Log retrieval method and device, electronic equipment and storage medium

Abstract

The application relates to a log retrieval method and device, electronic equipment and a storage medium. The log retrieval method comprises the following steps: acquiring a search keyword; determining all retrieval keywords in a retrieval library which match the search keyword according to the search keyword; acquiring corresponding retrieval conditions according to the retrieval keywords; acquiring a record introduction in each retrieval condition; generating a record introduction list according to all record introductions and displaying the introduction list; acquiring a specified record introduction; the specified record introduction is a record introduction selected according to the introduction list; determining a target retrieval condition according to the specified record introduction; determining the specific position of a corresponding record in a log file according to the target retrieval condition; acquiring a target record according to the specific position and displaying the target record.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a log retrieval method, apparatus, electronic device, and storage medium. Background Technology

[0002] During system operation, logs are generated to record events. Logs primarily document the system's running status and operations. When a system encounters vulnerabilities or unexpected situations, logs are often used for troubleshooting. Similarly, when human intervention is detected in system data, logs are used for analysis of user actions.

[0003] However, logs generated by monitoring network systems often contain a massive amount of text information. When analyzing certain text information in a log file, it is necessary to read the entire log file, which results in excessively long reading times and wastes system resources. Summary of the Invention

[0004] This application provides a log retrieval method, apparatus, electronic device, and storage medium to solve the problem that currently, when retrieving certain text information in a log, the system needs to read the entire log file and then manually retrieve the text information bit by bit, which is too wasteful of system resources and time. The goal is to achieve the effect of quickly retrieving target text information by simply entering search keywords.

[0005] Firstly, this application provides a log retrieval method, the method comprising:

[0006] Get search keywords;

[0007] Based on the search keywords, determine all search keywords in the search database that match the search keywords;

[0008] Based on the search keywords, obtain the corresponding search conditions;

[0009] For each search condition, obtain a brief description of the records in the search condition;

[0010] Generate a list of record descriptions based on all record descriptions, and then display the list of descriptions.

[0011] Get a description of a specified record; the specified record description is the description of the record selected from the description list;

[0012] Based on the specified record summary, determine the target search criteria;

[0013] Based on the target retrieval criteria, determine the specific location of the corresponding record in the log file;

[0014] Based on the specific location, obtain the target record and display the target record.

[0015] This solution utilizes a method that matches user-input search keywords with system-generated search keywords to return a list of records, reducing the difficulty of filtering for users. Users can then determine the target log record from the list, and finally accurately retrieve the target log by using the specific location of the log record in the search criteria. This avoids the need to read the entire log file and improves the efficiency of retrieving the target record.

[0016] Optionally, monitor the target log file and obtain the newly added records in the target log file;

[0017] Based on the newly added record, determine the search conditions and search keywords corresponding to the newly added record;

[0018] The search criteria and search keywords are stored in the search database.

[0019] This solution utilizes a monitoring unit to acquire each new record written to the log file. It allows for corresponding operations on each new record, generating search keywords and conditions for each record, which are then stored in a search database. This provides the necessary conditions for accurate reading of each record in the log file, thus improving the efficiency of log retrieval to some extent.

[0020] Optionally, the monitoring of the target log file, including obtaining new records in the target log file, includes:

[0021] Obtain the storage location of the target log file and monitor the size of the target log file;

[0022] When a new file is added to the target log file, record the size of the target log file before the addition and the size after the addition.

[0023] Based on the newly added size data, read the changed target log file in reverse order to obtain the newly added records;

[0024] The step of determining the search conditions and search keywords corresponding to the newly added record includes:

[0025] Generate a record summary by combining keywords from the newly added record;

[0026] Based on the previous size data, the new size data, and the record description, generate search criteria;

[0027] Based on the record summary, different types of search keywords are extracted.

[0028] This solution utilizes the size of each new entry in the target log file to read the log file in reverse chronological order, ensuring rapid retrieval of the latest new records. Then, by generating different types of keywords from the new record content and creating a record summary from these keywords, the core content of the new record is summarized. This allows users to determine whether they need the new record based on the summary. Furthermore, the system combines the size data before and after the new entry recorded by the monitoring unit, along with the record summary to generate search conditions and keywords, all of which improve the efficiency of subsequent record retrieval and reduce the time required to find the target record.

[0029] Optionally, the types of the search keywords include: generation time, operator, operated on, and operation status; the search keywords include: characters entered in the search box, filtering time, and filtering status.

[0030] The step of determining all search keywords in the search database that match the search keyword based on the search keyword includes:

[0031] Based on the search keywords, the characters entered in the search box are matched with the search keywords for operator type and operated-person type to confirm search keywords with the same characters; the filter time is matched with the search keywords for generation time type to confirm search keywords with matching time; the filter status is matched with the search keywords for operation status type to confirm search keywords with the same characters describing the status.

[0032] The step of obtaining the corresponding search conditions based on the search keywords includes:

[0033] The search keywords are categorized according to type;

[0034] Based on different types of search keywords, obtain the corresponding search conditions;

[0035] The search conditions corresponding to different types of search keywords are compared, and the search conditions that appear repeatedly in the search conditions corresponding to all types of search keywords are selected as the search conditions corresponding to the search keywords.

[0036] This solution categorizes and refines search keywords and retrieval criteria, and performs search matching for each category separately, enabling efficient searching of user-input keywords. Finally, it compares and filters the retrieval conditions corresponding to each category, selecting those conditions that simultaneously match the search keywords, thereby improving the retrieval accuracy of target log records.

[0037] Optionally, the target record and the search conditions corresponding to the target record are associated and stored in the cache;

[0038] Determining the specific location of the corresponding record in the log file based on the target retrieval criteria includes:

[0039] Based on the target retrieval criteria, check whether the target retrieval criteria are present in the cache. If they are present, confirm the specific location of the target record in the cache.

[0040] If the record is not found, the specific location of the corresponding record in the log file is determined based on the target retrieval criteria.

[0041] This solution stores the target records that users have searched in the cache, so that these target records can be retrieved through the cache when they are searched a second or multiple times. This reduces search time and disk read pressure when certain target records are searched frequently, and further optimizes the efficiency of log retrieval.

[0042] Optionally, the step of storing the target record and the corresponding search conditions in the cache includes:

[0043] Determine whether the number of target records stored in the cache exceeds the preset storage limit;

[0044] If so, delete the record with the fewest queries and the search conditions corresponding to the record from the cache, and then associate and store the target record and the search conditions corresponding to the target record in the cache;

[0045] If not, the target record and the corresponding search conditions are associated and stored in the cache.

[0046] This solution protects the normal use of memory space by setting a preset number of cache entries. By replacing the target records in the cache that are queried less frequently, it ensures that the target records stored in the cache are all frequently searched records, which improves the search efficiency of target log records to a certain extent.

[0047] Optionally, set the cache update time;

[0048] When the set cache update time is reached, query the number of times each record in the cache has been queried;

[0049] Delete all records whose query count is less than the preset number.

[0050] This solution allows you to set a cache update time to periodically delete target records that have been queried a low number of times within a period, so that the target records in the cache are all target records that have been queried a high number of times in the most recent period.

[0051] Secondly, this application provides a log retrieval device, comprising:

[0052] The first acquisition module is used to acquire search keywords;

[0053] The matching module is used to determine all search keywords in the search database that match the search keywords based on the search keywords.

[0054] The retrieval module is used to obtain the corresponding retrieval conditions based on the retrieval keywords; for each retrieval condition, obtain the record summary of the retrieval condition; generate a list of record summary based on all record summary, and call the display module to display the summary list;

[0055] The second acquisition module is used to acquire a description of a specified record; the specified record description is a description of a record selected according to the description list;

[0056] The reading module is used to determine the target search conditions based on the specified record description; determine the specific location of the corresponding record in the log file based on the target search conditions; obtain the target record based on the specific location; and call the display module to display the target record.

[0057] Optionally, the log retrieval device may also include: a monitoring module;

[0058] The monitoring module is used to monitor the target log file and obtain the new records in the target log file;

[0059] Based on the newly added record, determine the search conditions and search keywords corresponding to the newly added record;

[0060] The search criteria and search keywords are stored in the search database.

[0061] Optionally, when the monitoring module monitors the target log file and obtains new records in the target log file, it is specifically used to: obtain the storage location of the target log file and monitor the size of the target log file;

[0062] When a new file is added to the target log file, record the size of the target log file before the addition and the size after the addition.

[0063] Based on the newly added size data, read the changed target log file in reverse order to obtain the newly added records;

[0064] When the monitoring module determines the search conditions and keywords corresponding to the newly added record, it is specifically used for:

[0065] Generate a record summary by combining keywords from the newly added record;

[0066] Based on the previous size data, the new size data, and the record description, generate search criteria;

[0067] Based on the record summary, different types of search keywords are extracted.

[0068] Optionally, the types of the search keywords include: generation time, operator, operated on, and operation status; the search keywords include: characters entered in the search box, filtering time, and filtering status.

[0069] When the matching module determines all matching search keywords in the search database based on the search keywords, it specifically performs the following steps: matching the characters entered in the search box with search keywords of operator type and operated-person type to confirm search keywords with the same characters; matching the filtering time with search keywords of generation time type to confirm search keywords with matching times; and matching the filtering status with search keywords of operation status type to confirm search keywords with the same characters describing the status.

[0070] When the retrieval module obtains the corresponding retrieval conditions based on the retrieval keywords, it is specifically used for:

[0071] The search keywords are categorized according to type;

[0072] Based on different types of search keywords, obtain the corresponding search conditions;

[0073] The search conditions corresponding to different types of search keywords are compared, and the search conditions that appear repeatedly in the search conditions corresponding to all types of search keywords are selected as the search conditions corresponding to the search keywords.

[0074] Optionally, the log retrieval device may also include: a caching module;

[0075] The caching module is used to associate and store the target record and the corresponding search conditions in the cache.

[0076] When the reading module determines the specific location of the corresponding record in the log file based on the target retrieval conditions, it is specifically used for:

[0077] Based on the target retrieval criteria, check whether the target retrieval criteria are present in the cache. If they are present, confirm the specific location of the target record in the cache.

[0078] If the record is not found, the specific location of the corresponding record in the log file is determined based on the target retrieval criteria.

[0079] Optionally, when the caching module associates and stores the target record and the corresponding search conditions in the cache, it is specifically used for:

[0080] Determine whether the number of target records stored in the cache exceeds the preset storage limit;

[0081] If so, delete the record with the fewest queries and the search conditions corresponding to the record from the cache, and then associate and store the target record and the search conditions corresponding to the target record in the cache;

[0082] If not, the target record and the corresponding search conditions are associated and stored in the cache.

[0083] Optionally, the log retrieval device may also include: an update module;

[0084] The update module is used to set the cache update time;

[0085] When the set cache update time is reached, query the number of times each record in the cache has been queried;

[0086] Delete all records whose query count is less than the preset number.

[0087] Thirdly, this application provides an electronic device, including: a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute the method of the first aspect.

[0088] Fourthly, this application provides a computer-readable storage medium storing a computer program that can be loaded by a processor and execute the method of the first aspect. Attached Figure Description

[0089] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0090] Figure 1 This is a schematic diagram of an application scenario provided in an embodiment of this application;

[0091] Figure 2 A flowchart illustrating a log retrieval method provided in one embodiment of this application;

[0092] Figure 3 This is a schematic diagram of the structure of a log retrieval device provided in one embodiment of this application;

[0093] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0094] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0095] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article, unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0096] The embodiments of this application will now be described in further detail with reference to the accompanying drawings.

[0097] With the development of the internet, each network system is responsible for an increasing number of services. When anomalies occur in requests from various services, the common practice is to search log files to view the processing records of those requests and analyze the cause of the anomaly. However, the number of service requests received by network systems every day is enormous, so log files often contain massive amounts of text information. In current technology, retrieving a specific log entry requires traversing the entire log file, resulting in long log file reading times and very low retrieval efficiency.

[0098] Based on this, this application provides a log retrieval method, apparatus, electronic device, and storage medium that accurately reads log files based on user-input search keywords, avoiding the need for full-text traversal of log files and manual retrieval. This aims to improve log retrieval efficiency and user experience.

[0099] Figure 1 This is a schematic diagram illustrating an application scenario provided in this application. For example... Figure 1 As shown, the user sends search keywords to the server through their device. The server then searches based on the search keywords and returns a list of record descriptions matching the search keywords to the user's device. After the user selects any record description, the server returns the target record to the user's device based on the selected description. The specific implementation method can be found in the following embodiment.

[0100] Figure 2 This is a flowchart illustrating a log retrieval method according to an embodiment of this application. The method of this embodiment can be applied to servers in the above-described scenarios. Figure 2 As shown, the method includes:

[0101] S201. Obtain the search keywords, and based on the search keywords, determine all search keywords in the search database that match the search keywords.

[0102] Here, search keywords refer to the information entered by the user that best summarizes the log records to be retrieved. Retrieval keywords refer to the information generated based on the main content of each record in the log file.

[0103] The search database, specifically, stores the search keywords for each record in the log files. Matching here includes exact matching, fuzzy matching, and range matching.

[0104] Specifically, after a user enters search keywords on the search page, the search database is searched for those keywords, and all keywords that match the search criteria are retrieved. For example, if the user enters the date 2023 / 01 / 29, then all keywords matching the search criteria will be retrieved from 2023 / 01 / 29-00:00:00 to 2023 / 01 / 29-23:59:59. Alternatively, if the user enters the keyword "abnormal," then all abnormal keywords will be retrieved.

[0105] S202. Based on the search keywords, obtain the corresponding search conditions, and for each search condition, obtain a brief description of the records in the search condition.

[0106] The search criteria and keywords are stored in the search database in a corresponding relationship. Each search keyword corresponds to a search criterion, which is in JSON format and includes the specific storage location of the target record in the log file and a brief description of the record. The record description, derived from the keyword information in the record content, indicates the main content of the record.

[0107] Specifically, search keywords and search conditions are stored as a single piece of information in the search database. All the search keywords retrieved above correspond to a search condition. After obtaining the search condition, the record summary within the search condition is obtained by parsing the JSON format. For example, if the search keyword retrieved above is "abnormal," and the information containing the search keyword and search condition is "ID: 1, Search Keyword: Abnormal, Search Condition: {'Storage Location': '0kb', 'Record Size': '2kb', 'Record Summary': '2023 / 01 / 29-00:00:00 System cms Abnormal'}", then the specific search condition is "Search Condition: {'Storage Location': '0kb', 'Record Size': '2kb', 'Record Summary': '2023 / 01 / 29-00:00:00 System cms Abnormal'}". Parsing the JSON format then yields the record summary as '2023 / 01 / 29-00:00:00 System cms Abnormal'.

[0108] S203. Generate a list of record descriptions based on all record descriptions, and display the list of descriptions.

[0109] Specifically, the system iterates through all the search terms corresponding to the search keywords retrieved from the database, retrieves all corresponding record summaries, and displays all these summary records in a list format on the user page. The user page then paginates the list based on the number of summary records. When the summary records are displayed as a list, the list includes the information ID corresponding to each summary record. The page then processes the data to display only the summary records. For example, if the search list is

"'2023 / 01 / 29-00:00:00 System cms abnormal', '1'", "'2023 / 01 / 29-00:00:01 System cms abnormal', '2'", "'2023 / 01 / 29-00:00:02 System cms abnormal', '3'"

[0110] S204. Obtain a brief description of the specified record, and determine the target search criteria based on the brief description of the specified record.

[0111] The specified record description is the record description selected by the user from the description list, and the target search criteria are the search criteria corresponding to the specified record description.

[0112] Specifically, after displaying all record descriptions in a list format to the user's page, the user selects a record description from the list. The page then returns the information ID corresponding to the selected record description to the server. Using this information ID, the user can accurately find the information in the search database and find the corresponding search criteria.

[0113] S205. Based on the target retrieval criteria, determine the specific location of the corresponding record in the log file, retrieve the target record based on the specific location, and display the target record.

[0114] The specific location refers to the 'storage location' mentioned above, which represents the byte position where the target record is stored in the log file.

[0115] Specifically, by parsing the JSON data of the target search criteria, the information of 'storage location' and 'record size' is obtained. Then, when reading the log file, the information of the size indicated by 'record size' is read from the 'storage location'. The read information is the information of the target record, and finally, the target record is sent to the user's page for display. For example, if the target search criteria are "search criteria: {'storage location': '1kb', 'record size': '2kb', 'record description': '2023 / 01 / 29-00:00:00 System database exception'}", then the 'storage location' is 1kb and the 'record size' is 2kb. When reading the log file, a total of 2kb of record information is read from the 1kb position, and this record information is the target record information.

[0116] This solution utilizes a method that matches user-input search keywords with system-generated search keywords to return a list of records, reducing the difficulty of filtering for users. Users can then determine the target log record from the list, and finally accurately retrieve the target log by using the specific location of the log record in the search criteria. This avoids the need to read the entire log file and improves the efficiency of retrieving the target record.

[0117] In some embodiments, a target log file is monitored to obtain newly added records in the target log file. Based on the newly added records, the search conditions and search keywords corresponding to the newly added records are determined, and the search conditions and search keywords are stored in the search database.

[0118] Specifically, a monitoring unit is set up in the log storage server. The monitoring unit is a trigger-based monitoring unit. When a new record is added to the monitored log file, the monitoring unit is triggered and reads the log file. The content read is the new record in the log file.

[0119] Then, the newly added records are analyzed to determine the corresponding search keywords and search conditions.

[0120] Store the search keywords and search criteria in the search database in the format described above.

[0121] This solution utilizes a monitoring unit to acquire each new record written to the log file. It allows for corresponding operations on each new record, generating search keywords and conditions for each record, which are then stored in a search database. This provides the necessary conditions for accurate reading of each record in the log file, thus improving the efficiency of log retrieval to some extent.

[0122] In some embodiments, monitoring a target log file and obtaining newly added records in the target log file includes: obtaining the storage location of the target log file, monitoring the size of the target log file, recording the size data of the target log file before the addition and the size data after the addition when a new record is added to the target log file, reading the changed target log file in reverse order based on the size data after the addition to obtain the new record, and determining the search conditions and search keywords corresponding to the new record based on the new record, including: combining the keywords in the new record to generate a record description, generating search conditions based on the size data before the addition, the size data after the addition, and the record description, and extracting different types of search keywords based on the record description.

[0123] Specifically, the monitoring unit is configured with the file path to be monitored and the filename of the target log file. After the monitoring unit starts monitoring normally, it is triggered when the size of the target log file increases during routine monitoring. At this time, the monitoring unit records the size data of the target log file before the increase and the size data of the increase. Then, it reads the target log file in reverse order to read the size of the increase. At this time, the complete information of the increase can be obtained.

[0124] Then, a word segmenter is used to filter and segment the newly added record information, converting the entire content of the new record into a series of words or phrases. Each word or phrase is then categorized according to time, status description, noun, or other categories to obtain different types of keywords. Alternatively, regular expressions can be used to filter and segment the new record to obtain different types of keywords. These keywords are then combined in a specific order to generate a record summary. The status description category involves matching specific input words; if they match, the record is categorized as a status description. These specific words generally refer to words like success, exception, or failure.

[0125] Finally, the size data before the addition and the size data of the addition, along with the record description, are combined by the monitoring unit to generate JSON data information. This data information serves as the search criteria. Then, different types of search keywords are generated based on the record description. Finally, each search keyword is stored in the search database along with the corresponding search criteria.

[0126] For example, if the monitored log file is 1kb, and when the log file becomes 2kb, the monitoring unit is triggered. The monitoring unit records that the size before the addition was 1kb, and the size of the added data is also 1kb. Reading the 2kb content of the log file in reverse chronological order, it obtains the message "System. Exception: Database Connection is not available, request timed out 2023 / 01 / 29-00:00:00". Then, using a word segmenter, it filters and categorizes the data to obtain the time category '2023 / 01 / 29-00:00:00', the noun categories 'System' and 'Datebase', and the status description category 'Exception'. These are combined to obtain the record summary "2023 / 01 / 29-00:00:00 System Database Exception". The generated search criteria are: "Search criteria: {'Storage location': '1kb', 'Record size': '1kb', 'Record summary': '2023 / 01 / 29-00:00:00'}". Then, based on the record description, generate search keywords '2023 / 01 / 29-00:00:00', 'System', 'Datebase', and 'Exception', and store the four search keywords and search conditions in the search database.

[0127] This solution utilizes the size of each new entry in the target log file to read the log file in reverse chronological order, ensuring rapid retrieval of the latest new records. Then, by generating different types of keywords from the new record content and creating a record summary from these keywords, the core content of the new record is summarized. This allows users to determine whether they need the new record based on the summary. Furthermore, the system combines the size data before and after the new entry recorded by the monitoring unit, along with the record summary to generate search conditions and keywords, all of which improve the efficiency of subsequent record retrieval and reduce the time required to find the target record.

[0128] In some embodiments, the types of search keywords include: generation time, operator, operated party, and operation status; the search keywords include: characters entered in the search box, filtering time, and filtering status; determining all matching search keywords in the search database based on the search keywords includes: matching the characters entered in the search box with search keywords of operator type and operated party type, confirming search keywords with the same characters; matching filtering time with search keywords of generation time type, confirming search keywords with the same time; matching filtering status with search keywords of operation status type, confirming search keywords with the same characters describing the status; obtaining corresponding search conditions based on the search keywords includes: classifying search keywords according to type; obtaining corresponding search conditions for different types of search keywords; comparing the search conditions corresponding to different types of search keywords; and selecting the search conditions that appear repeatedly in the search conditions corresponding to all types of search keywords as the search conditions corresponding to the search keywords.

[0129] The operator can be a user or a system, and the operated entity can be a system or some data. The filtering time and filtering status are selected by checkboxes. The filtering time can be a time period or a specific time point, and the filtering status can be words such as success, failure, or exception.

[0130] The search input box contains prompts indicating that the characters entered by the user should be the operator or the person being operated on in the log to be searched. If the format of the input entered by the user in the search box does not conform to the preset input information, an input error will be prompted and the user will be asked to re-enter the information.

[0131] Specifically, when a user enters search keywords on the search page, the user can choose to enter the operator or the operated party information in the search input box, or check the occurrence time of the log record and the status of the log record. All three can be entered at the same time, or only some of them can be entered.

[0132] Then, based on the search keywords entered by the user, separate searches are performed. The search keywords in the search input box are searched in the categories of operator and operated party, the search keywords for the occurrence time of the selected log record are searched in the category of generation time, and the search keywords for the status of the selected log record are searched in the category of operation status, resulting in three categories of search results.

[0133] When searching for keywords in the search input box within the categories of operator and operated-person search keywords, a precise query based on character comparison is used. That is, a match is considered successful only when the search keyword is exactly the same as the search keyword.

[0134] When searching for the occurrence time of the selected log records within the generation time search keyword category, a range search method is used. If the selected occurrence time is a time period, all search keywords with generation times within that time period will be successfully matched. If the selected occurrence time is a specific point in time, an exact search method is used, and only those with exactly the same time point will be successfully matched.

[0135] When searching for the status of the selected log entries within the operation status search keyword category, a precise query using character comparison is used. A successful match is achieved only if the search keyword and the retrieved keyword are exactly the same.

[0136] The above three categories may yield multiple search keywords. By matching the search keywords of each category with the search conditions, three sets of search conditions can be obtained. By comparing the three sets of search conditions in pairs, the search conditions that appear in all three sets are selected as the search conditions corresponding to the current search keywords.

[0137] It should be noted that if the entered search keywords contain only one or two of these keywords, then no type of input will be selected for the search.

[0138] This solution categorizes and refines search keywords and retrieval criteria, and performs search matching for each category separately, enabling efficient searching of user-input keywords. Finally, it compares and filters the retrieval conditions corresponding to each category, selecting those conditions that simultaneously match the search keywords, thereby improving the retrieval accuracy of target log records.

[0139] In some embodiments, the target record and the corresponding search conditions are associated and stored in the cache. Based on the target search conditions, the specific location of the corresponding record in the log file is determined, including: based on the target search conditions, checking whether the target search conditions are present in the cache; if present, confirming the specific location of the target record in the cache; if not present, determining the specific location of the corresponding record in the log file based on the target search conditions.

[0140] The cache is a temporary storage in memory, and the actual search is performed in memory, which is faster than disk reads.

[0141] Specifically, after the server returns and displays the target record to the user, it stores the target record and the corresponding search conditions in a one-to-one correspondence in the cache.

[0142] After the user specifies the record description, when retrieving the search criteria corresponding to the specified record description, the search criteria are searched in the cache. If the search criteria are present in the cache, the target record corresponding to the search criteria is retrieved from the cache. If the search criteria are not present in the cache, the corresponding target record is retrieved from the log file according to the 'storage location' contained in the search criteria.

[0143] This solution stores the target records that users have searched in the cache, so that these target records can be retrieved through the cache when they are searched a second or multiple times. This reduces search time and disk read pressure when certain target records are searched frequently, and further optimizes the efficiency of log retrieval.

[0144] Furthermore, storing the target record and the corresponding search conditions in the cache includes: determining whether the number of target records stored in the cache exceeds the preset storage limit; if so, deleting the record with the fewest queries and the search conditions corresponding to the record from the cache, and then storing the target record and the corresponding search conditions in the cache; if not, storing the target record and the corresponding search conditions in the cache.

[0145] The preset storage number is the number of records that the cache can store in advance.

[0146] It should be noted that when retrieving the target record corresponding to the search conditions from the cache, the target record will be marked with a number. The number will be incremented by 1 each time the record is retrieved. The initial number is 1. Target records that have not been retrieved from the cache will not be marked with a number.

[0147] Specifically, before storing the target record and its corresponding search criteria in the cache each time, the number of records stored in the cache is checked. If the number of records in the cache has reached the preset storage limit, the numerical tag of each target record is queried. Target records without numerical tags are randomly deleted. If no target records with numerical tags are found, the target record with the smallest numerical tag is deleted. If the preset limit has not been reached, the target record and its corresponding search criteria are stored in the cache.

[0148] This solution protects the normal use of memory space by setting a preset number of cache entries. By replacing the target records in the cache that are queried less frequently, it ensures that the target records stored in the cache are all frequently searched records, which improves the search efficiency of target log records to a certain extent.

[0149] In some embodiments, a cache update time is set. When the set cache update time is reached, the number of times each record in the cache has been queried is queried, and all records whose number of queries is less than a preset number are deleted.

[0150] The preset number of queries is the number of times the target record is queried in advance, and the cache update time is the time at which the target record is periodically cleared from the cache in advance.

[0151] Specifically, when the set cache update time is reached, the numerical markers of all target records are queried. If the numerical marker is less than or equal to the preset number of times, the target record corresponding to that numerical marker is deleted.

[0152] For example, if the preset number of updates is 2 and the cache update time is set to one month, then every month, the numerical markers of all target records are queried. If the numerical marker is less than or equal to 2, the target record is deleted.

[0153] This solution allows you to set a cache update time to periodically delete target records that have been queried a low number of times within a period, so that the target records in the cache are all target records that have been queried a high number of times in the most recent period.

[0154] Figure 3 This is a schematic diagram of the structure of a log retrieval device provided in an embodiment of this application, as shown below. Figure 3 As shown, the log retrieval device 300 includes:

[0155] The first acquisition module 301 is used to acquire search keywords.

[0156] The matching module 302 is used to determine all search keywords in the search database that match the search keywords based on the search keywords.

[0157] The retrieval module 303 is used to obtain the corresponding retrieval conditions based on the retrieval keywords; for each retrieval condition, obtain the record summary of the retrieval condition; generate a list of record summary based on all record summary, and call the display module to display the summary list.

[0158] The second acquisition module 304 is used to acquire a specified record summary; the specified record summary is a record summary selected according to the summary list.

[0159] The reading module 305 is used to determine the target retrieval conditions based on the specified record description; determine the specific location of the corresponding record in the log file based on the target retrieval conditions; obtain the target record based on the specific location; and call the display module to display the target record.

[0160] In some embodiments, the log retrieval device 300 further includes: a monitoring module 306;

[0161] Monitoring module 306 is used to monitor the target log file and obtain the new records of the target log file;

[0162] Based on the newly added record, determine the search conditions and search keywords corresponding to the newly added record;

[0163] The search criteria and search keywords are stored in the search database.

[0164] In some embodiments, when the monitoring module 306 monitors the target log file and obtains new records in the target log file, it is specifically used to: obtain the storage location of the target log file and monitor the size of the target log file;

[0165] When a new file is added to the target log file, record the size of the target log file before the addition and the size after the addition.

[0166] Based on the newly added size data, read the changed target log file in reverse order to obtain the newly added records;

[0167] When the monitoring module 306 determines the search conditions and search keywords corresponding to the newly added record, it is specifically used for:

[0168] Generate a record summary by combining keywords from the newly added record;

[0169] Based on the previous size data, the new size data, and the record description, generate search criteria;

[0170] Based on the record summary, different types of search keywords are extracted.

[0171] In some embodiments, the type of the retrieval keyword includes: generation time, operator, operated party, and operation status; the search keyword includes: characters entered in the search box, filtering time, and filtering status.

[0172] When the matching module 302 determines all search keywords in the search database that match the search keyword based on the search keyword, it is specifically used to: match the characters input in the search box with search keywords of operator type and operated-person type based on the search keyword to confirm search keywords with the same characters; match the filtering time with search keywords of generation time type to confirm search keywords with matching times; and match the filtering status with search keywords of operation status type to confirm search keywords with the same characters describing the status.

[0173] When the retrieval module 303 obtains the corresponding retrieval conditions based on the retrieval keywords, it is specifically used for:

[0174] The search keywords are categorized according to type;

[0175] Based on different types of search keywords, obtain the corresponding search conditions;

[0176] The search conditions corresponding to different types of search keywords are compared, and the search conditions that appear repeatedly in the search conditions corresponding to all types of search keywords are selected as the search conditions corresponding to the search keywords.

[0177] In some embodiments, the log retrieval device 300 further includes a cache module 307;

[0178] Cache module 307 is used to associate and store the target record and the search conditions corresponding to the target record in the cache;

[0179] When the reading module 305 determines the specific location of the corresponding record in the log file based on the target retrieval conditions, it is specifically used for:

[0180] Based on the target retrieval criteria, check whether the target retrieval criteria are present in the cache. If they are present, confirm the specific location of the target record in the cache.

[0181] If the record is not found, the specific location of the corresponding record in the log file is determined based on the target retrieval criteria.

[0182] In some embodiments, when the caching module 307 associates and stores the target record and the corresponding search conditions in the cache, it is specifically used for:

[0183] Determine whether the number of target records stored in the cache exceeds the preset storage limit;

[0184] If so, delete the record with the fewest queries and the search conditions corresponding to the record from the cache, and then associate and store the target record and the search conditions corresponding to the target record in the cache;

[0185] If not, the target record and the corresponding search conditions are associated and stored in the cache.

[0186] In some embodiments, the log retrieval device 300 further includes: an update module 308;

[0187] Update module 308 is used to set the cache update time;

[0188] When the set cache update time is reached, query the number of times each record in the cache has been queried;

[0189] Delete all records whose query count is less than the preset number.

[0190] The apparatus of this embodiment can be used to execute the method of any of the above embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0191] Figure 4 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application, such as... Figure 4 As shown, the electronic device 400 of this embodiment may include a memory 401 and a processor 402.

[0192] The memory 401 stores a computer program that can be loaded by the processor 402 and execute the methods described in the above embodiments.

[0193] The processor 402 and the memory 401 are connected, for example, via a bus.

[0194] Optionally, the electronic device 400 may also include a transceiver. It should be noted that in practical applications, the transceiver is not limited to one, and the structure of the electronic device 400 does not constitute a limitation on the embodiments of this application.

[0195] Processor 402 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 602 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0196] A bus can include a pathway for transmitting information between the aforementioned components. The bus can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, only one thick line is used in the diagram, but this does not imply that there is only one bus or one type of bus.

[0197] The memory 401 may be a ROM (Read Only Memory) or other type of static storage device capable of storing static information and instructions, RAM (Random Access Memory) or other type of dynamic storage device capable of storing information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0198] The memory 401 is used to store application code that executes the solution of this application, and its execution is controlled by the processor 402. The processor 402 is used to execute the application code stored in the memory 401 to implement the content shown in the foregoing method embodiments.

[0199] Electronic devices include, but are not limited to: mobile terminals such as mobile phones, laptops, digital radio receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), and in-vehicle terminals (such as in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Servers can also be included. Figure 4 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0200] The electronic device in this embodiment can be used to execute the method of any of the above embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0201] This application also provides a computer-readable storage medium storing a computer program that can be loaded by a processor and execute the methods described in the above embodiments.

[0202] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

Claims

1. A log retrieval method, characterized in that, include: Obtain the storage location of the target log file and monitor the size of the target log file; When a new file is added to the target log file, record the size of the target log file before the addition and the size after the addition. Based on the newly added size data, read the changed target log file in reverse order to obtain the newly added records; Generate a record summary by combining keywords from the newly added record; Based on the previous size data, the new size data, and the record description, generate search criteria; Based on the record summary, extract different types of search keywords; Based on the newly added record, determine the search conditions and search keywords corresponding to the newly added record; The search criteria and search keywords are stored in the search database. Get search keywords; The search keywords include: characters entered in the search box, filtering time, and filtering status; Based on the search keywords, determine all search keywords in the search database that match the search keywords; The search keywords are categorized according to type; the types of search keywords include: generation time, operator, operated on, and operation status. Based on different types of search keywords, obtain the corresponding search conditions; The search conditions corresponding to different types of search keywords are compared, and the search conditions that appear repeatedly in the search conditions corresponding to all types of search keywords are selected as the search conditions corresponding to the search keywords. For each search condition, obtain a brief description of the records in the search condition; Generate a list of record descriptions based on all record descriptions, and then display the list of descriptions. Get a description of a specified record; the specified record description is the description of the record selected from the description list; Based on the specified record summary, determine the target search criteria; Based on the target retrieval criteria, determine the specific location of the corresponding record in the log file; Based on the specific location, obtain the target record and display the target record.

2. The method according to claim 1, characterized in that, The step of determining all search keywords in the search database that match the search keyword based on the search keyword includes: Based on the search keywords, the characters entered in the search box are matched with the search keywords for operator type and operator type to confirm search keywords with the same characters; the filter time is matched with the search keywords for generation time type to confirm search keywords with matching time; the filter status is matched with the search keywords for operation status type to confirm search keywords with the same characters describing the status.

3. The method according to claim 1 or 2, characterized in that, Also includes: The target record and the corresponding search conditions are associated and stored in the cache; Determining the specific location of the corresponding record in the log file based on the target retrieval criteria includes: Based on the target retrieval criteria, check whether the target retrieval criteria are present in the cache. If they are present, confirm the specific location of the target record in the cache. If the record is not found, the specific location of the corresponding record in the log file is determined based on the target retrieval criteria.

4. The method according to claim 3, characterized in that, The step of associating and storing the target record and the corresponding search conditions in the cache includes: Determine whether the number of target records stored in the cache exceeds the preset storage limit; If so, delete the record with the fewest queries and the search conditions corresponding to the record from the cache, and then associate and store the target record and the search conditions corresponding to the target record in the cache; If not, the target record and the corresponding search conditions are associated and stored in the cache.

5. The method according to claim 4, characterized in that, The method further includes: Set the cache update time; When the set cache update time is reached, query the number of times each record in the cache has been queried; Delete all records whose query count is less than the preset number.

6. A log retrieval device, characterized in that, include: The monitoring module is used to obtain the storage location of the target log file and monitor the size of the target log file; when a new entry is made to the target log file, it records the size data of the target log file before the entry and the size data after the entry; based on the size data after the entry, it reads the changed target log file in reverse order to obtain the new record; it combines keywords in the new record to generate a record description; based on the size data before the entry, the size data after the entry, and the record description, it generates search conditions; based on the record description, it extracts different types of search keywords; based on the new record, it determines the search conditions and search keywords corresponding to the new record. The search criteria and search keywords are stored in the search database. The first acquisition module is used to acquire search keywords; The search keywords include: characters entered in the search box, filtering time, and filtering status; The matching module is used to determine all search keywords in the search database that match the search keywords based on the search keywords. The retrieval module is used to classify the search keywords according to their types, including: generation time, operator, operated on, and operation status. It obtains corresponding search conditions for each type of search keyword, compares the search conditions corresponding to different types of search keywords, and selects the search conditions that appear repeatedly in all types of search keyword search conditions as the search conditions corresponding to the search keyword. For each search condition, it obtains a record summary from the search condition; based on all record summaries, it generates a list of record summaries and calls the display module to display the summary list. The second acquisition module is used to acquire a description of a specified record; the specified record description is a description of a record selected according to the description list; The reading module is used to determine the target search conditions based on the specified record description; determine the specific location of the corresponding record in the log file based on the target search conditions; obtain the target record based on the specific location; and call the display module to display the target record.

7. An electronic device, characterized in that, include: Memory and processor; The memory is used to store program instructions; The processor is configured to call and execute program instructions in the memory to perform the log retrieval method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program; when the computer program is executed by a processor, it implements the log retrieval method as described in any one of claims 1-5.

Images