, and the log field "live stream push disconnected" is stored in the abnormal log as the abnormal log field and its error detection time.

[0152] In this embodiment, the positive and negative matching rules are used to query whether there is a corresponding field in the application log, and then the field representing the abnormality of the application is stored in the abnormality log. It can be understood that through the two-way error detection mechanism, the abnormality of the application can be quickly detected through the log.

[0153] In one embodiment, please refer to Figure 8 The step of performing log analysis on the application log according to the tree model chain included in the target log analysis model to obtain the corresponding abnormal log includes the following steps:

[0154] Step S131: Call the root node in the target log analysis model to filter out the logs to be analyzed in the application logs:

[0155] The root node is generally the clipping module, which prioritizes the tree module chain in the target log analysis module to filter out the logs to be analyzed. Specifically, through the target start identifier and target end identifier contained in the clipping module, all log fields between the target start identifier and the target end identifier in the application log are queried as the logs to be analyzed.

[0156] Step S132: Call the first tree module chain under the root node to perform log analysis on the log to be analyzed, and store the log fields matched during the analysis into the exception log:

[0157] After the logs to be analyzed are filtered out through the root node, the first tree module chain under the root node will be used to perform log analysis on the logs to be analyzed. As to how to set the first tree module chain for log analysis, those skilled in the art can set it according to the abnormal problem to be solved. For the event that is most likely to trigger the abnormal problem, it is generally used as the priority detection direction. The tree module chain configured for this detection direction will be the first tree module chain for log analysis, thereby improving the efficiency of log analysis.

[0158] Step S133: If the log to be analyzed has an abnormal log field corresponding to the first tree module chain, the abnormal log field is stored in the abnormal log; if the abnormal log field does not exist, backtrack to the root node to call the next tree module chain to perform log analysis on the log to be analyzed:

[0159] If the log to be analyzed contains an exception log field corresponding to the first tree module chain, the exception log field will be stored in the exception log. At this time, the call to the target log analysis module to perform log analysis on the application log will be stopped, and the exception log will be output. If the exception log field corresponding to the first tree module chain does not exist, the root node will be traced back to call the next tree module chain to perform log analysis on the log to be analyzed. Similarly, the log analysis of the application log for the target exception type will be completed, and the corresponding exception log will be generated for output or stored in the corresponding database.

[0160] In this embodiment, the application log is analyzed and processed through the log analysis model, and the application log is analyzed in an orderly manner through different tree module chains in the log analysis model. The abnormal problems reflected in the application log will be recorded, translated and output, so that developers can confirm the abnormal point that caused the exception without browsing the complex original fields of the application log.

[0161] Furthermore, by functionalizing the various steps in the methods disclosed in the above embodiments, a log analysis and processing device of the present application can be constructed. Figure 9In a typical embodiment, the device includes: an exception instruction response module 11, which is used to respond to the application exception instruction pushed by the user end, and obtain the target exception type and application log corresponding to the application exception instruction; an analysis model query module 12, which is used to query the target log analysis model corresponding to the target exception type from the log model pool, and the log analysis model has multiple tree module chains, and the tree module chain contains a clipping module, a translation module or an error detection module; an exception log acquisition module 13, which is used to call the target log analysis model and use the tree module chain contained in the target log analysis model to perform log analysis on the application log to obtain the corresponding exception log.

[0162] In one embodiment, the abnormal instruction response module 11 includes: an abnormal instruction parsing submodule, which is used to parse the application abnormal instruction and obtain the user abnormal text contained in the application abnormal instruction; a type similarity determination submodule, which is used to call the abnormal type recognition model trained to convergence, and determine the semantic similarity probability value corresponding to the user abnormal text and each abnormal type based on the semantic features of the user abnormal text; a target abnormal type determination submodule, which is used to use the abnormal type with the largest semantic similarity probability value as the target abnormal type corresponding to the user abnormal text.

[0163] In one embodiment, the analysis model query module 12 includes: a target identifier query submodule, used to traverse the application log and query the target start identifier and target end identifier in the application log; a log to be analyzed acquisition submodule, used to intercept the log field between each target start identifier and the target end identifier, and use the log field as the log to be analyzed corresponding to the target log analysis model.

[0164] In another embodiment, the analysis model query module 12 also includes: a filter calling submodule, which is used to call the log filter, traverse the log to be analyzed according to the matching expression of the log filter, and match the log field in the log to be analyzed that has the characters contained in the matching expression; a result field matching submodule, which is used to call the preset result matching rule, and match the result field contained in the log field; a translation output field replacement submodule, which is used to obtain the translation output field corresponding to the result matching rule, replace the corresponding replacement field in the translation output field with the result field, and store the replaced translation output field in the exception log.

[0165] In another embodiment, the analysis model query module 12 also includes: an error detection log field acquisition submodule, which is used to call the preset error detection field matching rules, obtain the target error detection log field with the error detection keyword in the log to be analyzed, and obtain the error detection focus field contained in the target error detection log field and store it in the focus result pool; an error detection log field verification submodule, which is used to call the standard result pool and the error detection relationship pool corresponding to the error detection field matching rules, and judge whether the currently verified error detection focus field in the focus result pool and the corresponding standard focus field in the standard result pool are consistent with the relationship represented by the corresponding relationship identifier in the error detection relationship pool; an abnormal log field determination submodule, which is used to store the error detection log field to which the error detection focus field belongs as an abnormal log field in the abnormal log when any error detection focus field and its corresponding standard focus field do not conform to the relationship represented by the corresponding relationship identifier in the error detection relationship pool.

[0166] In another embodiment, the analysis model query module 12 also includes: a positive output matching detection submodule, which is used to call a preset positive output matching rule to detect whether there is a log field corresponding to the regular expression of the positive output matching rule in the log to be analyzed; if not, the error field corresponding to the positive output matching rule is stored as an abnormal log field in the abnormal log; a negative output matching detection submodule, which is used to call a preset negative output matching rule to detect whether there is a log field corresponding to the regular expression of the negative output matching rule in the log to be analyzed; if so, the log field is stored as an abnormal log field in the abnormal log.

[0167] In one embodiment, the exception log acquisition module 13 includes: a log screening submodule for analyzing, which is used to call the root node in the target log analysis model to filter out the logs to be analyzed in the application log; a log parsing submodule for analyzing, which is used to call the first tree-shaped module chain under the root node to perform log analysis on the logs to be analyzed, and store the log fields matched during the analysis process in the exception log; a module chain traversal submodule for storing the exception log field in the exception log if the log to be analyzed has the exception log field corresponding to the first tree-shaped module chain; and tracing back to the root node if the exception log field does not exist to call the next tree-shaped module chain to perform log analysis on the log to be analyzed.

[0168] In order to solve the above technical problems, the embodiment of the present application also provides a computer device for running a computer program implemented according to the log analysis and processing method. Figure 10 , Figure 10 This is a basic structural block diagram of the computer device in this embodiment.

[0169] like Figure 10 As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a non-volatile storage medium, a memory and a network interface connected via a system bus. Among them, the non-volatile storage medium of the computer device stores an operating system, a database and computer-readable instructions, and the database may store a control information sequence. When the computer-readable instructions are executed by the processor, the processor can implement a log analysis and processing method. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor can execute a log analysis and processing method. The network interface of the computer device is used to connect and communicate with the terminal. Those skilled in the art will understand that Figure 10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0170] In this embodiment, the processor is used to execute the specific functions of each module / submodule in the log analysis and processing device of this application, and the memory stores the program code and various data required to execute the above modules. The network interface is used to transmit data between user terminals or servers. The memory in this embodiment stores the program code and data required to execute all modules / submodules in the log analysis and processing device, and the server can call the server's program code and data to execute the functions of all submodules.

[0171] The present application also provides a non-volatile storage medium, in which the log analysis and processing method is written into a computer program and stored in the storage medium in the form of computer-readable instructions. When the computer-readable instructions are executed by one or more processors, it means that the program is running in the computer, thereby enabling one or more processors to execute the steps of the log analysis and processing method of any of the above embodiments.

[0172] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When executed, the program can include the processes in the above-described method embodiments. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0173] In summary, the automated analysis of this application helps developers analyze application logs, quickly identify abnormal problems, respond to users in a timely manner and fix the abnormalities, saving time and labor costs in resolving abnormalities.

[0174] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0175] Those skilled in the art will appreciate that the steps, measures, and schemes in the various operations, methods, and processes discussed in this application may be interchanged, modified, combined, or deleted. Furthermore, other steps, measures, and schemes in the various operations, methods, and processes discussed in this application may also be interchanged, modified, rearranged, decomposed, combined, or deleted. Furthermore, steps, measures, and schemes in the prior art that are similar to those disclosed in this application may also be interchanged, modified, rearranged, decomposed, combined, or deleted.

[0176] The above description is only part of the implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A log analysis and processing method, characterized in that: The steps include: Respond to the application exception instruction pushed by the user end, and obtain the target exception type and application log corresponding to the application exception instruction; Querying a target log analysis model corresponding to the target exception type from a log model pool, wherein the log analysis model has multiple tree module chains, each of which includes a clipping module, a translation module, and an error detection module. The clipping module, the translation module, or the error detection module is reused between multiple tree module chains; Calling the target log analysis model, and using the tree module chain contained in the target log analysis model to perform log analysis on the application log to obtain a corresponding exception log, including: using the cropping module to crop the application log to obtain a log to be analyzed in the application log, using the translation module to match the corresponding log field from the log to be analyzed, performing translation processing to replace it with a translated text, and detecting, using the error detection module, a log field in the log to be analyzed that triggers the target exception type and storing it as an exception log field in the exception log; Among them, the log analysis model performs different log analysis processing on the application log through the multiple tree module chains it possesses, so that the log analysis model analyzes the log fields of the application log through multiple tree module chains, and analyzes the events triggered by the exception types corresponding to the log analysis when the application is running; and then analyzes the application log from different angles and constitutes corresponding exception logs for output, thereby solving the exceptions triggered by the user-side running of the application; the nodes in the tree module chain of the log analysis module are composed of one or more different types of modules, so that the nodes in the tree module chain comprehensively analyze the application log.

2. The method according to claim 1, characterized in that The step of responding to the application exception instruction pushed by the user terminal and obtaining the target exception type and application log pointed to by the application exception instruction includes the following steps: Parsing the application exception instruction to obtain the user exception text contained in the application exception instruction; Calling the abnormality type recognition model that has been trained to convergence, and determining the semantic similarity probability value corresponding to the user abnormal text and each abnormality type according to the semantic features of the user abnormal text; The exception type with the largest semantic similarity probability value is used as the target exception type corresponding to the user exception text.

3. The method according to claim 1, characterized in that The log analysis model has multiple tree-shaped module chains, and the tree-shaped module chains include the following steps: Traversing the application log, querying the target start identifier and the target end identifier in the application log; The log field between each target start identifier and the target end identifier is intercepted, and the log field is used as the log to be analyzed corresponding to the target log analysis model.

4. The method according to claim 3, characterized in that The log analysis model has multiple tree-shaped module chains, and the tree-shaped module chains include the following steps: Calling the log filter, traversing the log to be analyzed according to the matching expression of the log filter, and matching the log fields in the log to be analyzed that have the characters contained in the matching expression; Calling a preset result matching rule to match the result field contained in the log field; The translation output field corresponding to the result matching rule is obtained, the replacement field corresponding to the translation output field is replaced with the result field, and the translation output field after the replacement is completed is stored in the exception log.

5. The method according to claim 3, characterized in that The log analysis model has multiple tree-shaped module chains, and the tree-shaped module chains include the following steps: Call the preset error detection field matching rule to obtain the target error detection log field with the error detection key character in the log to be analyzed, and obtain the error detection focus field contained in the target error detection log field and store it in the focus result pool; Call the standard result pool and error detection relationship pool corresponding to the error detection field matching rule, and determine whether the error detection focus field currently being checked in the focus result pool and the corresponding standard focus field in the standard result pool conform to the relationship represented by the corresponding relationship identifier in the error detection relationship pool; When any error detection concern field and its corresponding standard concern field do not conform to the relationship represented by the corresponding relationship identifier in the error detection relationship pool, the error detection log field to which the error detection concern field belongs is stored in the exception log as an exception log field.

6. The method according to claim 3, characterized in that The log analysis model has multiple tree-shaped module chains, and the tree-shaped module chains include the following steps: Calling a preset positive output matching rule to detect whether there is a log field corresponding to the regular expression of the positive output matching rule in the log to be analyzed; if not, storing the error field corresponding to the positive output matching rule as an abnormal log field in the abnormal log; The preset negative output matching rule is called to detect whether there is a log field corresponding to the regular expression of the negative output matching rule in the log to be analyzed. If so, the log field is stored in the exception log as an exception log field.

7. The method according to any one of claims 1 to 6, characterized in that The step of performing log analysis on the application log according to the tree model chain included in the target log analysis model to obtain the corresponding abnormal log includes the following steps: Calling the root node in the target log analysis model to filter out the logs to be analyzed in the application logs; Calling the first tree module chain under the root node to perform log analysis on the log to be analyzed, and storing the log fields matched during the analysis process in the exception log; If the log to be analyzed has an exception log field corresponding to the first tree module chain, the exception log field is stored in the exception log; if the exception log field does not exist, backtrack to the root node to call the next tree module chain to perform log analysis on the log to be analyzed.

8. A log analysis and processing device, characterized in that: include: The exception instruction response module is used to respond to the application exception instruction pushed by the user end and obtain the target exception type and application log corresponding to the application exception instruction; An analysis model query module is used to query the target log analysis model corresponding to the target exception type from the log model pool. The log analysis model has multiple tree module chains, each of which includes a clipping module, a translation module, and an error detection module. The clipping module, translation module, or error detection module is reused between multiple tree module chains. an exception log acquisition module, configured to call the target log analysis model and perform log analysis on the application log using the tree module chain contained in the target log analysis model to obtain a corresponding exception log, including: using the cropping module to crop the application log to obtain a log to be analyzed in the application log; using the translation module to match the corresponding log field from the log to be analyzed, performing translation processing to replace it with a translated text; and using the error detection module to detect the log field in the log to be analyzed that triggers the target exception type and storing it as an exception log field in the exception log; Among them, the log analysis model performs different log analysis processing on the application log through the multiple tree module chains it possesses, so that the log analysis model analyzes the log fields of the application log through multiple tree module chains, and analyzes the events triggered by the exception types corresponding to the log analysis when the application is running; and then analyzes the application log from different angles and constitutes corresponding exception logs for output, thereby solving the exceptions triggered by the user-side running of the application; the nodes in the tree module chain of the log analysis module are composed of one or more different types of modules, so that the nodes in the tree module chain comprehensively analyze the application log.

9. An electronic device comprising a central processing unit and a memory, characterized in that: The central processing unit is configured to call and run a computer program stored in the memory to execute the steps of the method according to any one of claims 1 to 7.

10. A non-volatile storage medium, characterized in that: It stores a computer program implemented according to the method described in any one of claims 1 to 7 in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the method are executed.

Images