Log processing method, device, computer equipment and storage medium

Abstract

The application discloses a log processing method and device, computer equipment and a storage medium, and belongs to the technical field of computers. The application filters the field data targeted by this log analysis by using filter words on the log to be analyzed, and then automatically performs business analysis on the filtered field data in a function calculation manner through an analysis function associated with a business analysis type, and outputs the final business analysis result, so that as long as the analysis function is configured, the analysis function can be introduced to implement business analysis by a machine, without manual participation in the log analysis process to troubleshoot business problems, improving the processing efficiency of the log analysis process, and enabling organic combination of log analysis and abnormal positioning and troubleshooting tasks of business logic.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a log processing method, apparatus, computer equipment, and storage medium. Background Art

[0002] With the development of computer technology, business logs are usually generated when applications provide business services to users. Before a new version or new function of an application is launched, a large number of tests are usually performed on the application code. By analyzing the generated business logs, problems (bugs) generated by the application code during the testing process can be analyzed, so as to locate the problems in the application code and facilitate debugging (Debug) to fix the problems.

[0003] In the process of analyzing business logs, a keyword-based regular matching method can usually be used to quickly find the field data associated with the keyword from massive business logs, and then sort and display these field data according to the timestamps of the business logs.

[0004] Because when obtaining specified field data based on regular match filtering and displaying the filtered field data based on timestamps, only linear process analysis can be performed on the displayed field data, and business issues reflected by the field data need to be manually checked. Therefore, the log analysis process is inefficient and cannot be integrated with business logic. Summary of the Invention

[0005] The embodiments of the present application provide a log processing method, apparatus, computer device, and storage medium that can improve the processing efficiency of the log analysis process and organically combine log analysis with the anomaly location and troubleshooting tasks of business logic. The technical solution is as follows:

[0006] In one aspect, a log processing method is provided, the method comprising:

[0007] Determine a business scenario type and a business analysis type for log analysis, wherein the business scenario type represents the business scenario targeted by the log analysis, and the business analysis type represents the analysis type to which the field data targeted by the log analysis belongs;

[0008] Acquire a filter word associated with the business scenario type and an analysis function associated with the business analysis type;

[0009] Filtering the log to be analyzed to obtain field data associated with the filter word;

[0010] Based on the analysis function, business analysis is performed on the field data, and the business analysis result of the log is output.

[0011] In one possible implementation, the method further includes:

[0012] Displaying a scenario parameter configuration interface for log analysis, wherein the scenario parameter configuration interface is used to edit at least one of the business scenario type, the business analysis type, the filter word, or the analysis function;

[0013] In response to an editing operation triggered based on the scenario parameter configuration interface, the information input by the editing operation is assigned to the editing object targeted by the editing operation, and the editing object is at least one of the business scenario type, the business analysis type, the filter word or the analysis function.

[0014] In a possible implementation manner, when the scene parameter configuration interface supports editing the analysis function, the method further includes:

[0015] In the area for editing the analysis function in the scene parameter configuration interface, the application programming interface API supported by the analysis function and the description information of the API are displayed.

[0016] In one aspect, a log processing device is provided, comprising:

[0017] A determination module, configured to determine a business scenario type and a business analysis type for log analysis, wherein the business scenario type represents the business scenario targeted by the log analysis, and the business analysis type represents the analysis category to which the field data targeted by the log analysis belongs;

[0018] An acquisition module, configured to acquire a filter word associated with the business scenario type and an analysis function associated with the business analysis type;

[0019] A filtering module, configured to filter the log to be analyzed and obtain field data associated with the filtering word;

[0020] The analysis output module is used to perform business analysis on the field data based on the analysis function and output the business analysis results of the log.

[0021] In one possible implementation, the acquisition module includes:

[0022] A first determining unit, configured to determine a plurality of candidate functions associated with the business analysis type;

[0023] a second determining unit, configured to determine a data type of the field data associated with the filter word;

[0024] The third determining unit is configured to determine, from the plurality of candidate functions, an analysis function whose parameter type of an input parameter matches the data type.

[0025] In one possible implementation, the data type includes a variable type and a variable attribute, wherein the variable type represents the type of the variable involved in the field data, and the variable attribute represents the type of variable to which the variable type belongs;

[0026] The third determining unit is configured to:

[0027] Screening and obtaining, from the multiple candidate functions, at least one candidate function whose input parameter matches the variable attribute;

[0028] An analysis function whose parameter type is compatible with the variable type is screened out from the at least one candidate function.

[0029] In one possible implementation, the analysis function includes an analysis sub-function and a chart sub-function;

[0030] The analysis output module is used to:

[0031] The field data is used as an input parameter of the analysis sub-function, passed into the analysis sub-function, and the analysis sub-function having the input parameter passed into it is run to obtain the running result of the analysis sub-function;

[0032] The operation result is passed into the chart sub-function, an analysis chart of the operation result is drawn by the chart sub-function, and the analysis chart is output as the business analysis result.

[0033] In one possible implementation, the device further includes:

[0034] a reading module, configured to read the function code of the analysis function from a cache if the function code of the analysis function has been cached;

[0035] The conversion module is used to obtain the function string of the analysis function when the function code is not cached, and convert the function string into the function code.

[0036] In one possible implementation, the business analysis results include at least one of the following: business analysis data obtained by analyzing the field data based on the analysis function; or, a trend curve of the business analysis data plotted in a graphical form as the log timestamp changes; or, a business analysis report obtained based on the analysis of the trend curve.

[0037] In one possible implementation, the device further includes:

[0038] A display module, configured to display a scenario parameter configuration interface for log analysis, wherein the scenario parameter configuration interface is used to edit at least one of the business scenario type, the business analysis type, the filter word, or the analysis function;

[0039] An assignment module is used to assign the information input by the editing operation to the editing object targeted by the editing operation in response to an editing operation triggered based on the scenario parameter configuration interface, where the editing object is at least one of the business scenario type, the business analysis type, the filter word or the analysis function.

[0040] In a possible implementation manner, when the scene parameter configuration interface supports editing the analysis function, the display module is further configured to:

[0041] In the area for editing the analysis function in the scene parameter configuration interface, the application programming interface API supported by the analysis function and the description information of the API are displayed.

[0042] On the one hand, a computer device is provided, which includes one or more processors and one or more memories, wherein the one or more memories store at least one computer program, and the at least one computer program is loaded and executed by the one or more processors to implement a log processing method as any possible implementation method described above.

[0043] In one aspect, a storage medium is provided, in which at least one computer program is stored. The at least one computer program is loaded and executed by a processor to implement the log processing method according to any possible implementation manner described above.

[0044] In one aspect, a computer program product or computer program is provided, comprising one or more program codes stored in a computer-readable storage medium. One or more processors of a computer device are capable of reading the one or more program codes from the computer-readable storage medium and executing the one or more program codes, thereby enabling the computer device to perform any of the possible implementations of the log processing method described above.

[0045] The beneficial effects of the technical solutions provided in the embodiments of the present application include at least:

[0046] By filtering the logs to be analyzed using filter words, the field data targeted by this log analysis is obtained. Then, through the analysis function associated with the business analysis type, the filtered field data is automatically subjected to business analysis in the form of function calculation, and the final business analysis results are output. Therefore, as long as the analysis function is configured, the analysis function can be introduced to implement business analysis by the machine, without the need for manual participation in the log analysis process to troubleshoot business problems. This improves the processing efficiency of the log analysis process and can organically combine log analysis with the anomaly location and troubleshooting tasks of business logic. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0048] Figure 1 This is a schematic diagram of an implementation environment of a log processing method provided in an embodiment of the present application;

[0049] Figure 2 This is a flow chart of a log processing method provided by an embodiment of the present application;

[0050] Figure 3 This is a flow chart of a log processing method provided by an embodiment of the present application;

[0051] Figure 4 is a schematic diagram of an analysis chart provided in an embodiment of the present application;

[0052] Figure 5 This is a principle flow chart of a log processing method provided in an embodiment of the present application;

[0053] Figure 6 This is a schematic diagram showing a business analysis result provided by an embodiment of the present application;

[0054] Figure 7 This is a schematic diagram of a scene parameter configuration interface provided in an embodiment of the present application;

[0055] Figure 8 This is a schematic diagram of a scene parameter configuration interface provided in an embodiment of the present application;

[0056] Figure 9 This is a structural diagram of a log processing device provided in an embodiment of the present application;

[0057] Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present application;

[0058] Figure 11 Fig. 1 is a structural schematic diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to make the objects, technical solutions and advantages of the present application clearer, the following will further describe the embodiments of the present application in detail with reference to the drawings.

[0060] In the present application, the terms "first", "second" and the like are used to distinguish the same or similar items with substantially the same function and action, and it should be understood that there is no logical or time sequence dependency between "first", "second" and "nth", and the number and execution order are not limited.

[0061] In the present application, the term "at least one" means one or more, and the term "multiple" means two or more, for example, multiple candidate functions means two or more candidate functions.

[0062] In the present application, the term "including at least one of A or B" refers to the following cases: including A only, including B only, and including both A and B.

[0063] In the present application, the user-related information (including but not limited to user device information, personal information, behavior information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.) and signals involved are all authorized, agreed or authorized by the user or all parties when the method of the embodiments of the present application is applied to specific products or technologies, and the collection, use and processing of the relevant information, data and signals need to comply with relevant laws, regulations and standards of relevant countries and regions. For example, the logs generated in the business scenarios involved in the present application are obtained under sufficient authorization.

[0064] In the following, the terms involved in the embodiments of the present application are explained and described.

[0065] Log information filtering: a log is information composed of field data of multiple fields, and through a regular expression, specified field data or field data containing specified keywords can be filtered from the log based on regular matching, and each field data filtered can form a log flowchart.

[0066] Function calculation: in the log analysis process, a container for writing code is provided to a technician, so that the technician can predefine function code of an analysis function in the container, so that the log content can be directly analyzed and operated by the function code, and the running result of the output function code can be controlled.

[0067] Chart analysis: in the log analysis process, after the running result of the analysis function is obtained by the above function calculation method, the massive log data is cleaned and analyzed, and under the action of the chart related function, the running result can be visually presented in a chart manner, which includes but is not limited to: data table, column chart, pie chart, sector chart, line chart, scatter chart and the like.

[0068] Finding the cause from the result: in the log analysis process, if a bug occurs in the business process, the result caused by some bugs can be located when the log is analyzed, at this time, the result data can be used as a clue to query the bug that will cause the result data in the business process in reverse order.

[0069] Time backtracking: in the log analysis process, the time stamp may be missed in some logs, or only the log of the failed process node is generated in some business processes, and the log of the successful process node is not generated, which will cause the time stamp missing in the existing log, or the time stamp of the process node missing due to the missing of some logs, in this case, the time stamp of the previous process node can be used as the time stamp of the current missing process node, so as to achieve the effect of log time backtracking.

[0070] The system architecture of the embodiment of the present application is described below.

[0071] Figure 1 It is an implementation environment schematic diagram of a log processing method provided by the embodiment of the present application. Referring to Figure 1 In the implementation environment, a terminal 101 and a server 102 are included, and the terminal 101 and the server 102 are both exemplary descriptions of a computer device.

[0072] The terminal 101 is used to provide any type of business service, for example, the terminal 101 provides Web service through a browser application, or provides LBS (Location Based Services) through a map application, or provides instant messaging service through a social application, and the like, in the process of providing business service by the terminal 101, the application supporting the above business service will generate a log, and report the log to the server 102, the generation and reporting of the above log need to be fully authorized and separately agreed by the user.

[0073] The terminal 101 and the server 102 can be directly or indirectly connected through wired or wireless communication, which is not limited in the present application.

[0074] Server 102 is used to provide a log analysis platform to terminal 101. Optionally, server 102 provides background services for the above-mentioned applications that support business services, and also provides analysis services for the logs generated by the above-mentioned applications. Alternatively, server 102 is a server cluster composed of business servers and analysis servers, and the business servers are used to provide background services for applications that support business services, and the analysis servers are used to provide analysis services for the logs generated by the above-mentioned applications.

[0075] In some embodiments, after receiving the logs reported by each terminal 101, the server 102 can perform batch analysis and processing on massive logs through the log processing method involved in the embodiments of the present application to obtain the business analysis results of the logs and visualize the business analysis results. The business analysis results can assist in locating possible bugs in the business process, or troubleshoot various types of anomalies in the application (such as flash back, page obstruction, freeze, inability to jump, functional abnormalities, etc.), and can also help test the business effects of new versions or new functions of the application, and has a wide range of application scenarios.

[0076] In some embodiments, the server 102 and the terminal 101 may be integrated on the same physical machine, which is not specifically limited in the embodiments of the present application.

[0077] Optionally, server 102 is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0078] Optionally, the terminal 101 generally refers to one of a plurality of terminals, and the device type of the terminal 101 includes at least one of a smartphone, a tablet computer, an e-book reader, an MP3 (Moving Picture Experts Group Audio Layer III) player, an MP4 (Moving Picture Experts Group Audio Layer IV) player, a laptop computer, a desktop computer, a smart speaker, or a smartwatch. For example, the terminal 101 is a smartphone or other portable electronic device.

[0079] Those skilled in the art will appreciate that the number of terminals 101 may be greater or less. For example, there may be only one terminal 101, or there may be dozens, hundreds, or even more terminals 101. The present embodiment does not limit the number or device type of terminals 101.

[0080] Figure 2 This is a flow chart of a log processing method provided by an embodiment of the present application. Figure 2 This embodiment is executed by a computer device and is described by taking the computer device as a server as an example. This embodiment includes:

[0081] 201. The server determines a business scenario type and a business analysis type for log analysis. The business scenario type represents the business scenario targeted by the log analysis, and the business analysis type represents the analysis type to which the field data targeted by the log analysis belongs.

[0082] The log involved in the embodiments of this application refers to the log generated during the process of providing business services in a business scenario, and is therefore also called a business log. Among them, the log is information composed of field data of multiple fields. During the storage process, each log can be stored as a data record in the database. The log stored in the form of a data record is called a log record. For the log record, each field is equivalent to the column name of a data column in the log record, and the field data of each field is equivalent to the field value stored in the corresponding data column.

[0083] The business scenario type involved in the embodiments of the present application is used to characterize the business scenario targeted by log analysis. Optionally, the business scenario type involves the following levels of scenario tags: application tags, business tags and scenario tags. The application tag is used to identify which application's reported logs are to be analyzed. For example, the application tags include: application A, application B, application C, etc. The business tag is used to identify which type of business supported by the specified application generates logs for analysis. For example, the business tags include: basic business, navigation business, map business, recommendation business, advertising business, extended business 1, extended business 2, etc. The scenario tag is used to identify which type of scenario is to be analyzed in the process of the specified application providing related services of the specified business. For example, the scenario tags include: process number switching, page layout time analysis, page dwell time analysis, video viewing time analysis, etc. The embodiments of the present application do not specifically limit the business scenario type.

[0084] The business analysis type involved in the embodiments of the present application represents what kind of field data obtained by filtering the specified filter words under the specified business scenario type needs to be analyzed. For example, the business analysis types include: info (used to analyze various types of field data), core (used to analyze business processes), warn (used to analyze alarm conditions), error (used to analyze error conditions), fatal (used to analyze core bugs), charts (used to visualize business analysis results), etc. The embodiments of the present application do not specifically limit the business analysis types.

[0085] In some embodiments, during the log analysis process, a technician inputs or specifies the business scenario type and business analysis type targeted by this log analysis on the server side.

[0086] In other embodiments, the server provides a log analysis platform to the technician, who can log in to the log analysis platform on the web page or application side of the terminal. Then, the technician starts a log analysis process in the log analysis platform and specifies the business scenario type and business analysis type for this log analysis. For example, an analysis start option is provided in the user interaction interface of the log analysis platform. After the technician clicks the start analysis option, an analysis configuration interface pops up (it can be in the form of a pop-up window, a new tab, or a sub-interface, etc.). In the analysis configuration interface, the business scenario type and business analysis type can be selected. Optionally, an edit box for filter words and a run option are also displayed in the analysis configuration interface. The technician can enter the filter words for this log analysis in the edit box. At the same time, after the configuration of each hyperparameter and analysis function is completed, clicking the run option can trigger a log analysis request to be sent to the server of the log analysis platform. The log analysis request is used to start all logs under the business scenario type, and use the analysis function that matches the business analysis type to implement this log analysis. After receiving the log analysis request, the server parses to obtain the business scenario type and the business analysis type. The embodiment of the present application does not specifically limit the method for determining the business scenario type and the business analysis type.

[0087] 202. The server obtains a filter word associated with the business scenario type and an analysis function associated with the business analysis type.

[0088] The filter words involved in the embodiments of the present application refer to keywords (or search words, query words, etc.) used to filter log information during the log analysis process. The server will generate a regular expression based on the filter words and the filtering rules specified by the technicians, thereby filtering out the various field data that match the filter words from multiple logs and multiple field data of each log based on regular matching.

[0089] The analysis function involved in the embodiment of the present application refers to a function used to analyze or process the various field data filtered from the log in an automated manner. The analysis function can be written in real time by the technician for a specific business scenario, or it can be a predefined function read from a function library (which may have been used in the historical analysis process, or may be native to the function library, or may be written in advance by the technician and stored in the library). The embodiment of the present application does not specifically limit the source of the analysis function.

[0090] In some embodiments, the technician inputs the filter word on the server side and specifies the analysis function so that the server obtains the filter word and the analysis function. Optionally, in the process of obtaining the filter word, the technician inputs the filter word, or the technician selects one from the multiple filter words provided as the filter word for this log analysis. The embodiment of the present application does not specifically limit the input method of the filter word. Optionally, in the process of obtaining the analysis function, the technician inputs the function code of the analysis function, or the technician selects one from multiple analysis functions that have been packaged in advance as the analysis function for this log analysis. Alternatively, the technician does not need to specify the analysis function, and the server automatically selects the most matching analysis function according to the filter word and business analysis type. The embodiment of the present application does not specifically limit the acquisition method of the analysis function.

[0091] In other embodiments, the server receives a log analysis request sent by the terminal. Assuming that the log analysis request carries the function code of the analysis function, the server directly parses the log analysis request to obtain the function code of the analysis function; or, assuming that the log analysis request carries the function identifier of the analysis function, the server uses the function identifier (such as the function name or function ID) as an index to search the function library for the function code of the analysis function corresponding to the function identifier; or, assuming that the log analysis request does not carry any function code and function identifier, the server automatically selects the most matching analysis function according to the filter words and business analysis type. The embodiments of the present application do not specifically limit the method of obtaining the analysis function.

[0092] 203. The server filters the log to be analyzed to obtain field data associated with the filter word.

[0093] In some embodiments, multiple logs to be analyzed that match the business scenario type are screened from multiple logs stored in a log library. Then, based on the filter word and preset filtering rules, a regular expression containing the filter word is generated. Based on the regular expression, all fields in each log to be analyzed are regularly matched, thereby filtering to obtain field data that conforms to the regular expression. The above operation is repeated until all logs to be analyzed are traversed, and finally all field data associated with the filter word in all logs to be analyzed are obtained.

[0094] In other embodiments, assuming that the technician also specifies an analysis time period, or the analysis time period is also carried in the log analysis request, the server can obtain the analysis time period for this log analysis, and then filter out multiple logs stored in the log library that match the business scenario type and are within the analysis time period to be analyzed, and then filter all field data associated with the filter term in all logs to be analyzed based on the above method.

[0095] 204. The server performs business analysis on the field data based on the analysis function and outputs the business analysis result of the log.

[0096] In some embodiments, the server uses each field data obtained by filtering as an input parameter, inputs it into the analysis function determined in the above step 202, and runs the analysis function to obtain the running result of the analysis function. Optionally, the running result of the analysis function is directly output as the business analysis result. Optionally, the analysis function includes an analysis sub-function and a chart sub-function. The above-mentioned running result is obtained through the analysis sub-function, and then the running result is automatically converted into visual information in the form of a chart through the chart sub-function, so as to output the visual information as the business analysis result. The embodiment of the present application does not specifically limit whether the visual information is used as the business analysis result.

[0097] All the above optional technical solutions can be combined in any way to form optional embodiments of the present disclosure, and will not be described in detail here.

[0098] The method provided in the embodiment of the present application obtains the field data targeted by this log analysis by filtering the log to be analyzed using filter words, and then automatically performs business analysis on the filtered field data in a function calculation manner through an analysis function associated with the business analysis type, and outputs the final business analysis result. Therefore, as long as the analysis function is configured, the analysis function can be introduced to implement business analysis by the machine without the need for manual participation in the log analysis process to troubleshoot business problems, thereby improving the processing efficiency of the log analysis process and being able to organically combine log analysis with the anomaly location and troubleshooting tasks of business logic.

[0099] In the above embodiment, the log processing process involved in the embodiment of the present application is briefly introduced. In the embodiment of the present application, a detailed exemplary process for performing log analysis using an analysis function will be provided, which will be explained below.

[0100] Figure 3 This is a flow chart of a log processing method provided by an embodiment of the present application. Figure 3This embodiment is executed by a computer device and is described by taking the computer device as a server as an example. This embodiment includes:

[0101] 301. The server determines a business scenario type and a business analysis type for log analysis. The business scenario type represents the business scenario targeted by the log analysis, and the business analysis type represents the analysis type to which the field data targeted by the log analysis belongs.

[0102] The above step 301 is similar to the above step 201 and will not be described in detail here.

[0103] 302. The server obtains a filter word associated with the business scenario type.

[0104] The above step 302 is similar to the method of filtering words in the above step 202, and will not be described in detail here.

[0105] 303. The server filters the log to be analyzed to obtain field data associated with the filter word.

[0106] The above step 303 is similar to the above step 203 and will not be described in detail here.

[0107] 304. The server determines multiple candidate functions associated with the business analysis type.

[0108] In the above embodiment, multiple methods of determining the analysis function are introduced in step 302. In the embodiment of the present application, an example will be given to illustrate how the server determines the analysis function that best matches the filter word when the technician does not specify the analysis function.

[0109] In some embodiments, when the server stores each candidate function for log analysis in the function library, it will associate the candidate function with the business analysis type, so that when the business analysis type is obtained through the above step 301, multiple candidate functions associated with the business analysis type can be queried in the function library.

[0110] Schematically, the above-mentioned associative storage of candidate functions and business analysis types means that when storing each candidate function in the function library, the business analysis type to which it belongs is used as the index, and the tuple consisting of the function identifier and function code of the candidate function is used as the index content. In this way, when querying the candidate function, the business analysis type obtained in the above step 301 can be used as the index to query multiple candidate functions corresponding to the index in the function library.

[0111] Schematically, the above-mentioned associative storage of candidate functions and business analysis types refers to building a function index table in the cache, which is used to indicate the mapping relationship between the function identifier of each function and the business analysis type. In this way, when querying candidate functions, multiple function identifiers that have a mapping relationship with the business analysis type are queried in the function index table. Then, each function identifier is used as an index to query the candidate function corresponding to the index in the function library. Repeat the above operation to obtain multiple candidate functions.

[0112] In some embodiments, regardless of whether the business analysis type or the function identifier is used as the index, a Key-Value (key-value pair) data structure of the index-index content can be constructed. For example, the business analysis type is used as the Key (key name) and the {function identifier, function code} tuple is used as the Value (key value) to construct a Key-Value data structure. For another example, the function identifier is used as the Key and the function code is used as the Value to construct a Key-Value data structure. In this way, multiple pairs of Key-Value data structures can be stored in a hash table to improve indexing efficiency.

[0113] 305. The server determines the data type of the field data associated with the filter word.

[0114] In some embodiments, the data type includes a variable type and a variable attribute. The variable type represents the type of the variable involved in the field data. For example, the variable type includes but is not limited to: integer, floating point, string, array, queue, stack, etc.; the variable attribute represents the type of variable to which the variable type belongs. For example, the variable attribute includes but is not limited to: timestamp, frequency, process number, duration, and identification symbols of various objects (such as page identifier, alarm type identifier, error type identifier, etc.). The embodiments of the present application do not specifically limit the variable type and variable attributes.

[0115] In some embodiments, after the server obtains the various field data associated with the filter word through filtering in step 303, for each field data, it can determine the variable type of the field data based on the attribute information of the field data itself. For example, assuming that the field data is a string, the variable type is a string. For example, assuming that the character data is an integer data, the variable type is an integer, etc.; then, based on the attribute information of the field to which the field data belongs, the variable attribute can be determined. For example, assuming that the field name of the field to which the field data belongs is "timestamp", the variable attribute is timestamp. For example, assuming that the field name of the field to which the field data belongs is "page stay time", the variable attribute is time length. The embodiment of the present application does not specifically limit the method of obtaining variable types and variable attributes.

[0116] 306. The server determines, from the multiple candidate functions, an analysis function whose parameter type of the input parameter matches the data type.

[0117] In some embodiments, when the variable type and variable attributes are determined, the server can first filter out at least one candidate function whose input parameters hit the variable attributes from the multiple candidate functions determined in the above step 304; then, filter out the analysis function whose parameter type of the input parameter is compatible with the variable type from the at least one candidate function.

[0118] In some embodiments, for each candidate function, since the input parameters of the candidate function are pre-defined, for example, a candidate function needs to input a timestamp of string type as an input parameter, at this time, it is equivalent to being able to determine a parameter type and parameter attribute for the input parameter, for example, the parameter type is a string, and the parameter attribute is a timestamp; then, by judging whether the parameter attribute of the input parameter is the same as the variable attribute of the field data determined in the above step 305, if the parameter attribute is the same as the variable attribute, it means that the input parameter hits the variable attribute, and the candidate function is usually put into the next judgment process; if the parameter attribute is different from the variable attribute, it means that the input parameter does not hit the variable attribute, then the candidate function is skipped and the above judgment operation is performed on the next candidate function, and the above judgment operation is repeated until all candidate functions determined in the above step 304 are traversed, and finally it can be determined whether the input parameter hits the variable attribute. One less candidate function; then, continue to determine whether the parameter type of the input parameter is compatible with the variable type of the field data determined in the above step 305. "Compatible" here means: the parameter type is the same as the variable type, or the parameter type and the variable type can be converted to each other. For example, if the parameter type and the variable type are both strings, it means that the parameter type is compatible with the variable type. For example, if the parameter type is integer and the variable type is floating-point, since integer data and floating-point data can be converted to each other, it also means that the parameter type is compatible with the variable type. At this time, for each candidate function in the at least one candidate function, if the parameter type is compatible with the variable type, the candidate function is determined as the analysis function required for this log analysis. If the parameter type is incompatible with the variable type, the candidate function is skipped and the above judgment operation is performed on the next candidate function. The above judgment operation is repeated until all candidate functions whose parameter attributes hit the variable attributes are traversed.

[0119] It should be noted that the number of analysis functions obtained through the above screening process may be one or more. Assuming that only one analysis function is screened, the one analysis function is put into the following steps 307-308 to obtain the business analysis results. Assuming that multiple analysis functions are screened, the server can provide the multiple analysis functions to the technical personnel, and the technical personnel can choose which analysis function to use this time, or the server can randomly select the analysis function to be used this time, or the server can execute the following steps 307-308 for each analysis function obtained through screening to obtain multiple business analysis results. The embodiment of the present application does not specifically limit this.

[0120] In some embodiments, the analysis function associated with the business analysis type can be obtained through the above steps 304-306. Optionally, the analysis function can be filtered using only the variable type, or only the variable attributes. The embodiment of the present application does not specifically limit the filtering method of the analysis function.

[0121] In the above process, by using variable types and variable attributes to jointly screen out analysis functions from candidate functions, it is possible to ensure that the parameter attributes of the input parameters of the analysis function are consistent with the variable attributes of the filtered field data, thereby avoiding errors in the analysis function due to inconsistencies between parameter attributes and variable attributes. In addition, it is also possible to ensure that the parameter types of the input parameters of the analysis function are compatible with the variable types of the filtered field data, thereby avoiding errors in the analysis function due to incompatibility between parameter types and variable types. Overall, when the technician has not specified an analysis function, the screening accuracy of the analysis function can be improved, and the error rate of the screened analysis function can be greatly reduced.

[0122] In some embodiments, when the analysis function to be used in this log analysis has been determined, the server also needs to obtain the function code of the analysis function. Optionally, if the function code of the analysis function has been cached, the server reads the function code from the cache; if the function code is not cached, the server obtains the function string of the analysis function and converts the function string into the function code.

[0123] Schematically, each analysis function is stored in the function library in the form of an Eval string. Assuming that the server has called the analysis function before, the function code converted from the Eval string will be cached in the cache. At this time, there is no need to perform the conversion operation again, and you only need to read the function code of the analysis function in the cache; assuming that the server has never called the analysis function, the function code will not be stored in the cache, and you need to call the Eval() method to convert the Eval string into function code, and store the function code in the cache for the next call.

[0124] In the above process, by storing the function code of the analysis function that has been called in the cache, it is convenient to reuse the analysis function later without converting the Eval string into the function code again, thereby improving the efficiency of obtaining the function code.

[0125] 307. The server uses the field data as an input parameter of an analysis sub-function in the analysis function, passes it into the analysis sub-function, runs the analysis sub-function with the input parameter passed in, and obtains the running result of the analysis sub-function.

[0126] In some embodiments, the analysis function includes an analysis sub-function and a chart sub-function as an example. The analysis sub-function is used to perform business analysis on the field data to output the operating results obtained by the analysis, and the chart sub-function is used to visualize the operating results output by the analysis sub-function in the form of a chart.

[0127] In some embodiments, when the analysis function includes an analysis sub-function and a chart sub-function, the above steps 304-306 only need to ensure that the parameter attributes of the input parameters of the analysis sub-function are consistent with the variable attributes of the field data, and ensure that the parameter type of the input parameters of the analysis sub-function is compatible with the variable type of the field data. Since the running results of the analysis sub-function will be input into the chart sub-function, when pre-defining the chart sub-function, the technician will ensure that when the running results are input as input parameters into the chart sub-function, no errors will occur due to mismatch of parameter attributes or parameter types.

[0128] In some embodiments, the server inputs the field as an input parameter and passes it into the analysis sub-function, which is equivalent to dynamically transmitting the input parameter. Then, the analysis sub-function with the input parameter passed in is run, and the running result of the analysis sub-function can be obtained, and the following step 308 is entered.

[0129] In the above process, by using the analysis sub-function to perform business analysis on the field data, different solutions can be customized for various situations through function logic. For example, suppose that during the business process analysis, the log timestamps of some process nodes are missing, or the log timestamps of some process nodes are missing. In this case, by configuring the function code of the analysis sub-function, the missing log timestamps can be automatically completed (or filled) by configuring the function code of the analysis sub-function, thereby enabling log time backtracking. This facilitates reverse analysis based on the backtracked logs, and combines methods such as finding the cause by the result to extract the business process displayed in the entire log. For example, suppose a business process includes four key process nodes A->B->C->D, but process node B has no log output when it runs successfully, and only logs when it fails. This will result in the log of process node B being missing. In this case, if you want to view the business process based on the existing logs, you can use the analysis sub-function to automatically fill in the log of process node B as running successfully. This can complete the complete business process, making it easier for subsequent technical personnel to adjust or optimize based on the complete business process.

[0130] Furthermore, when function calculation is supported, it is equivalent to adding a programmable function to the field data of the log, which can perform more flexible business logic processing on the field data, thereby supporting business programming capabilities for the field data. Technical personnel use some script functions as analysis functions to solidify the analysis logic of the field data of the log into function code for calculation. Taking the analysis function as a JS (JavaScript, a scripting language) script as an example, by providing a JS dynamic and closed operating environment for the field data, when executing function calculation based on the JS script, the output method of the business analysis results can be controlled through the logic of the chart sub-function in the following step 308. In addition to directly printing data and displaying data in charts, a business analysis report for the log can also be generated.

[0131] 308. The server transfers the running result to the chart sub-function in the analysis function, draws an analysis chart of the running result through the chart sub-function, and outputs the analysis chart as a business analysis result.

[0132] In some embodiments, the server passes the running result obtained in the above step 307 as an input parameter into the chart sub-function, which is equivalent to dynamically transmitting the input parameter, and then runs the chart sub-function to obtain an analysis chart of the running result, so as to visualize or display the analysis chart as a business analysis result.

[0133] Optionally, the above-mentioned analysis charts include but are not limited to: data tables, bar charts, pie charts, sector charts, line charts, scatter charts, etc. The embodiment of the present application does not specifically limit the display method of the analysis charts.

[0134] In the above process, the running result of the analysis sub-function is charted by the chart sub-function, so that the running result can be visually displayed in the form of a chart. Thus, regardless of the type of business scenario or the type of business analysis, the business analysis result can be visually displayed in a universal and platformized manner, thereby providing a universal and sustainable iterative log analysis scheme. In addition, since the running result obtained by analyzing the log can be converted into a more easily understood data display form, the running result is equivalent to being cleaned into charted data. Charted data is simpler and more intuitive to understand, and can intuitively show the trend of the running result.

[0135] Further, since the analysis function can be customized by a technician according to different business analysis requirements, the logical analysis business process can be realized by a customized scheme, which facilitates the definition of BUGs that occur in any business process and the troubleshooting of exceptions. In addition, since the technician can control which analysis function to use to process the filtered field data through function programming, the input parameters, running result, and display form of the running result of the analysis function are highly controllable, making the log analysis process programmable without manual positioning of BUGs or troubleshooting of exceptions. Moreover, by solidifying the business analysis logic through code, a log expert system can be constructed, making the analysis of problems more professional.

[0136] In some embodiments, assuming that the running result is a series of business analysis data that changes over time, the business analysis result includes at least one of: business analysis data obtained by analyzing the field data based on the analysis function, in which case the business analysis data can be directly printed as the running result of the analysis sub-function without using the chart sub-function to arrange the business analysis data into an analysis chart. That is, the analysis function only includes the analysis sub-function and does not include the chart sub-function; or a trend curve of the business analysis data plotted in a chart manner over the log timestamp, in which case the chart sub-function is needed to arrange the business analysis data into a trend curve over the log timestamp in the analysis chart; or a business analysis report obtained based on the trend curve analysis, that is, based on the arrangement of the business analysis data into a trend curve over the log timestamp in the analysis chart by using the chart sub-function, the trend curve in the analysis chart is further analyzed to obtain a business analysis report, and the business analysis report is output. For example, the analysis of the trend curve includes: average, median, peak, minimum, variance, standard deviation, fitting of a specified curve, etc. The embodiments of the present application do not make specific limitations thereto.

[0137] Figure 4 is a schematic diagram of an analysis chart provided by an embodiment of the present application, as Figure 4As shown, assuming that the business analysis data is the layout parsing time, the layout parsing time is represented by the parameter "inflate". The meaning of the layout parsing time refers to the time it takes for the terminal to parse the layout of the web page (or application interface) in the process of providing business services. The longer the layout parsing time, the more stuck and unsmooth the page refresh. The layout parsing time is an important analysis method for using logs to locate abnormalities. After obtaining the inflate parameter value for each log timestamp through the analysis sub-function, the chart sub-function can plot the trend curve of the inflate parameter as the log timestamp changes in the analysis chart 400. It can be seen that the horizontal axis in the analysis chart 400 is the log timestamp and the vertical axis is the inflate parameter value. The analysis chart 400 can clearly see which log timestamp has the largest inflate parameter value, which means that the page accessed at this log timestamp is the most stuck, so that the cause of the page stuck can be located by checking the layout file of the page.

[0138] In the above steps 307-308, a possible implementation method is provided for performing business analysis on the field data based on the analysis function and outputting the business analysis results of the log. In another embodiment, the business analysis results can also be obtained and output through the description in step 204 in the previous embodiment. This embodiment of the present application does not specifically limit this.

[0139] Figure 5 This is a principle flow chart of a log processing method provided by an embodiment of the present application, such as Figure 5As shown, in the overall log analysis process, the following steps are involved: Step 501, analyze the log line by line; Step 502, filter the key information by regular expression, that is, filter the field data associated with the filter word by regular matching; Step 503, detect whether there is a matching analysis function that can participate in the function calculation; Step 504, determine whether the analysis function can be queried in the cache, if not, the analysis function is not queried in the cache, go to step 505, if yes, the analysis function is queried in the cache, go to step 507; Step 505, query the Eval string of the analysis function from the function library, go to step 506; Step 506, convert the Eval string into function code and write it into the cache, that is, convert the Eval string into function code. The Function function is written into the Cache and the process goes to step 507; in step 507, the Function function is executed by dynamically passing in data, that is, the field data is passed as input parameters to the analysis function and the analysis function is run; in step 508, the running result of the analysis function is output, which includes several different output methods, such as directly outputting the running result in the form of data, or converting the running result into an analysis chart and then outputting it in the form of a chart, or further obtaining the business processing result for the analysis chart and then outputting it in the form of a business analysis report. The above-mentioned final output data, chart or report is the final business analysis result. Optionally, the business analysis result obtained this time can also be cached for subsequent access when performing abnormality troubleshooting.

[0140] Figure 6 This is a schematic diagram showing a business analysis result provided by an embodiment of the present application. Figure 6 As shown, in the display interface 600 of the business analysis results, business analysis data 601 output in data form is displayed. The business analysis data 601 is sorted in ascending order according to the log timestamp. The business analysis data 601 is used as an example to illustrate the inflation cost, i.e., the layout parsing time. In addition, an analysis chart 602 drawn for the business analysis data 601 is displayed in the display interface 600. The trend curve of the business analysis data 601 changing with the log timestamp can be seen in the analysis chart 602, so that the process of how the inflation cost parameter changes with the log timestamp can be visualized. By providing multiple display methods for the business analysis data 601, the flexibility and intelligence of the display process of the business analysis data 601 can be improved.

[0141] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present disclosure, and will not be described in detail here.

[0142] The method provided in the embodiment of the present application obtains the field data targeted by this log analysis by filtering the log to be analyzed using filter words, and then automatically performs business analysis on the filtered field data in a function calculation manner through an analysis function associated with the business analysis type, and outputs the final business analysis result. Therefore, as long as the analysis function is configured, the analysis function can be introduced to implement business analysis by the machine without the need for manual participation in the log analysis process to troubleshoot business problems, thereby improving the processing efficiency of the log analysis process and being able to organically combine log analysis with the anomaly location and troubleshooting tasks of business logic.

[0143] In the above embodiment, how to use the analysis function pre-defined by the technician to obtain and output the business analysis results of the log is introduced in detail. The following will introduce how to configure the business scenario type, business analysis type, filter words and analysis function.

[0144] In some embodiments, the server provides a scene parameter configuration interface for log analysis to the technician. Optionally, the server displays the scene parameter configuration interface, or the server provides display resources of the scene parameter configuration interface to the terminal. This embodiment of the present application does not specifically limit this.

[0145] Taking the server displaying the scenario parameter configuration interface as an example, optionally, the scenario parameter configuration interface is used to edit at least one of the business scenario type, the business analysis type, the filter word or the analysis function. For example, the scenario parameter configuration interface includes configuration options for the business scenario type, configuration options for the business analysis type, an edit box for the filter word, and an edit box for the analysis function. In this way, technicians can edit the filter word and analysis function under any business scenario type and any business analysis type to achieve personalized configuration of the analysis function.

[0146] Figure 7 This is a schematic diagram of a scene parameter configuration interface provided by an embodiment of the present application. Figure 7As shown, the scenario parameter configuration interface 700 includes configuration options 701-704 for business scenario types, a configuration option 705 for business analysis types, edit boxes 706-707 for filter words, and an edit box 708 for analysis functions. Among them, configuration option 701 is used to configure the application label and business label of the business scenario type. For example, configuration option 701 currently has "Application A Basic Business (Android)" selected, which means that the application label is Application A and the business label is Android (Android) basic business; configuration option 702 is used to configure the process type to be analyzed under the business scenario type. For example, configuration option 702 currently has "Timeline" selected, which means that a timeline analysis is to be performed on the Android basic business of application A; configuration option 703 is used to configure the scenario name of this analysis. For example, configuration option 703 currently has "Process Number Switching" selected, which means that the process number switching situation is to be analyzed for the Android basic business of application A when the process type is timeline; configuration option 704 is used to configure the scenario description information added to the scenario name set for configuration option 703 this time. For example, configuration option 704 currently has "Null" selected, which means that no scenario description information has been added. The user can enter the corresponding scenario description information in the text input box provided by configuration option 704. Configuration option 705 is used to configure the business analysis type for this analysis. Optionally, business analysis types include: Info, Core, Warn, Error, Fatal, charts, etc. For example, "Error" is currently selected in configuration option 705, indicating that the error situation will be analyzed for the process ID switching scenario. By detecting when the application process ID switches, it can be determined when the application represented by the log crashes and restarts. Edit box 706 is used to edit the filter words for this analysis. For example, the filter words " / (?<$1>\d*)27604(?<$2>\S*) / " have been configured in edit box 706. Edit box 707 is used to edit the filter word description information for this analysis. For example, the filter word description information "[Local] Application restart, process ID switch: $1" has been configured in edit box 707. Among them, the editing box 708 is used to edit the analysis function used in this analysis. For example, by judging whether the process number of the current log is consistent with the process number of the previous log, if the process numbers are consistent, it is considered that the application is controlled by the same process (no flash back occurs), and the log is not printed as output. If the process numbers are inconsistent, it is considered that the application is taken over by different processes (indicating that it has been restarted after a flash back occurs), and the ID content after the process switch is output by default, that is, the process number after the restart is printed by default. The function code of the following analysis function can be configured for the above judgment logic:

[0147]

[0148] Furthermore, an edit box 709 for verification data can be provided in the scene parameter configuration interface 700. The edit box 709 is used to configure the verification data for this analysis function. This makes it convenient to test whether there is a bug in the function code of the analysis function entered this time by giving a part of the verification data as a test log. For example, the verification data "27491 27604D" is entered in the edit box 709. After that, the technician clicks "Data Test" to test the analysis function to test whether the process number switch occurs for the verification data "27491 27604D". The technician can decide whether to debug the function code of the analysis function or save the function code of the analysis function to the function library for subsequent calls based on the test results.

[0149] In some embodiments, after the technician performs an editing operation on any editing object in the scenario parameter configuration interface, the server responds to the editing operation triggered based on the scenario parameter configuration interface and assigns the information input in the editing operation to the editing object targeted by the editing operation, wherein the editing object is at least one of the business scenario type, the business analysis type, the filter word, or the analysis function.

[0150] For example, based on Figure 7 For example, a technician can perform an editing operation based on the configuration options 701-704 of the business scenario type to update the application tag, business tag, process type, scenario name or scenario description information of the business scenario type, or perform an editing operation based on the configuration option 705 of the business analysis type to update the business analysis type, or perform an editing operation based on the edit boxes 706-707 of the filter words to update the filter words or the filter word description information, or perform an editing operation based on the edit box 708 of the analysis function to update the function code of the analysis function, or perform an editing operation based on the edit box 709 of the verification data to update the verification data of the analysis function, etc. The embodiments of the present application do not specifically limit this.

[0151] In some embodiments, when the scenario parameter configuration interface supports editing the analysis function, the server can also display the application programming interface API supported by the analysis function and the description information of the API in the area used to edit the analysis function in the scenario parameter configuration interface, so as to conveniently and intuitively prompt technicians which APIs can be used in the process of configuring the function code of the analysis function, and what functions or roles these APIs have, thereby improving the configuration efficiency of the analysis function.

[0152] Figure 8 This is a schematic diagram of a scene parameter configuration interface provided by an embodiment of the present application. Figure 8As shown, the scenario parameter configuration interface 800 displays a business scenario type configuration option 801 and a business analysis type configuration option 802. For example, the business scenario type configuration option 801 currently has "Inflate Time Analysis (Basic)" selected, indicating that the inflate layout time consumption will be analyzed for the basic business of the current application. For example, the business analysis type configuration option 802 currently has "Info" selected, indicating that the business analysis will be performed based on the filtered layout time consumption information. In addition, the scenario parameter configuration interface 800 also displays a filter word edit box 803 and a filter word description information edit box 804. For example, the filter word edit box 803 has the filter word " / inflate cost:(?<$1>\d*) / " entered. For example, the filter word description information "inflate cost:$1" has been entered in the filter word description information edit box 804, which defines the variable $1 to represent the inflate layout time consumption. For example, filtering the verification data "inflate cost:2" will result in variable $1 being equal to 2.

[0153] Furthermore, an analysis function edit box 805 is also displayed in the scenario parameter configuration interface 800. Assuming that the technician has not yet entered any function code of the analysis function, the API and API description information 8051 are displayed in the analysis function edit box 805. For example, the API and API description information 8051 are as follows:

[0154] / **

[0155] Function Compute, system parameter description.

[0156] $1, $2... / / are the regular filter matching variables declared in the filter word. The variable value is a string by default. If you determine that the variable is a numeric type, you can use the +$1 method to automatically escape it into a numeric type for comparison.

[0157] $hidden=false, / / You can hide this line of matching information.

[0158] $color = "#ff0000", / / Set the color of the regular expression matching word.

[0159] $global = {} / / Global object during scene search, the declaration period is valid for the current text search process.

[0160] $line / / Text content analyzed line by line.

[0161] $comment / / Add a description when the mouse hovers

[0162] $type / / change filter type, support value "info" "core" "warn" "error" "fatal"

[0163] window = {} / / system global object, permanent effective.

[0164] lineChart(title, label, value, priority, gradient) / / chart display, title chart title, label chart inside label type, value chart value, priority (optional): priority sorting, from large to small sorting, gradient (optional): whether to open gradient support (true / false) support: barChart column chart, pointChart point chart

[0165] * /

[0166] Schematically, each variable $1 filtered is written into the chart function lineChart("layout analysis time-consuming analysis", "inflate", $1);, so that a visual data chart can be output (for example Figure 4 ).

[0167] As can be seen, under the prompting of the API and the description information 8051 of the API, it is greatly convenient for the technical personnel to write the function code of the analysis function, supports the technical personnel to use the built-in code and data to build the analysis function, and provides a lightweight dynamic independent JS running environment, and some system data necessary for function calculation and analysis can also be provided in the JS running environment, so that the technical personnel can easily write the logic flow of business analysis into the function code, and put these function codes into the log real-time analysis process.

[0168] In the embodiment of the present application, when configuring the related information of log analysis, the function code of the analysis function is added, so that the automatic business analysis capability based on the analysis function can be provided through the log analysis platform, and when entering the function code of the analysis function, some verification data is input to test whether the analysis function is error, so as to reduce the debugging cost of the analysis function and improve the human-computer interaction efficiency.

[0169] Figure 9 is a structural schematic diagram of a log processing device provided by an embodiment of the present application, please refer to Figure 9 , the device comprises:

[0170] Determination module 901, for determining the business scenario type and business analysis type of the log analysis, wherein the business scenario type represents the business scenario targeted by the log analysis, and the business analysis type represents the analysis type of the field data targeted by the log analysis;

[0171] An acquisition module 902 is configured to acquire a filter word associated with the business scenario type and an analysis function associated with the business analysis type;

[0172] The filtering module 903 is used to filter the log to be analyzed to obtain the field data associated with the filtering word;

[0173] The analysis output module 904 is used to perform business analysis on the field data based on the analysis function and output the business analysis results of the log.

[0174] The device provided in the embodiment of the present application obtains the field data targeted by this log analysis by filtering the log to be analyzed using filter words, and then automatically performs business analysis on the filtered field data in a function calculation manner through an analysis function associated with the business analysis type, and outputs the final business analysis result. Therefore, as long as the analysis function is configured, the analysis function can be introduced to implement business analysis by the machine without the need for human participation in the log analysis process to troubleshoot business problems, thereby improving the processing efficiency of the log analysis process and being able to organically combine log analysis with the anomaly location and troubleshooting tasks of business logic.

[0175] In one possible implementation, based on Figure 9 The acquisition module 902 includes:

[0176] A first determining unit, configured to determine a plurality of candidate functions associated with the business analysis type;

[0177] a second determining unit, configured to determine a data type of the field data associated with the filter word;

[0178] The third determining unit is configured to determine, from the plurality of candidate functions, an analysis function whose parameter type of an input parameter matches the data type.

[0179] In a possible implementation, the data type includes a variable type and a variable attribute, wherein the variable type represents the type of the variable involved in the field data, and the variable attribute represents the type of variable to which the variable type belongs;

[0180] The third determining unit is configured to:

[0181] Screening and obtaining, from the multiple candidate functions, at least one candidate function whose input parameter matches the variable attribute;

[0182] From the at least one candidate function, an analysis function whose parameter type is compatible with the variable type is obtained by screening.

[0183] In one possible implementation, the analysis function includes an analysis sub-function and a chart sub-function;

[0184] The analysis output module 904 is used to:

[0185] The field data is used as an input parameter of the analysis sub-function, passed into the analysis sub-function, and the analysis sub-function having the input parameter passed into it is run to obtain the running result of the analysis sub-function;

[0186] The operation result is passed into the chart sub-function, an analysis chart of the operation result is drawn by the chart sub-function, and the analysis chart is output as the business analysis result.

[0187] In one possible implementation, based on Figure 9 The device is composed of:

[0188] A reading module, configured to read the function code of the analysis function from the cache if the function code of the analysis function has been cached;

[0189] The conversion module is used to obtain the function string of the analysis function when the function code is not cached, and convert the function string into the function code.

[0190] In one possible implementation, the business analysis result includes at least one of the following: business analysis data obtained by analyzing the field data based on the analysis function; or, a trend curve of the business analysis data plotted in a graphical form as the log timestamp changes; or, a business analysis report obtained based on the analysis of the trend curve.

[0191] In one possible implementation, based on Figure 9 The device is composed of:

[0192] A display module, configured to display a scenario parameter configuration interface for log analysis, wherein the scenario parameter configuration interface is used to edit at least one of the business scenario type, the business analysis type, the filter word, or the analysis function;

[0193] An assignment module is used to respond to an editing operation triggered based on the scenario parameter configuration interface, and assign the information input by the editing operation to the editing object targeted by the editing operation, where the editing object is at least one of the business scenario type, the business analysis type, the filter word or the analysis function.

[0194] In a possible implementation manner, when the scene parameter configuration interface supports editing the analysis function, the display module is further configured to:

[0195] In the area for editing the analysis function in the scene parameter configuration interface, the application programming interface API supported by the analysis function and the description information of the API are displayed.

[0196] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present disclosure, and will not be described in detail here.

[0197] It should be noted that the log processing device provided in the above embodiment is merely an example of the division of the functional modules described above when processing logs. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device can be divided into different functional modules to complete all or part of the functions described above. In addition, the log processing device provided in the above embodiment and the log processing method embodiment are based on the same concept. The specific implementation process is detailed in the log processing method embodiment and will not be repeated here.

[0198] Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. Figure 10 As shown, a computer device is used as terminal 1000 for the purpose of illustration. Optionally, the device types of terminal 1000 include: a smartphone, a tablet computer, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 player (Moving Picture Experts Group Audio Layer IV), a laptop computer, or a desktop computer. Terminal 1000 may also be referred to as user equipment, a portable terminal, a laptop terminal, a desktop terminal, or other names.

[0199] Typically, the terminal 1000 includes a processor 1001 and a memory 1002 .

[0200] Optionally, the processor 1001 includes one or more processing cores, such as a 4-core processor, an 8-core processor, etc. Optionally, the processor 1001 is implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), or PLA (Programmable Logic Array). In some embodiments, the processor 1001 includes a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 1001 is integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1001 also includes an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0201] In some embodiments, the memory 1002 includes one or more computer-readable storage media, optionally, the computer-readable storage medium is non-transitory. Optionally, the memory 1002 also includes a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 1002 is used to store at least one program code, and the at least one program code is used to be executed by the processor 1001 to implement the log processing method provided in each embodiment of the present application.

[0202] In some embodiments, terminal 1000 may also optionally include a peripheral device interface 1003 and at least one peripheral device. Processor 1001, memory 1002, and peripheral device interface 1003 may be connected via a bus or signal lines. Each peripheral device may be connected to peripheral device interface 1003 via a bus, signal lines, or circuit boards. Specifically, the peripheral device may include at least one of a radio frequency circuit 1004, a display screen 1005, a camera assembly 1006, an audio circuit 1007, and a power supply 1008.

[0203] The peripheral device interface 1003 can be used to connect at least one I / O (Input / Output)-related peripheral device to the processor 1001 and the memory 1002. In some embodiments, the processor 1001, the memory 1002, and the peripheral device interface 1003 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 1001, the memory 1002, and the peripheral device interface 1003 are implemented on separate chips or circuit boards, which is not limited in this embodiment.

[0204] The RF circuit 1004 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The RF circuit 1004 communicates with communication networks and other communication devices via electromagnetic signals. The RF circuit 1004 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals into electrical signals. Optionally, the RF circuit 1004 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, and the like. Optionally, the RF circuit 1004 communicates with other terminals via at least one wireless communication protocol. Such wireless communication protocols include, but are not limited to, metropolitan area networks, various generations of mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks, and / or WiFi (Wireless Fidelity) networks. In some embodiments, the RF circuit 1004 also includes circuitry related to NFC (Near Field Communication), which is not limited in this application.

[0205] The display screen 1005 is used to display a UI (User Interface). Optionally, the UI includes graphics, text, icons, videos, and any combination thereof. When the display screen 1005 is a touch screen display, the display screen 1005 also has the ability to collect touch signals on the surface or above the surface of the display screen 1005. The touch signal can be input as a control signal to the processor 1001 for processing. Optionally, the display screen 1005 is also used to provide virtual buttons and / or virtual keyboards, also known as soft buttons and / or soft keyboards. In some embodiments, there is one display screen 1005, which is set on the front panel of the terminal 1000; in other embodiments, there are at least two display screens 1005, which are respectively set on different surfaces of the terminal 1000 or in a folding design; in still other embodiments, the display screen 1005 is a flexible display screen, which is set on the curved surface or folding surface of the terminal 1000. Even, optionally, the display screen 1005 is set into a non-rectangular irregular shape, that is, a special-shaped screen. Optionally, the display screen 1005 is made of materials such as LCD (Liquid Crystal Display) and OLED (Organic Light-Emitting Diode).

[0206] The camera assembly 1006 is used to capture images or videos. Optionally, the camera assembly 1006 includes a front camera and a rear camera. Typically, the front camera is arranged on the front panel of the terminal, and the rear camera is arranged on the back of the terminal. In some embodiments, there are at least two rear cameras, which are any one of a main camera, a depth of field camera, a wide-angle camera, and a telephoto camera, so as to realize the fusion of the main camera and the depth of field camera to realize the background blur function, the fusion of the main camera and the wide-angle camera to realize panoramic shooting and VR (Virtual Reality) shooting function or other fusion shooting functions. In some embodiments, the camera assembly 1006 also includes a flash. Optionally, the flash is a monochrome temperature flash, or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cold light flash, which is used for light compensation at different color temperatures.

[0207] In some embodiments, the audio circuit 1007 includes a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals to be input into the processor 1001 for processing, or input into the radio frequency circuit 1004 to achieve voice communication. For the purpose of stereo sound collection or noise reduction, there are multiple microphones, which are respectively arranged in different parts of the terminal 1000. Optionally, the microphone is an array microphone or an omnidirectional collection microphone. The speaker is used to convert the electrical signal from the processor 1001 or the radio frequency circuit 1004 into sound waves. Optionally, the speaker is a traditional thin film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert the electrical signal into sound waves audible to humans, but also convert the electrical signal into sound waves inaudible to humans for purposes such as ranging. In some embodiments, the audio circuit 1007 also includes a headphone jack.

[0208] Power supply 1008 is used to power various components in terminal 1000. Optionally, power supply 1008 is AC power, DC power, a disposable battery, or a rechargeable battery. When power supply 1008 includes a rechargeable battery, the rechargeable battery supports wired charging or wireless charging. The rechargeable battery is also configured to support fast charging technology.

[0209] Those skilled in the art will understand that Figure 10 The structure shown in the figure does not constitute a limitation on the terminal 1000, and the terminal 1000 can include more or fewer components than shown in the figure, or combine certain components, or adopt a different component arrangement.

[0210] Figure 11 This is a structural diagram of a computer device provided in an embodiment of the present application. The computer device 1100 may have relatively large differences due to different configurations or performances. The computer device 1100 includes one or more processors (Central Processing Units, CPU) 1101 and one or more memories 1102, wherein the memory 1102 stores at least one computer program, and the at least one computer program is loaded and executed by the one or more processors 1101 to implement the log processing methods provided in the above-mentioned embodiments. Optionally, the computer device 1100 also has components such as a wired or wireless network interface, a keyboard, and an input and output interface for input and output. The computer device 1100 also includes other components for realizing device functions, which will not be described in detail here.

[0211] In an exemplary embodiment, a computer-readable storage medium is also provided, such as a memory including at least one computer program. The at least one computer program can be executed by a processor in a terminal to implement the log processing method in each of the above embodiments. For example, the computer-readable storage medium includes ROM (Read-Only Memory), RAM (Random-Access Memory), CD-ROM (Compact Disc Read-Only Memory), magnetic tape, floppy disk, and optical data storage device.

[0212] In an exemplary embodiment, a computer program product or computer program is also provided, including one or more program codes stored in a computer-readable storage medium. One or more processors of a computer device can read the one or more program codes from the computer-readable storage medium and execute the one or more program codes, thereby enabling the computer device to perform the log processing method of the above embodiment.

[0213] Those skilled in the art will understand that all or part of the steps to implement the above embodiments can be completed by hardware, or can be completed by instructing relevant hardware through a program. Optionally, the program is stored in a computer-readable storage medium. Optionally, the above-mentioned storage medium is a read-only memory, a disk or an optical disk, etc.

[0214] The above description is merely an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A log processing method, characterized in that: The method comprises: Determine a business scenario type and a business analysis type for log analysis, wherein the business scenario type represents the business scenario targeted by the log analysis, and the business analysis type represents the analysis type to which the field data targeted by the log analysis belongs; Obtaining a filter word associated with the business scenario type; and determining a plurality of candidate functions associated with the business analysis type; determining a data type of field data associated with the filter word; and determining, from the plurality of candidate functions, an analysis function whose parameter type of an input parameter matches the data type; Filtering the log to be analyzed to obtain field data associated with the filter word; The analysis function includes an analysis sub-function and a chart sub-function; based on the analysis sub-function, a business analysis is performed on the field data to obtain the running result of the analysis sub-function, and the running result is a string of business analysis data that changes with the timestamp; based on the chart sub-function, an analysis chart of the running result is drawn, and the analysis chart includes a trend curve of the business analysis data changing with the log timestamp; based on the analysis chart, the business analysis result of the log is output; the business analysis result includes at least one of the following: the change trend curve and the business analysis report obtained by analyzing the change trend curve, and the business analysis result has at least one of the following functions: assisting in locating possible problems in the business process, troubleshooting various anomalies in the application, and assisting in testing the business effects of the new version or new function of the application.

2. The method according to claim 1, characterized in that The data type includes a variable type and a variable attribute, wherein the variable type represents the type of the variable involved in the field data, and the variable attribute represents the type of variable to which the variable type belongs; Determining, from the plurality of candidate functions, an analysis function whose parameter type of an input parameter matches the data type comprises: Screening and obtaining, from the multiple candidate functions, at least one candidate function whose input parameter matches the variable attribute; An analysis function whose parameter type is compatible with the variable type is screened out from the at least one candidate function.

3. The method according to claim 1, characterized in that The performing of business analysis on the field data based on the analysis sub-function to obtain the running result of the analysis sub-function includes: The field data is used as an input parameter of the analysis sub-function, passed into the analysis sub-function, and the analysis sub-function having the input parameter passed into it is run to obtain the running result of the analysis sub-function; Drawing an analysis chart of the operation result based on the chart sub-function includes: The operation result is passed into the chart sub-function, and an analysis chart of the operation result is drawn by the chart sub-function.

4. The method according to claim 3, characterized in that The method further comprises: In a case where the function code of the analysis function has been cached, reading the function code from the cache; If the function code is not cached, a function string of the analysis function is obtained, and the function string is converted into the function code.

5. The method according to claim 1, wherein The business analysis result also includes business analysis data obtained by analyzing the field data based on the analysis function.

6. The method according to claim 1, characterized in that The method further comprises: Displaying a scenario parameter configuration interface for log analysis, wherein the scenario parameter configuration interface is used to edit at least one of the business scenario type, the business analysis type, the filter word, or the analysis function; In response to an editing operation triggered based on the scenario parameter configuration interface, the information input by the editing operation is assigned to the editing object targeted by the editing operation, and the editing object is at least one of the business scenario type, the business analysis type, the filter word or the analysis function.

7. The method according to claim 6, characterized in that In a case where the scene parameter configuration interface supports editing the analysis function, the method further includes: In the area for editing the analysis function in the scene parameter configuration interface, the application programming interface API supported by the analysis function and the description information of the API are displayed.

8. A log processing device, characterized in that: The device comprises: A determination module, configured to determine a business scenario type and a business analysis type for log analysis, wherein the business scenario type represents the business scenario targeted by the log analysis, and the business analysis type represents the analysis category to which the field data targeted by the log analysis belongs; an acquisition module, configured to acquire a filter word associated with the business scenario type; and The acquisition module includes a first determination unit, a second determination unit and a third determination unit; The first determining unit is configured to determine a plurality of candidate functions associated with the business analysis type; The second determining unit is configured to determine a data type of the field data associated with the filter word; The third determining unit is configured to determine, from the plurality of candidate functions, an analysis function whose parameter type of an input parameter matches the data type; A filtering module, configured to filter the log to be analyzed and obtain field data associated with the filtering word; The analysis function includes an analysis sub-function and a chart sub-function; an analysis output module is used to perform business analysis on the field data based on the analysis sub-function to obtain the running result of the analysis sub-function, and the running result is a string of business analysis data that changes with the timestamp; based on the chart sub-function, an analysis chart of the running result is drawn, and the analysis chart includes a trend curve of the business analysis data changing with the log timestamp; based on the analysis chart, the business analysis result of the log is output; the business analysis result includes at least one of the following: the change trend curve and the business analysis report obtained by analyzing the change trend curve, and the business analysis result has at least one of the following functions: assisting in locating possible problems in the business process, troubleshooting various anomalies in the application, and assisting in testing the business effects of the new version or new function of the application.

9. The device according to claim 8, characterized in that The data type includes a variable type and a variable attribute, wherein the variable type represents the type of the variable involved in the field data, and the variable attribute represents the type of variable to which the variable type belongs; The third determining unit is configured to: Screening and obtaining, from the multiple candidate functions, at least one candidate function whose input parameter matches the variable attribute; An analysis function whose parameter type is compatible with the variable type is screened out from the at least one candidate function.

10. The device according to claim 8, characterized in that The analysis output module is used to: The field data is used as an input parameter of the analysis sub-function, passed into the analysis sub-function, and the analysis sub-function having the input parameter passed into it is run to obtain the running result of the analysis sub-function; The operation result is passed into the chart sub-function, and an analysis chart of the operation result is drawn by the chart sub-function.

11. The device according to claim 10, characterized in that The device further comprises: a reading module, configured to read the function code of the analysis function from a cache if the function code of the analysis function has been cached; The conversion module is used to obtain the function string of the analysis function when the function code is not cached, and convert the function string into the function code.

12. The device according to claim 8, characterized in that The business analysis result also includes business analysis data obtained by analyzing the field data based on the analysis function.

13. The device according to claim 8, characterized in that The device further comprises: A display module, configured to display a scenario parameter configuration interface for log analysis, wherein the scenario parameter configuration interface is used to edit at least one of the business scenario type, the business analysis type, the filter word, or the analysis function; An assignment module is used to assign the information input by the editing operation to the editing object targeted by the editing operation in response to an editing operation triggered based on the scenario parameter configuration interface, where the editing object is at least one of the business scenario type, the business analysis type, the filter word or the analysis function.

14. The device according to claim 13, characterized in that In the case where the scene parameter configuration interface supports editing the analysis function, the display module is further configured to: In the area for editing the analysis function in the scene parameter configuration interface, the application programming interface API supported by the analysis function and the description information of the API are displayed.

15. A computer device, characterized in that: The computer device includes one or more processors and one or more memories, wherein at least one computer program is stored in the one or more memories, and the at least one computer program is loaded and executed by the one or more processors to implement the log processing method according to any one of claims 1 to 7.

16. A storage medium, characterized in that The storage medium stores at least one computer program, and the at least one computer program is loaded and executed by the processor to implement the log processing method according to any one of claims 1 to 7.

17. A computer program product, characterized in that The computer program product includes one or more program codes, which are stored in a computer-readable storage medium. One or more processors of a computer device can read the one or more program codes from the computer-readable storage medium, and the one or more processors execute the one or more program codes, so that the computer device can execute the log processing method according to any one of claims 1 to 7.

Images