Log processing methods, devices, computer equipment, and storage media

Abstract

This application, belonging to the field of big data, relates to a log processing method, including: receiving a log query request input by a user; extracting log query keywords from the log query request and obtaining logs corresponding to the log query keywords; parsing the logs to obtain log identification information; obtaining log call information based on the identification information; sorting the logs according to the call information to obtain sorted target logs; and displaying the target logs on a preset page canvas. This application also provides a log processing device, a computer device, and a storage medium. Furthermore, this application relates to blockchain technology, whereby the target logs can be stored in the blockchain. This application can graphically display the hierarchical relationship of the log call chain, enabling rapid, accurate, and efficient troubleshooting of log call chain issues, effectively improving the operational efficiency of log data processing.

Description

Technical Field

[0001] This application relates to the field of big data technology, and in particular to log processing methods, apparatus, computer equipment and storage media. Background Technology

[0002] As business requirements become increasingly complex, large business systems must be broken down into various modules according to business functions. These modules are then dynamically combined to ultimately provide rich business functionalities while improving system flexibility and scalability. With the rise of microservice architecture and container technology in computer software, microservice architecture is becoming increasingly popular. The core solution of microservice architecture is to break down traditional, large, highly complex, monolithic application systems into different modules according to certain rules, and then distribute these different patterns across a massive number of instances.

[0003] In traditional architectures, operations and maintenance (O&M) personnel only need to log into a small number of machines and use their personal experience to quickly locate anomalies in the logs when troubleshooting problems in business systems. However, this approach is no longer suitable for microservice architectures. Using this log processing method for anomaly localization requires a significant amount of human resources, and O&M personnel cannot quickly filter out anomaly logs from a massive number of instances, resulting in low efficiency in log processing O&M work. Summary of the Invention

[0004] The purpose of this application is to provide a log processing method, apparatus, computer device, and storage medium to solve the technical problem that using existing log processing methods for log anomaly localization requires a large amount of human resources and results in low efficiency of log processing operation and maintenance.

[0005] To address the aforementioned technical problems, this application provides a log processing method, employing the following technical solution:

[0006] Receive a log query request input by the user; wherein the log query request carries log query keywords;

[0007] Extract the log query keywords from the log query request and obtain the logs corresponding to the log query keywords;

[0008] The log is parsed to obtain the log's identification information;

[0009] Based on the identification information, obtain the link call information of the log;

[0010] The logs are sorted according to the link call information to obtain the sorted target logs;

[0011] The target log is displayed on a preset page canvas.

[0012] Furthermore, the step of obtaining the logs corresponding to the log query keywords specifically includes:

[0013] Call the preset log query server;

[0014] The log query keywords are sent to the log storage server, and the log query server retrieves the logs corresponding to the log query keywords.

[0015] Receive the logs returned by the log query server.

[0016] Furthermore, after the step of sorting the logs according to the link call information to obtain the sorted target logs, the method further includes:

[0017] Get the remaining available capacity locally, and get the capacity occupied by the target log;

[0018] Calculate the difference between the remaining available capacity and the occupied capacity, and determine whether the difference is greater than a preset value;

[0019] If the value is greater than the preset value, the target log will be stored locally.

[0020] If the value is not greater than the preset value, the target log will be stored in the preset storage block.

[0021] Furthermore, the step of storing the target log in a preset storage block specifically includes:

[0022] Access storage blocks built on blockchain technology;

[0023] The target log is converted into blockchain ledger data;

[0024] The ledger data is stored in the storage block.

[0025] Furthermore, after the step of storing the target log locally, the method further includes:

[0026] Determine whether the target log meets the preset cleanup conditions;

[0027] If the cleanup conditions are met, obtain the current time;

[0028] Determine whether the current time is within a preset business idle time period;

[0029] If the target log is within the business's idle period, delete it from the local machine.

[0030] Furthermore, before the step of determining whether the current time is within a preset idle service period, the method further includes:

[0031] The resource usage within a specified time period of the first preset time cycle is obtained through a preset monitoring program.

[0032] The data of the first preset time period, the specified time period, and the resource usage are integrated to generate a corresponding resource usage data record table;

[0033] The resource usage data record table is used to query the first time period in which the resource usage is less than the preset resource usage threshold in each day within the first preset time period.

[0034] Filter out the second time period that appears repeatedly from all the first time periods; wherein, the number of the second time periods includes multiple periods;

[0035] The number of repetitions in each of the second time periods is obtained, and the third time period with a repetition count greater than a preset threshold is selected from all the second time periods.

[0036] The third time period is designated as the idle time period for the business.

[0037] Furthermore, after the step of obtaining the logs corresponding to the log query keywords, the method further includes:

[0038] Invoke the preset anomaly analysis model;

[0039] Anomaly analysis is performed on the logs based on the anomaly analysis model to obtain anomaly analysis results corresponding to the logs.

[0040] Determine whether the anomaly analysis result indicates the presence of an anomaly;

[0041] If so, generate an anomaly report corresponding to the log based on the anomaly analysis results;

[0042] Obtain the target user's communication address;

[0043] Send the anomaly report to the communication address.

[0044] To address the aforementioned technical problems, this application also provides a log processing device, which employs the following technical solution:

[0045] A receiving module is used to receive a log query request input by a user; wherein the log query request carries log query keywords;

[0046] The first acquisition module is used to extract the log query keywords from the log query request and acquire the logs corresponding to the log query keywords;

[0047] The parsing module is used to parse the logs to obtain the log identification information;

[0048] The second acquisition module is used to acquire the link call information of the log based on the identification information;

[0049] The sorting module is used to sort the logs according to the link call information to obtain the sorted target logs;

[0050] The display module is used to display the target log based on a preset page canvas.

[0051] To address the aforementioned technical problems, this application also provides a computer device that employs the following technical solution:

[0052] Receive a log query request input by the user; wherein the log query request carries log query keywords;

[0053] Extract the log query keywords from the log query request and obtain the logs corresponding to the log query keywords;

[0054] The log is parsed to obtain the log's identification information;

[0055] Based on the identification information, obtain the link call information of the log;

[0056] The logs are sorted according to the link call information to obtain the sorted target logs;

[0057] The target log is displayed on a preset page canvas.

[0058] To address the aforementioned technical problems, this application also provides a computer-readable storage medium, employing the technical solution described below:

[0059] Receive a log query request input by the user; wherein the log query request carries log query keywords;

[0060] Extract the log query keywords from the log query request and obtain the logs corresponding to the log query keywords;

[0061] The log is parsed to obtain the log's identification information;

[0062] Based on the identification information, obtain the link call information of the log;

[0063] The logs are sorted according to the link call information to obtain the sorted target logs;

[0064] The target log is displayed on a preset page canvas.

[0065] Compared with the prior art, the embodiments of this application have the following main advantages:

[0066] This embodiment of the application, upon receiving a log query request from a user, first extracts the log query keywords from the request and retrieves the logs corresponding to those keywords. Then, it parses the logs to obtain their identifiers, and subsequently obtains the log call chain information based on the identifiers. The logs are then sorted according to the call chain information to obtain the sorted target logs. Finally, the target logs are displayed on a preset page canvas. This embodiment of the application, by retrieving the corresponding logs based on the log query request, obtaining the log call chain information based on the log identifiers, sorting the logs according to the call chain information, and displaying the sorted logs on a page canvas, achieves a visual display of the target logs according to the call chain hierarchy. This allows users to clearly see the hierarchical relationship of the log call chain in a graphical way, thereby enabling fast, accurate, and efficient troubleshooting of log call chain issues. This effectively improves the operational efficiency of log data processing, saves development costs, and enhances the user experience. Attached Figure Description

[0067] To more clearly illustrate the solutions in this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0068] Figure 1 This is an exemplary system architecture diagram to which this application can be applied;

[0069] Figure 2 A flowchart of an embodiment of the log processing method according to this application;

[0070] Figure 3 This is a schematic diagram of the structure of one embodiment of the log processing apparatus according to this application;

[0071] Figure 4 This is a schematic diagram of the structure of one embodiment of the computer device according to this application. Detailed Implementation

[0072] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings of this application, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings of this application are used to distinguish different objects, not to describe a particular order.

[0073] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0074] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0075] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0076] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0077] Terminal devices 101, 102, and 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), laptops, and desktop computers, etc.

[0078] Server 105 can be a server that provides various services, such as a backend server that supports the pages displayed on terminal devices 101, 102, and 103.

[0079] It should be noted that the log processing method provided in this application embodiment is generally executed by a server / terminal device, and correspondingly, the log processing device is generally set in the server / terminal device.

[0080] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0081] Continue to refer to Figure 2 A flowchart of an embodiment of the log processing method according to this application is shown. The log processing method includes the following steps:

[0082] Step S201: Receive a log query request input by the user; wherein the log query request carries log query keywords.

[0083] In this embodiment, the log processing method runs on an electronic device (e.g., Figure 1 The server / terminal device shown can receive log query requests via wired or wireless connection. It should be noted that the aforementioned wireless connection methods include, but are not limited to, 3G / 4G / 5G connections, WiFi connections, Bluetooth connections, WiMAX connections, Zigbee connections, UWB (ultra-wideband) connections, and other currently known or future-developed wireless connection methods. The log keywords can be descriptions of the service name the user wants to query. The number of log query keywords can be multiple.

[0084] Step S202: Extract the log query keywords from the log query request and obtain the logs corresponding to the log query keywords.

[0085] In this embodiment, log query keywords can be extracted by parsing the log query request. The number of logs mentioned above includes multiple logs. Furthermore, the specific implementation process for obtaining the logs corresponding to the query keywords will be described in more detail in subsequent embodiments of this application, and will not be elaborated upon here.

[0086] Step S203: Parse the log to obtain the log's identification information.

[0087] In this embodiment, the aforementioned identification information includes at least a TraceID and may also include the log generation time. The TraceID is used to identify a specific request. The TraceID flows through the server from receiving the request to responding to it, relaying it to downstream applications to uniquely identify and define this request. For each service call request, a unique TraceID is assigned to identify a request chain, and this TraceID persists throughout all services in the entire request processing process. Simultaneously, this TraceID is also recorded in the log each time a log entry is generated. By parsing the logs, the TraceID and log generation time of each log entry can be obtained.

[0088] Step S204: Obtain the link call information of the log based on the identification information.

[0089] In this embodiment, each log entry records the link call information from receiving a request from the server to responding to the request. The link call information of the log corresponding to the TraceID can be obtained based on the identification information TraceID.

[0090] Step S205: Sort the logs according to the link call information to obtain the sorted target logs.

[0091] In this embodiment, the logs can be sorted based on the order of link calls in the link call information to obtain the target logs.

[0092] Step S206: Display the target log based on a preset page canvas.

[0093] In this embodiment, the aforementioned page canvas is specifically AntX. By using the page canvas to display the target log, the target log can be displayed according to the hierarchy of the call chain, thereby presenting the call chain corresponding to the target log in a three-dimensional form (tree structure).

[0094] Upon receiving a log query request from a user, this application first extracts the log query keywords from the request and retrieves the logs corresponding to those keywords. Then, it parses the logs to obtain their identifiers, followed by the acquisition of the log's call chain information based on the identifiers. Subsequently, the logs are sorted according to the call chain information to obtain the sorted target logs. Finally, the target logs are displayed on a pre-defined page canvas. This application achieves a visual representation of the target logs according to the call chain hierarchy by retrieving the corresponding logs from the query request, obtaining the call chain information based on the log's identifiers, sorting the logs according to the call chain information, and displaying the sorted logs on a page canvas. This allows users to clearly see the hierarchical relationship of the log's call chain in a graphical way, enabling rapid, accurate, and efficient troubleshooting of log-related issues. This effectively improves the operational efficiency of log data processing, saves development costs, and enhances the user experience.

[0095] In some optional implementations, step S202, obtaining the logs corresponding to the log query keywords, includes the following steps:

[0096] Call the preset log query server.

[0097] In this embodiment, the log query server is a pre-created server storing log data. Different logs are stored using the business name corresponding to the log as an index. Log data from the call chain can be pre-collected using Spring events and the RabbitMQ message middleware. Furthermore, log data can be tabled and stored in the log query server according to preset partition information to facilitate log data retrieval and cleanup. The partition information refers to the secondary partition information corresponding to the current day of the log data. The secondary partition information includes primary and secondary partitions. Primary partitions are partitioned using the dayOfMonth field of the month, and secondary partitions are partitioned using a hash algorithm. Additionally, the log data can be cleaned using the truncate method.

[0098] The log query keywords are sent to the log storage server, and the log query server retrieves the logs corresponding to the log query keywords.

[0099] In this embodiment, the log storage server can perform parallel queries on all log data contained within it based on log query keywords, thereby improving the rate of obtaining logs corresponding to the log query keywords.

[0100] Receive the logs returned by the log query server.

[0101] This application uses a log query server to quickly and accurately retrieve corresponding logs based on log query keywords, enabling the subsequent rapid acquisition of log identification information and log call information based on the retrieved logs.

[0102] In some optional implementations of this embodiment, after step S205, the electronic device may further perform the following steps:

[0103] Get the remaining available capacity locally, and get the capacity occupied by the target log.

[0104] Calculate the difference between the remaining available capacity and the occupied capacity, and determine whether the difference is greater than a preset value.

[0105] In this embodiment, the aforementioned preset value is the value at which the corresponding electronic device can operate normally; that is, if the remaining available capacity of the electronic device is greater than the preset value, it indicates that the electronic device can operate normally. Furthermore, the value of the aforementioned preset value is not specifically limited and can be set according to actual usage needs.

[0106] If the value is greater than the preset value, the target log will be stored locally.

[0107] In this embodiment, when it is determined that the difference between the remaining available capacity of the electronic device and the occupied capacity of the target log is greater than a preset value, storing the target log locally can effectively avoid the problem of low data query success rate of the target log due to network instability or disconnection, thereby improving the storage adaptability of the target log.

[0108] If the value is not greater than the preset value, the target log will be stored in the preset storage block.

[0109] In this embodiment, the aforementioned storage block is constructed and generated based on blockchain technology. When it is determined that the difference between the remaining available capacity of the electronic device and the occupied capacity of the target log is not greater than the aforementioned preset value, the security and immutability of the target log can be effectively guaranteed by using this storage block to store and manage it. Furthermore, the specific implementation process of storing the target log within the preset storage block will be described in further detail in subsequent embodiments of this application, and will not be elaborated upon here.

[0110] This application compares the occupied capacity of the target log with the remaining available capacity locally, and then stores the target log locally or in a preset storage block based on the comparison result. This effectively improves the intelligence and adaptability of target log storage and also ensures the security of target data.

[0111] In some optional implementations, storing the target log in a preset storage block includes the following steps:

[0112] Invokes a storage block built on blockchain technology.

[0113] In this embodiment, in order to improve the security of data storage, a storage block is pre-built based on blockchain technology, which can be used for log data.

[0114] The target log is converted into blockchain-style ledger data.

[0115] In this embodiment, when the aforementioned storage block receives ledger data, it first converts the target log into blockchain-style ledger data, thereby enabling the target log to be stored as a blockchain-style ledger.

[0116] The ledger data is stored in the storage block.

[0117] In this embodiment, after generating ledger data corresponding to the target log, the ledger data is associated with the target log, and the ledger data is stored based on blockchain technology after the association is completed. Thus, by using storage blocks to store the ledger data corresponding to the target log, local storage space on electronic devices can be effectively saved, and the intelligence of log data storage can be improved.

[0118] When this application determines that the difference between the remaining available capacity of the electronic device and the occupied capacity of the target log is not greater than the aforementioned preset value, it will intelligently store and manage the target log by using storage blocks built based on blockchain technology, thereby effectively saving local storage resources and ensuring the security of storing the target log.

[0119] In some alternative implementations, after the step of storing the target log locally described above, the electronic device may further perform the following steps:

[0120] Determine whether the target log meets the preset cleanup conditions.

[0121] In this embodiment, the aforementioned cleanup conditions correspond to a pre-set log data cleanup mechanism. Electronic devices have a certain amount of local storage space. When the local storage space usage reaches a certain level, performance lag may occur. Therefore, a corresponding log data cleanup mechanism is established. Specifically, the cleanup conditions can be at least one or a combination of the following: when the user instructs the cleanup of log data; when the log data storage time reaches a preset time limit; when the log data access frequency is lower than a preset frequency threshold, etc. The values ​​of the preset time limit and frequency threshold are not specifically limited and can be set according to actual usage needs.

[0122] If the cleanup conditions are met, obtain the current time.

[0123] Determine whether the current time is within a preset business idle time period.

[0124] In this embodiment, the process of generating the aforementioned idle time period will be described in more detail in subsequent specific embodiments, and will not be elaborated upon here.

[0125] If the target log is within the business's idle period, delete it from the local machine.

[0126] In this embodiment, by deleting the target log during the business idle period, the processing of the target log during the business busy period can be avoided, thereby reducing the impact on the normal operation of electronic devices and ensuring the processing efficiency of log data.

[0127] This application stores the target log locally and, upon detecting that the target log meets the preset cleanup conditions, intelligently deletes the target log from the local machine during idle business periods. This effectively reduces the waste of space in electronic devices, ensures the rational use of system resources, and improves the intelligence of log data storage.

[0128] In some optional implementations of this embodiment, before the step of determining whether the current time is within a preset idle service period, the electronic device may further perform the following steps:

[0129] The resource usage is obtained within a specified time period of the first preset time cycle through a preset monitoring program.

[0130] In this embodiment, the monitoring program can be written and generated by developers based on actual resource data monitoring needs. This monitoring program can call the data acquisition interface provided by the electronic device, thereby quickly and conveniently obtaining the resource usage of the electronic device. The value of the first preset time period is not specifically limited and can be set according to actual usage needs. For example, the first preset time period can be the previous week adjacent to the current time. Furthermore, the specified time period is the initial idle time period of the electronic device, roughly determined manually or automatically by the device; for example, the target time period can be set to 0:00-9:00; 21:00-24:00.

[0131] The data of the first preset time period, the specified time period, and the resource usage are integrated to generate a corresponding resource usage data record table.

[0132] In this embodiment, a first preset time period, a specified time period, and resource usage can be added to a preset data record table template to generate a resource usage data record table. The data record table template can be created and generated according to actual business usage needs.

[0133] The resource usage data record table is used to retrieve the first time period in which the resource usage on each day within the first preset time period is less than the preset resource usage threshold.

[0134] In this embodiment, the value of the above-mentioned resource usage threshold is not specifically limited and can be set according to actual usage needs.

[0135] Select the second time period that appears repeatedly from all the first time periods; wherein the number of the second time periods includes multiple periods.

[0136] The number of repetitions in each of the second time periods is obtained, and the third time period with a repetition count greater than a preset threshold is selected from all the second time periods.

[0137] In this embodiment, the value of the preset number of times threshold is not specifically limited and can be set according to actual usage requirements.

[0138] The third time period is designated as the idle time period for the business.

[0139] This application analyzes and statistically processes historical resource usage data of electronic devices, and intelligently determines the idle time periods of electronic devices based on the analysis results. This effectively ensures the accuracy of the generated idle time periods, and subsequently, the target logs are intelligently deleted from the local storage during the idle time periods. This effectively reduces the waste of space in electronic devices, ensures the rational use of system resources, and improves the intelligence of log data storage.

[0140] In some optional implementations of this embodiment, after step S202, the electronic device may further perform the following steps:

[0141] Invoke the preset anomaly analysis model.

[0142] In this embodiment, the anomaly analysis model can be a machine learning model, specifically including any one of the following: logistic regression model, random forest model, and Naive Bayes model. The training process for the anomaly analysis model can refer to existing model training processes, and will not be elaborated upon here.

[0143] Anomaly analysis is performed on the logs based on the anomaly analysis model to obtain the anomaly analysis results corresponding to the logs.

[0144] In this embodiment, the anomaly analysis results may include whether an anomaly exists or not.

[0145] Determine whether the anomaly analysis result indicates the presence of an anomaly.

[0146] If so, an anomaly report corresponding to the log is generated based on the anomaly analysis results.

[0147] In this embodiment, the anomaly analysis results can be added to a preset anomaly report template to generate a corresponding anomaly report. The anomaly report template can be created and generated according to actual business needs.

[0148] Obtain the target user's communication address.

[0149] In this embodiment, the target user can be an operations and maintenance personnel related to log data maintenance. The communication address can be an email address.

[0150] Send the anomaly report to the communication address.

[0151] In this embodiment, if the communication address is an email address, the exception report can be sent to the target user's communication address by logging into the email server and then using the email server.

[0152] After generating an anomaly analysis result corresponding to the log content as anomaly through the anomaly analysis model, this application will intelligently generate an anomaly report corresponding to the log and send the anomaly report to the relevant target user's communication address, so that the target user can promptly process the log according to the received anomaly report, thereby improving the processing efficiency of anomaly logs and enhancing the user experience.

[0153] It should be emphasized that, to further ensure the privacy and security of the aforementioned target logs, these target logs can also be stored in a node of a blockchain.

[0154] The blockchain referred to in this application is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying blockchain platform, a platform product service layer, and an application service layer.

[0155] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0156] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0157] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware with computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When executed, the program can include the processes of the embodiments of the above methods. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0158] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0159] Further reference Figure 3 As a response to the above Figure 2 To implement the method shown, this application provides an embodiment of a log processing device, which is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0160] like Figure 3 As shown, the log processing device 300 described in this embodiment includes: a receiving module 301, a first acquisition module 302, a parsing module 303, a second acquisition module 304, a sorting module 305, and a display module 306. Wherein:

[0161] The receiving module 301 is used to receive a log query request input by a user; wherein the log query request carries log query keywords;

[0162] The first acquisition module 302 is used to extract the log query keywords from the log query request and acquire the logs corresponding to the log query keywords;

[0163] The parsing module 303 is used to parse the log to obtain the log's identification information;

[0164] The second acquisition module 304 is used to acquire the link call information of the log based on the identification information;

[0165] Sorting module 305 is used to sort the logs according to the link call information to obtain sorted target logs;

[0166] The display module 306 is used to display the target log based on a preset page canvas.

[0167] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the log processing method in the aforementioned embodiments, and will not be repeated here.

[0168] In some optional implementations of this embodiment, the first acquisition module 302 includes:

[0169] The first calling submodule is used to call the preset log query server;

[0170] The query submodule is used to send the log query keywords to the log storage server, and retrieve the logs corresponding to the log query keywords through the log query server.

[0171] The receiving submodule is used to receive the logs returned by the log query server.

[0172] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the log processing method in the aforementioned embodiments, and will not be repeated here.

[0173] In some optional implementations of this embodiment, the log processing device further includes:

[0174] The third acquisition module is used to acquire the remaining available capacity locally, and to acquire the capacity occupied by the target log.

[0175] The first judgment module is used to calculate the difference between the remaining available capacity and the occupied capacity, and to determine whether the difference is greater than a preset value;

[0176] The first storage module is used to store the target log locally if it is greater than the preset value;

[0177] The second storage module is used to store the target log in a preset storage block if the value is not greater than the preset value.

[0178] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the log processing method in the aforementioned implementation method, and will not be repeated here.

[0179] In some optional implementations of this embodiment, the second storage module includes:

[0180] The second calling submodule is used to call the storage block built based on blockchain technology;

[0181] The transformation submodule is used to convert the target log into blockchain-based ledger data;

[0182] The storage submodule is used to store the ledger data in the storage block.

[0183] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the log processing method in the aforementioned embodiments, and will not be repeated here.

[0184] In some optional implementations of this embodiment, the log processing apparatus further includes:

[0185] The second judgment module is used to determine whether the target log meets the preset cleanup conditions;

[0186] The fourth acquisition module is used to acquire the current time if the cleanup conditions are met;

[0187] The third judgment module is used to determine whether the current time is within a preset business idle time period;

[0188] The deletion module is used to delete the target log from the local machine if it is within the business's idle time period.

[0189] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the log processing method in the aforementioned embodiments, and will not be repeated here.

[0190] In some optional implementations of this embodiment, the log processing apparatus further includes:

[0191] The fourth judgment module is used to obtain the resource usage within a specified time period of the first preset time period through a preset monitoring program;

[0192] The first generation module is used to integrate the data of the first preset time period, the specified time period and the resource usage to generate a corresponding resource usage data record table.

[0193] The query module is used to query the resource usage data record table to find the first time period in which the resource usage is less than the preset resource usage threshold in each day within the first preset time period.

[0194] The first filtering module is used to filter out the second time period that appears repeatedly from all the first time periods; wherein, the number of the second time periods includes multiple periods.

[0195] The second filtering module is used to obtain the number of repetitions in each of the second time periods, and to filter out the third time period from all the second time periods where the number of repetitions is greater than a preset threshold.

[0196] The determination module is used to designate the third time period as the business idle time period.

[0197] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the log processing method in the aforementioned embodiments, and will not be repeated here.

[0198] In some optional implementations of this embodiment, the log processing apparatus further includes:

[0199] The calling module is used to invoke the preset anomaly analysis model;

[0200] The analysis module is used to perform anomaly analysis on the logs based on the anomaly analysis model to obtain anomaly analysis results corresponding to the logs;

[0201] The fifth judgment module is used to determine whether the anomaly analysis result indicates the presence of an anomaly.

[0202] The second generation module is used to generate an anomaly report corresponding to the log based on the anomaly analysis results if the anomaly is true.

[0203] The fifth acquisition module is used to acquire the target user's communication address;

[0204] The sending module is used to send the exception report to the communication address.

[0205] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the log processing method in the aforementioned embodiments, and will not be repeated here.

[0206] To address the aforementioned technical problems, embodiments of this application also provide a computer device. Please refer to [link / reference needed]. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0207] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected via a system bus. It should be noted that only the computer device 4 with components 41-43 is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described here is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0208] The computer device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control.

[0209] The memory 41 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 41 may be an internal storage unit of the computer device 4, such as the hard disk or memory of the computer device 4. In other embodiments, the memory 41 may also be an external storage device of the computer device 4, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 4. Of course, the memory 41 may also include both the internal storage unit and its external storage device of the computer device 4. In this embodiment, the memory 41 is typically used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions for log processing methods. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or will be output.

[0210] In some embodiments, the processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 42 is typically used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to execute computer-readable instructions stored in the memory 41 or to process data, for example, to execute computer-readable instructions for the log processing method.

[0211] The network interface 43 may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the computer device 4 and other electronic devices.

[0212] Compared with the prior art, the embodiments of this application have the following main advantages:

[0213] In this embodiment, upon receiving a log query request from a user, the system first extracts the log query keywords from the request and retrieves the logs corresponding to those keywords. Then, the logs are parsed to obtain their identifiers. Next, the log call chain information is obtained based on the identifiers. Subsequently, the logs are sorted according to the call chain information to obtain the sorted target logs. Finally, the target logs are displayed on a preset page canvas. This embodiment, by retrieving the corresponding logs based on the log query request, obtaining the log call chain information based on the log identifiers, sorting the logs according to the call chain information, and displaying the sorted logs on a page canvas, achieves a visual display of the target logs according to the call chain hierarchy. This allows users to clearly see the hierarchical relationship of the log call chain in a graphical way, thereby enabling fast, accurate, and efficient troubleshooting of log call chain issues. This effectively improves the operational efficiency of log data processing, saves development costs, and enhances the user experience.

[0214] This application also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the log processing method described above.

[0215] Compared with the prior art, the embodiments of this application have the following main advantages:

[0216] In this embodiment, upon receiving a log query request from a user, the system first extracts the log query keywords from the request and retrieves the logs corresponding to those keywords. Then, the logs are parsed to obtain their identifiers. Next, the log call chain information is obtained based on the identifiers. Subsequently, the logs are sorted according to the call chain information to obtain the sorted target logs. Finally, the target logs are displayed on a preset page canvas. This embodiment, by retrieving the corresponding logs based on the log query request, obtaining the log call chain information based on the log identifiers, sorting the logs according to the call chain information, and displaying the sorted logs on a page canvas, achieves a visual display of the target logs according to the call chain hierarchy. This allows users to clearly see the hierarchical relationship of the log call chain in a graphical way, thereby enabling fast, accurate, and efficient troubleshooting of log call chain issues. This effectively improves the operational efficiency of log data processing, saves development costs, and enhances the user experience.

[0217] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0218] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

Claims

1. A log processing method, characterized in that, Includes the following steps: Receive a log query request input by the user; wherein the log query request carries log query keywords; Extract the log query keywords from the log query request and obtain the logs corresponding to the log query keywords; The log is parsed to obtain the log's identification information; Based on the identification information, obtain the link call information of the log; The logs are sorted according to the link call information to obtain the sorted target logs; The target log is displayed based on a preset page canvas; The step of obtaining the logs corresponding to the log query keywords further includes: Invoke the preset anomaly analysis model; Anomaly analysis is performed on the logs based on the anomaly analysis model to obtain anomaly analysis results corresponding to the logs. Determine whether the anomaly analysis result indicates the presence of an anomaly; If so, generate an anomaly report corresponding to the log based on the anomaly analysis results; Obtain the target user's communication address; Send the anomaly report to the communication address; The log processing method further includes: calling a storage block built based on blockchain technology; converting the target log into blockchain-style ledger data; storing the ledger data in the storage block; after generating ledger data corresponding to the target log, associating the ledger data with the target log, and storing the ledger data based on blockchain technology after completing the association between the two. The step of sorting the logs according to the link call information to obtain the sorted target logs further includes: Get the remaining available capacity locally, and get the capacity occupied by the target log; Calculate the difference between the remaining available capacity and the occupied capacity, and determine whether the difference is greater than a preset value; If the value is greater than the preset value, the target log will be stored locally. If the value is not greater than the preset value, the target log will be stored in the preset storage block; The step of storing the target log locally includes: Determine whether the target log meets the preset cleanup conditions; If the cleanup conditions are met, obtain the current time; Determine whether the current time is within a preset business idle time period; If the target log is within the business idle period, delete it from the local machine; Prior to the step of determining whether the current time falls within a preset idle service period, the method further includes: The resource usage within a specified time period of the first preset time cycle is obtained through a preset monitoring program. The data of the first preset time period, the specified time period, and the resource usage are integrated to generate a corresponding resource usage data record table; The resource usage data record table is used to query the first time period in which the resource usage is less than the preset resource usage threshold in each day within the first preset time period. Filter out the second time period that appears repeatedly from all the first time periods; wherein, the number of the second time periods includes multiple periods; The number of repetitions in each of the second time periods is obtained, and the third time period with a repetition count greater than a preset threshold is selected from all the second time periods. The third time period shall be designated as the business idle time period; The above-mentioned cleanup conditions are at least one or a combination of the following conditions: when the user instructs the log data to be cleaned up; when the storage time of the log data reaches a preset time limit; when the access frequency of the log data is lower than a preset frequency threshold.

2. The log processing method according to claim 1, characterized in that, The step of obtaining the logs corresponding to the log query keywords specifically includes: Call the preset log query server; The log query keywords are sent to the log storage server, and the log query server retrieves the logs corresponding to the log query keywords. Receive the logs returned by the log query server.

3. The log processing method according to claim 1, characterized in that, The step of storing the target log in a preset storage block specifically includes: Access storage blocks built on blockchain technology; The target log is converted into blockchain ledger data; The ledger data is stored in the storage block.

4. A log processing device, characterized in that, include: A receiving module is used to receive a log query request input by a user; wherein the log query request carries log query keywords; The first acquisition module is used to extract the log query keywords from the log query request and acquire the logs corresponding to the log query keywords; The parsing module is used to parse the logs to obtain the log identification information; The second acquisition module is used to acquire the link call information of the log based on the identification information; The sorting module is used to sort the logs according to the link call information to obtain the sorted target logs; The display module is used to display the target log based on a preset page canvas; The log processing device also includes: The calling module is used to invoke the preset anomaly analysis model; The analysis module is used to perform anomaly analysis on the logs based on the anomaly analysis model to obtain anomaly analysis results corresponding to the logs; The fifth judgment module is used to determine whether the anomaly analysis result indicates the presence of an anomaly. The second generation module is used to generate an anomaly report corresponding to the log based on the anomaly analysis results if the anomaly is true. The fifth acquisition module is used to acquire the target user's communication address; The sending module is used to send the exception report to the communication address; The log processing device further includes: calling a storage block built based on blockchain technology; converting the target log into blockchain-style ledger data; storing the ledger data in the storage block; after generating ledger data corresponding to the target log, associating the ledger data with the target log, and storing the ledger data based on blockchain technology after completing the association between the two. The log processing device also includes: The third acquisition module is used to acquire the remaining available capacity locally, and to acquire the capacity occupied by the target log. The first judgment module is used to calculate the difference between the remaining available capacity and the occupied capacity, and to determine whether the difference is greater than a preset value; The first storage module is used to store the target log locally if it is greater than the preset value; The second storage module is used to store the target log in a preset storage block if the value is not greater than the preset value. The log processing device also includes: The second judgment module is used to determine whether the target log meets the preset cleanup conditions; The fourth acquisition module is used to acquire the current time if the cleanup conditions are met; The third judgment module is used to determine whether the current time is within a preset business idle time period; The deletion module is used to delete the target log from the local machine if it is within the business idle time period; The log processing device also includes: The fourth judgment module is used to obtain the resource usage within a specified time period of the first preset time period through a preset monitoring program; The first generation module is used to integrate the data of the first preset time period, the specified time period and the resource usage to generate a corresponding resource usage data record table. The query module is used to query the resource usage data record table to find the first time period in which the resource usage is less than the preset resource usage threshold in each day within the first preset time period. The first filtering module is used to filter out the second time period that appears repeatedly from all the first time periods; wherein, the number of the second time periods includes multiple periods. The second filtering module is used to obtain the number of repetitions in each of the second time periods, and to filter out the third time period from all the second time periods where the number of repetitions is greater than a preset threshold. A determination module is used to designate the third time period as the business idle time period; The above-mentioned cleanup conditions are at least one or a combination of the following conditions: when the user instructs the log data to be cleaned up; when the storage time of the log data reaches a preset time limit; when the access frequency of the log data is lower than a preset frequency threshold.

5. A computer device comprising a memory and a processor, the memory storing computer-readable instructions, wherein the processor, when executing the computer-readable instructions, implements the steps of the log processing method as described in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the log processing method as described in any one of claims 1 to 3.

Images