Information processing method and device, electronic equipment and storage medium

Abstract

The present disclosure provides an information processing method and device, electronic equipment and storage medium; the technical field of data processing is designed, and specifically relates to the fields of big data, intelligent search and knowledge graph. The specific implementation scheme is: obtaining plaintext logs of each module in a server; obtaining a link topology graph between the modules based on the plaintext logs; wherein, the nodes of the link topology graph are the modules, and the edges between the nodes indicate the upstream and downstream relationships between the nodes; and determining the source module of a return field in the plaintext logs according to the link topology graph. In the embodiment of the present disclosure, the upstream and downstream relationships between the modules are determined through the link topology graph, the source module of the return field is confirmed based on the upstream and downstream relationships between the modules, the corresponding source module can be quickly located according to the return field of the exception in the exception investigation, the investigation cost is reduced, and the exception investigation effect is improved.

Description

Technical Field

[0001] This disclosure relates to the field of data processing technology, specifically to the fields of big data, intelligent search, and knowledge graphs, and particularly to an information processing method, apparatus, electronic device, and storage medium. Background Technology

[0002] Current server-side applications tend to be microservice-based, so the analysis of field sources is an important research topic for analyzing interactions between modules. Currently, the module links are long and there are no complete request and return plaintext logs for analysis, resulting in high costs and poor analysis results for analyzing field sources. Summary of the Invention

[0003] This disclosure provides an information processing method, apparatus, electronic device, and storage medium.

[0004] According to a first aspect of this disclosure, an information processing method is provided, comprising: obtaining plaintext logs of each module within a server; obtaining a link topology diagram between the modules based on the plaintext logs; wherein the nodes of the link topology diagram are modules, and the edges between nodes indicate the upstream and downstream relationships between nodes; and determining the source module of the returned fields in the plaintext logs based on the link topology diagram.

[0005] According to a second aspect of this disclosure, an information processing apparatus is provided, comprising: a first acquisition module for acquiring plaintext logs of each module within a server; a second acquisition module for acquiring a link topology diagram between the modules based on the plaintext logs; wherein the nodes of the link topology diagram are modules, and the edges between nodes indicate the upstream and downstream relationships between nodes; and a third acquisition module for determining the source module of the returned fields in the plaintext logs based on the link topology diagram.

[0006] According to a third aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method of the first aspect.

[0007] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are configured to cause the computer to perform the method described in the first aspect.

[0008] According to a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0009] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0010] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0011] Figure 1 This is a flowchart illustrating an information processing method provided in an embodiment of this disclosure;

[0012] Figure 1A This is an interactive diagram of a server module provided in an embodiment of this disclosure;

[0013] Figure 2 This is a flowchart illustrating another information processing method provided in an embodiment of this disclosure;

[0014] Figure 3 This is a flowchart illustrating another information processing method provided in an embodiment of this disclosure;

[0015] Figure 4 This is a flowchart illustrating another information processing method provided in an embodiment of this disclosure;

[0016] Figure 5 This is a flowchart illustrating another information processing method provided in an embodiment of this disclosure;

[0017] Figure 6 This is a flowchart illustrating another information processing method provided in an embodiment of this disclosure;

[0018] Figure 7 This is a schematic diagram of the structure of an information processing device provided in an embodiment of this disclosure;

[0019] Figure 8 This is a block diagram of an electronic device used to implement the information processing method of the embodiments of this disclosure. Detailed Implementation

[0020] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0021] Data processing is the collection, storage, retrieval, processing, transformation, and transmission of data. Its basic purpose is to extract and derive valuable and meaningful data from large amounts of potentially messy and difficult-to-understand data.

[0022] Big data, also known as massive data, refers to data of such enormous scale that it cannot be captured, managed, processed, and organized into information that helps businesses make more proactive decisions within a reasonable timeframe using mainstream software tools. Big data includes structured, semi-structured, and unstructured data, with unstructured data increasingly becoming the main component.

[0023] Intelligent Search is a next-generation search engine that incorporates artificial intelligence technology. In addition to providing traditional functions such as fast retrieval and relevance ranking, it also offers features like user role registration, automatic user interest identification, semantic understanding of content, intelligent information filtering, and push notifications.

[0024] A knowledge graph, known in the library and information science field as knowledge domain visualization or knowledge domain mapping map, is a series of different graphics that display the development process and structural relationships of knowledge. It uses visualization technology to describe knowledge resources and their carriers, mines, analyzes, constructs, draws and displays knowledge and the interrelationships between them, and displays complex knowledge domains through data mining, information processing, knowledge measurement and graphic drawing.

[0025] Figure 1 This is a flowchart illustrating an information processing method provided in an embodiment of this disclosure. Figure 1 As shown, the method includes:

[0026] S101, retrieve plaintext logs from each module within the server.

[0027] In some implementations, the server-side includes multiple modules, such as a database module, a security module, a web module, a time module, and a load balancing module. Because each module in the server-side has a different functional role (e.g., storage module and processing module), the interaction between the client and the server may trigger coordination among multiple modules to meet the client's needs, resulting in interactions between these modules. Figure 1A As shown, when the client interacts with the server module 1, the implementation of the interaction service may also depend on module 2 and module 3. Among them, module 2 has a dependency relationship with module 4, and module 3 has a dependency relationship with module 5, module 6, ... and module n.

[0028] In some implementations, data exchanged between modules is recorded as logs; these logs can be in plaintext format, meaning the data exchanged between modules is in plaintext. In other implementations, the logs can be in binary format.

[0029] Optionally, plaintext logs can include both request and response data from the module. That is, the module's plaintext log includes fields from both the request and response data, providing a more accurate basis for troubleshooting when performing anomaly analysis based on the module's plaintext logs. It's understandable that, in some cases, request data can be referred to as request logs, and response data as response logs.

[0030] In some implementations, the plaintext logs of a module can be stored in the server's own memory, meaning that the module's plaintext logs can be read from its own memory.

[0031] In some implementations, the module's plaintext logs can also be stored on external storage devices, meaning that the module's plaintext logs can be read from external storage devices.

[0032] In some implementations, plaintext logs from various modules on the server can be obtained using a common logging software development kit (SDK). The logging SDK is a fundamental dependency SDK that provides capabilities such as unified client-side log printing, log level control, and module-specific log isolation, enabling more efficient acquisition of module-specific plaintext logs.

[0033] In other implementations, plaintext logs from various modules on the server can be obtained based on pre-defined middleware.

[0034] Optionally, middleware may include tools such as netbridge, nginx proxy server, and open-source tool Goreplay. Modules can directly request middleware services, allowing the middleware technology to store plaintext logs of module requests and responses, and retrieve the plaintext logs of each module on the server from the middleware.

[0035] S102, Obtain the link topology diagram between modules based on plaintext logs.

[0036] In this link topology graph, the nodes are modules, and the edges between nodes indicate the upstream and downstream relationships between them.

[0037] In some implementations, when modules interact, upstream and downstream relationships exist between them. This means that from the perspective of the current module, each step depends on a step in its upstream module, and each downstream module adds further processing logic or procedures to the current module. For example, module C depends on module B, and module B depends on module A. Module A is the upstream module of module B, and module B is the upstream module of module C. Module C imports all the functionalities of modules B and A and adds its own unique processing logic or procedures; therefore, module C is a downstream module.

[0038] Optionally, the module's request and return data can be determined based on the module's plaintext logs, thereby identifying other modules interacting with the current module. It is understood that these other modules interacting with the current module may be upstream or downstream modules of the current module.

[0039] Furthermore, after identifying other modules that interact with the current module, the corresponding Internet Protocol (IP) address can be obtained. Based on the module's IP address, upstream and downstream modules can be determined, and the current module, its upstream modules, and downstream modules can be associated based on these upstream and downstream relationships. It can be understood that the edges connecting modules indicate their upstream and downstream relationships; for example, the direction of the arrow on an edge determines whether a module is upstream or downstream. In other words, the link topology graph is a directed graph, and the upstream and downstream relationships between modules can be intuitively determined based on this graph.

[0040] Optionally, all modules in the server can be traversed, and the upstream and downstream modules of each traversed module can be summarized to determine the link topology diagram between all modules.

[0041] Understandably, the link topology diagram shows the upstream and downstream relationships between different modules.

[0042] S103, Based on the link topology diagram, determine the source module of the fields returned in the plaintext log.

[0043] After determining the link topology, the upstream and downstream interaction relationships between different modules, that is, the dependency relationships between modules, can be determined based on the link topology. For any returned field in the plaintext log, the source module of the returned field can be determined based on whether the returned field is in the plaintext log of the module.

[0044] It is understandable that the source module is the module that returns the returned field; when the returned field does not belong to the plaintext log of the current module, other related modules of the current module can be determined according to the link topology diagram, and it can be determined whether the returned field belongs to other related fields.

[0045] For example, assuming that for any returned field of module A, it can be determined whether the plaintext log of module A includes the returned field. If it does, the returned field can be considered to originate from module A. Correspondingly, if the plaintext log of module A does not include the returned field, one or more downstream associated modules of module A are determined according to the link topology diagram, it is determined whether one or more downstream associated modules include the returned field, and the downstream associated module that includes the returned field is obtained as the source module of the returned field.

[0046] Furthermore, after determining the source module corresponding to each returned field, if there is an anomaly in the returned field, the corresponding abnormal module can be quickly located based on the source module of the returned field, thereby improving the efficiency of troubleshooting module anomalies.

[0047] In this embodiment, plaintext logs corresponding to all modules on the server are obtained. The plaintext logs of the modules are acquired using a common log SDK or middleware, improving the efficiency of plaintext log acquisition and providing a more accurate foundation for subsequent anomaly investigation based on plaintext logs. A link topology diagram between modules is determined based on the plaintext logs corresponding to each module, providing a more intuitive understanding of the upstream and downstream relationships between modules. The source module of the returned field is determined based on the link topology diagram. During anomaly investigation, the corresponding source module can be quickly located based on the abnormal returned field, identifying the specific abnormal module, reducing investigation costs, solving the current problem of lacking complete plaintext log analysis, and resulting in better anomaly investigation performance.

[0048] Figure 2 This is a flowchart illustrating another information processing method provided in an embodiment of this disclosure. Figure 2 As shown, the method includes:

[0049] S201, retrieve plaintext logs from each module within the server.

[0050] In some implementations, after obtaining the plaintext logs from each module, the plaintext logs can be preprocessed, filtered, and the filtered plaintext logs can be saved for subsequent analysis to ensure the reliability of the analysis data and improve the accuracy of the final analysis results.

[0051] In some implementations, a first keyword can be obtained; the plaintext logs can be identified using the first keyword; plaintext logs containing the first keyword can be used as target plaintext logs; and a link topology diagram between modules can be obtained based on the target plaintext logs. In other words, by setting a first keyword, plaintext logs containing the first keyword are included as target plaintext logs, and subsequent analysis is performed based on the target plaintext logs.

[0052] In some implementations, a log whitelist can be obtained; based on the log whitelist, target plaintext logs within the plaintext logs can be determined; and a link topology diagram between modules can be obtained based on the target plaintext logs. In other words, by setting a log whitelist, plaintext logs included in the whitelist are used as target plaintext logs; and a link topology diagram between modules is obtained based on the target plaintext logs.

[0053] In some implementations, a unique identifier corresponding to the target plaintext log can be obtained; based on the request and return data in the target plaintext log, the first module that interacts with the module corresponding to the target plaintext log can be determined; based on the unique identifier, the target plaintext log can be associated with the first target plaintext log corresponding to the first module; and based on the associated target plaintext log, a link topology diagram between modules can be obtained.

[0054] Optionally, the unique identifier corresponding to the target plaintext log can be the identity document (Id) of the module corresponding to the target plaintext log. The request data and return data in the target plaintext log reflect the first module that interacts with the module corresponding to the target plaintext log. Based on the Id, the first module that interacts with the module corresponding to the target plaintext log is associated with the module, which provides a basis for obtaining the link topology diagram between modules and improves the efficiency of link topology diagram analysis.

[0055] In this embodiment of the disclosure, the method for implementing step S201 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0056] S202, starting from any module, traverses all modules within the server.

[0057] It is understandable that each module may interact with one or more other modules. For example, module B may be a downstream module of module A or an upstream module of module C. Therefore, each module in the server needs to be analyzed.

[0058] Optionally, starting from any module, each module within the server can be traversed and analyzed to ensure a complete analysis of the upstream and downstream relationships of all modules, resulting in a more reliable link topology diagram.

[0059] S203, obtain the first service identifier of the request downstream log in the plaintext log corresponding to the current traversal module.

[0060] In some implementations, the first service identifier for the requested downstream log is obtained from the plaintext log of the currently traversed module. Optionally, the first service identifier can be the IP address of the requested downstream log. It is understood that the plaintext logs used for analysis in this case are all filtered target plaintext logs.

[0061] It is understandable that the request downstream log is the request data when requesting downstream services. Based on the first service identifier of the request downstream log, the module corresponding to the first service identifier can be obtained, and thus the downstream module corresponding to the currently traversed module can be obtained.

[0062] S204, locate the first downstream module based on the first service identifier, and mark the first downstream module as the downstream module of the currently traversed module.

[0063] After obtaining the first service identifier of the request downstream log in the plaintext log of the current traversal module, the corresponding first downstream module can be located based on the first service identifier. That is, the first downstream module is determined based on the IP address of the request downstream log, which is the downstream module of the current traversal module.

[0064] Optionally, a relationship can be established between the current traversal module and its corresponding downstream module, including upstream and downstream relationships.

[0065] Iterate through all modules, obtain the first service identifier of the request downstream log in the plaintext log of each traversed module, and then determine the first downstream module based on the first service identifier to obtain the downstream module of each traversed module.

[0066] S205. Determine the link topology between modules based on the downstream modules corresponding to the modules.

[0067] After obtaining the downstream modules corresponding to each module, the downstream modules of all modules are aggregated to determine the link topology graph between modules. In this link topology graph, each node represents a module, and the edges between nodes indicate the upstream and downstream relationships between the corresponding modules.

[0068] S206, Based on the link topology diagram, determine the source module of the fields returned in the plaintext log.

[0069] In this embodiment of the disclosure, the method for implementing step S206 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0070] In this embodiment, the plaintext logs are preprocessed to obtain target plaintext logs before analysis, and the link topology map is obtained based on the target plaintext logs, thereby improving the efficiency of obtaining the link topology map. Starting with any module, a traversal analysis is performed. Based on the first service identifier in the plaintext log of the currently traversed module, the first downstream module is located, and the downstream modules of the currently traversed module are obtained. All modules are traversed to obtain their corresponding downstream modules, thereby constructing a link topology map between modules. The obtained link topology map is more complete and reliable, and more accurately reflects the upstream and downstream relationships between modules. The source module of the returned field is obtained based on the more accurate link topology map, with higher accuracy.

[0071] Figure 3 This is a flowchart illustrating another information processing method provided in an embodiment of this disclosure. Figure 3 As shown, the method includes:

[0072] S301, retrieve plaintext logs from each module within the server.

[0073] In this embodiment of the disclosure, the method for implementing step S301 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0074] S302, Obtain the link topology diagram between modules based on plaintext logs.

[0075] In this embodiment of the disclosure, the method for implementing step S302 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0076] S303, Based on the link topology diagram, determine one or more second downstream modules corresponding to the plaintext log module.

[0077] It is understandable that the link topology diagram includes the upstream and downstream relationships between modules, so all downstream modules corresponding to any module can be determined based on the link topology diagram.

[0078] In some implementations, the module corresponding to the plaintext log is identified, and one or more second downstream modules corresponding to that module are obtained according to the link topology diagram. Then, it is determined whether the one or more second downstream modules are the source modules of the returned fields.

[0079] S304, Determine the module corresponding to the requested data.

[0080] In some implementations, the returned fields of the plaintext log may originate from the request data in the plaintext log. Therefore, when determining the source module of the returned fields, the module corresponding to the request data is retrieved.

[0081] In some implementations, the request data is the same as the request data in the plaintext log, so the module corresponding to the request data is also the module corresponding to the plaintext log.

[0082] S305, determine the source module of the returned field from the second downstream module and the module corresponding to the requested data.

[0083] In some implementations, the returned field may be the same as the returned field from the plaintext log request, or it may be the returned field from a downstream module. Therefore, after identifying the module corresponding to the requested data and the second downstream module corresponding to the plaintext log, the source module of the returned field is determined from the second downstream module and the module corresponding to the requested data.

[0084] In some implementations, if the requested data includes the returned field, then the module corresponding to the requested data is the source module of the returned field.

[0085] In some implementations, if the returned data of the second downstream module includes the returned field, then the second downstream module that includes the returned field is the source module of the returned field.

[0086] In this embodiment of the disclosure, after confirming the link topology diagram between modules, one or more second downstream modules of the module corresponding to the returned field can be determined based on the link topology diagram. Furthermore, the module that obtains the requested data, that is, the module of the plaintext log where the returned field is located, determines the source module of the returned field from the module that requested the data and the second downstream module. This reduces the cost of checking each module one by one and improves the efficiency and accuracy of determining the source module of the returned field.

[0087] Figure 4 This is a flowchart illustrating another information processing method provided in an embodiment of this disclosure. Figure 4 As shown, the method includes:

[0088] S401, retrieve plaintext logs from each module within the server.

[0089] In this embodiment of the disclosure, the method for implementing step S401 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0090] S402, Obtain the link topology diagram between modules based on plaintext logs.

[0091] In this embodiment of the disclosure, the method for implementing step S402 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0092] S403, Based on the link topology diagram, determine one or more second downstream modules corresponding to the plaintext log module.

[0093] In this embodiment of the disclosure, the method for implementing step S403 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0094] S404, Determine the module corresponding to the requested data.

[0095] In this embodiment of the disclosure, the method for implementing step S404 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0096] S405, determine whether the returned field is in the request data of the plaintext log.

[0097] In some implementations, the plaintext logs for each module can be pre-processed with formatting to ensure consistent data format. Optionally, the data in the plaintext logs can be serialized into key-value pairs. For example, JavaScript Object Notation (JSON) string structures can be serialized into key-value pairs. JSON strings are a lightweight data interchange format.

[0098] As we can understand, a key-value pair is a data structure consisting of a key and a corresponding value, with a one-to-one relationship between the key and the value. In a key-value pair, each key is unique, and the corresponding value can be of any data type, such as an integer, string, boolean, or object. This converts data from plaintext logs into key-value pairs to facilitate data analysis.

[0099] In some implementations, the key-value pair corresponding to the returned field is determined; based on the key-value pair corresponding to the returned field and the key-value pair in the request data, it is determined whether the returned field is in the request data of the plaintext log.

[0100] Optionally, the determination can be based on the key of the returned field. This involves iterating through the keys of each key-value pair in the request data of the plaintext log and determining if a key matching the key of the returned field exists in the request data. If a key matching the returned field exists in the request data, then the returned field is in the request data of the plaintext log. Conversely, if a key matching the returned field does not exist in the request data, then the returned field is not in the request data of the plaintext log.

[0101] S406, If the returned field is in the requested data, determine whether the requested data includes the key value of the returned field.

[0102] In some implementations, if it is determined that the returned field is in the request data, it is further determined whether the request data includes the key value of the returned field.

[0103] Optionally, the key value of the returned field can be the corresponding value in the key-value pair of the returned field. Whether the requested data includes the key value of the returned field allows for a more accurate determination of whether the module requesting the data is the source module of the returned field.

[0104] S407, In response to the request data including a key value of a returned field, determine the module corresponding to the plaintext log as the source module of the returned field.

[0105] When the requested data includes a key value of the returned field, that is, when the requested data includes a key of the returned field and the corresponding value of that key in the requested data is equal to the corresponding value of the returned field, then it is determined that the source module of the returned field is the module corresponding to the requested data.

[0106] For example, suppose the request data of module A includes the key corresponding to the returned field a. This means that the returned field a is in the request data of module A. Further, it is determined whether module A includes the key value of the returned field a. If the returned field a is in the request data of module A, and the corresponding value of the key of the returned field a in the request data is equal to the corresponding value of the returned field a, then it is determined that the source module of the returned field a is module A.

[0107] S408, if the returned field does not exist in the requested data, obtain the first similarity between the returned field and the requested data.

[0108] In some implementations, if it is determined that the returned field does not exist in the requested data, the first similarity between the returned field and the requested data is calculated. If the first similarity value is large, the module corresponding to the requested data is still used as the source module of the returned field.

[0109] Optionally, the first similarity can be calculated from the key-value pairs of the returned field and the key-value pairs of the requested data.

[0110] In some implementations, the third similarity between the key of the returned field and the key in the requested data can be obtained. Optionally, the third similarity can be obtained using a text similarity comparison algorithm. Commonly used text similarity comparison algorithms include Euclidean distance, Hamming distance, Levinshtam, or Jacquard indexing.

[0111] In some implementations, it is also possible to obtain the fourth similarity between the corresponding value of the returned field and the corresponding value in the requested data. That is, the third similarity of the keys and the fourth similarity of the corresponding values ​​in the key-value pairs of the returned field are compared with those in the key-value pairs of the requested data.

[0112] In this embodiment, the third similarity and the fourth similarity are used as the first similarity. Optionally, the sum of the third similarity and the fourth similarity can also be calculated as the first similarity.

[0113] S409, in response to the first similarity meeting the first set condition, determine the module corresponding to the plaintext log as the source module of the returned field.

[0114] After determining the first similarity, the larger the first similarity value, the more likely the returned field is to come from the module corresponding to the plaintext log. Therefore, a first setting condition is preset. When the first similarity meets the first setting condition, the module corresponding to the plaintext log is determined to be the source module of the returned field.

[0115] In some implementations, satisfying the first condition can be that both the third and fourth similarities are greater than the similarity threshold, or that the sum of the third and fourth similarities is greater than the similarity summation threshold.

[0116] When the first similarity meets the first set condition, it is determined that the key-value pairs of the returned field have a high similarity with the key-value pairs of the requested data. At this time, it is determined that the source module of the returned field is the module corresponding to the plaintext log.

[0117] In this embodiment, one or more second downstream modules corresponding to the module of the returned field are determined according to the link topology diagram. The returned field and the data in the plaintext log are formatted in a unified way to determine key-value pairs. The key in the key-value pair is used to determine whether the requested data includes the returned field. Then, different calculations are performed based on whether the returned field is included. This allows the determination of whether the returned field belongs to the requested data to be made regardless of whether the key of the returned field is included or not. When the requested data includes the returned field, the key value is directly compared to determine whether they are equal, quickly determining whether the module corresponding to the requested data is the source module of the returned field. When the requested data does not include the returned field, a first similarity is calculated, and it is determined whether the first similarity meets a preset condition. If the first similarity meets the preset condition, it is determined whether the module corresponding to the requested data is the source module of the returned field, improving the accuracy of the analysis of the source module of the returned field.

[0118] Figure 5 This is a flowchart illustrating another information processing method provided in an embodiment of this disclosure. Figure 5 As shown, the method includes:

[0119] S501, retrieve plaintext logs from each module within the server.

[0120] In this embodiment of the disclosure, the method for implementing step S501 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0121] S502, obtains the link topology diagram between modules based on plaintext logs.

[0122] In this embodiment of the disclosure, the method for implementing step S502 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0123] S503, based on the link topology diagram, determine one or more second downstream modules corresponding to the plaintext log module.

[0124] In this embodiment of the disclosure, the method for implementing step S503 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0125] S504, determine the module corresponding to the requested data.

[0126] In this embodiment of the disclosure, the method for implementing step S504 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0127] S505, determine whether the returned field is in the request data of the plaintext log.

[0128] In this embodiment of the disclosure, the method for implementing step S505 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0129] S506, If the returned field is in the requested data, determine whether the requested data includes the key value of the returned field.

[0130] In this embodiment of the disclosure, the method for implementing step S506 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0131] S507, if the returned field does not exist in the requested data, obtain the first similarity between the returned field and the requested data.

[0132] In this embodiment of the disclosure, the method for implementing step S507 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0133] S508, in response to the request data not including the key value of the returned field, or the first similarity not meeting the first set condition, determine whether the returned field is in the corresponding returned data of the second downstream module.

[0134] In some implementations, if the requested data does not include the key value of the returned field, it is determined that the module corresponding to the requested data is not the source module of the returned field; or if the first similarity does not meet the first set condition, it is determined that the module corresponding to the requested data is not the source module of the returned field.

[0135] Furthermore, after determining that the module corresponding to the requested data is not the source module of the returned field, the second downstream module is analyzed to determine whether the second downstream module of the module corresponding to the plaintext log is the source module of the returned field.

[0136] In some implementations, it can be determined whether the returned field exists in the returned data of the corresponding second downstream module. Alternatively, the determination can be made based on the key-value pair corresponding to the returned field and the key-value pair of the returned data of any second downstream module.

[0137] Optionally, the determination can be based on the key of the returned field. This involves iterating through the keys of each key-value pair in the returned data of the plaintext log of the second downstream module, and determining if a key matching the key of the returned field exists in the returned data. If a key matching the key exists in the returned data, then the returned field is present in the returned data of the corresponding second downstream module. Conversely, if no key matching the key exists in the returned data, then the returned field is not present in the returned data of the corresponding second downstream module.

[0138] S509, if the returned field is in the returned data, determine whether the returned data includes the key value of the returned field.

[0139] In some implementations, if it is determined that the returned field is in the returned data, it is further determined whether the returned data includes the key value of the returned field.

[0140] Optionally, the key value of the returned field can be the corresponding value in the key-value pair of the returned field. Whether the returned data includes the key value of the returned field allows for a more accurate determination of whether the second downstream module corresponding to the returned data is the source module of the returned field.

[0141] S510, in response to the return data including a key value of the return field, determine that the second downstream module is the source module of the return field.

[0142] When the returned data includes a key value of a returned field, that is, when the returned data includes the key of the returned field and the corresponding value of the key in the returned data is equal to the corresponding value of the returned field, then the source module of the returned field is determined to be the second downstream module corresponding to the returned data.

[0143] For example, assuming that the returned data of the second downstream module B includes the key corresponding to the returned field a, it means that the returned field a is in the returned data of the second downstream module B. Further, it is determined whether the second downstream module B includes the key value of the returned field a. If the returned field a is in the returned data of the second downstream module B, and the corresponding value of the key of the returned field a in the returned data is equal to the corresponding value of the returned field a, then it is determined that the source module of the returned field a is the second downstream module B.

[0144] S511, if the returned field does not exist in the returned data, obtain the second similarity between the returned field and the returned data.

[0145] In some implementations, if it is determined that the returned field does not exist in the returned data, a second similarity between the returned field and the returned data is calculated. If the second similarity value is large, the second downstream module corresponding to the returned data is still used as the source module of the returned field.

[0146] Optionally, the second similarity can be calculated from the key-value pairs of the returned fields and the key-value pairs of the returned data.

[0147] In some implementations, the fifth similarity between the key of the returned field and the key in the returned data can be obtained. Optionally, the fifth similarity can be obtained using a text similarity comparison algorithm. Commonly used text similarity comparison algorithms can be Euclidean distance, Hamming distance, Levinshtam, or Jacquard indexing, etc.

[0148] In some implementations, it is also possible to obtain the sixth similarity between the corresponding value of the returned field and the corresponding value in the returned data. That is, the fifth similarity of the keys and the sixth similarity of the corresponding values ​​in the key-value pairs of the returned field are compared with those in the key-value pairs of the returned data.

[0149] In this embodiment, the fifth and sixth similarities are used as the second similarity. Optionally, the sum of the fifth and sixth similarities can also be calculated as the second similarity.

[0150] S512, in response to the second similarity meeting the second set condition, determine the second downstream module as the source module of the returned field.

[0151] After determining the second similarity, the larger the value of the second similarity, the more likely the returned field is to originate from the second downstream module corresponding to the returned data. Therefore, a second setting condition is preset. When the second similarity meets the second setting condition, the second downstream module corresponding to the returned data is determined to be the source module of the returned field.

[0152] In some implementations, satisfying the second condition can be achieved by both the fifth and sixth similarities being greater than the similarity threshold, or by the sum of the fifth and sixth similarities being greater than the similarity summation threshold.

[0153] When the second similarity meets the second set condition, it is determined that the similarity between the key-value pairs of the returned field and the key-value pairs of the returned data is high. At this time, it is determined that the source module of the returned field is the second downstream module corresponding to the returned data.

[0154] In some implementations, if it is determined that the current second downstream module is not the source module of the returned field, the other second downstream modules are traversed and analyzed. Understandably, the traversal ends once the source module of the returned field is determined.

[0155] In some implementations, if neither the module corresponding to the plaintext log nor any of the second downstream modules is the source module of the returned field, then the returned field is determined to be a special processing field of the module corresponding to the plaintext log, which may be generated by the code of the plaintext log module.

[0156] In some implementations, when the traversing module forms an entire link in the link topology graph, the results of multiple modules can be correlated. For example, if the module corresponding to the current plaintext log is module A, and the second downstream modules corresponding to module A are modules C and D, and modules A, C, and D form an entire link in the link topology graph, then the data from modules A, C, and D can be integrated. For instance, assuming that the returned field 'a' in module A originates from the returned data of module C, and the returned data of module C originates from the returned data of module D, then the fields 'a' originating from module D, the grandchild node of module A, can be merged.

[0157] In some implementations, the source results of all fields and modules can be summarized to form a field source graph. The nodes in this field source graph are modules, and the lines connecting the nodes in the field source graph indicate the source of each field in the module.

[0158] In this embodiment, after determining that the module corresponding to the requested data is not the source module of the returned field, a traversal analysis is performed on the second downstream modules of the module corresponding to the requested data. It is determined whether one or more of the second downstream modules corresponding to the requested data are the source modules of the returned field. A preliminary analysis is performed based on whether the returned data of the second downstream module includes the returned field, and different calculation methods are determined based on whether the returned field is included. This allows for a secondary determination of whether the returned field originates from the second downstream module when the returned data includes or contains the key value of the returned field. Ultimately, the source module of the returned field in the second downstream module is determined, resulting in higher accuracy. At the same time, for modules in an entire chain, the results can be merged when determining the source module, reducing the error and calculation cost of checking the source module of the returned field, making the source module of the returned field more intuitive and accurate.

[0159] Figure 6This is a flowchart illustrating another information processing method provided in an embodiment of this disclosure. Figure 6 As shown, the method includes:

[0160] S601, retrieve plaintext logs from each module within the server.

[0161] In this embodiment of the disclosure, the method for implementing step S601 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0162] S602, starting from any module, traverses all modules within the server.

[0163] In this embodiment of the disclosure, the method for implementing step S602 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0164] S603, obtain the first service identifier of the request downstream log in the plaintext log corresponding to the current traversal module.

[0165] In this embodiment of the disclosure, the method for implementing step S603 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0166] S604, locate the first downstream module based on the first service identifier, and mark the first downstream module as the downstream module of the currently traversed module.

[0167] In this embodiment of the disclosure, the method for implementing step S604 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0168] S605, determine the link topology between modules based on the downstream modules corresponding to the module.

[0169] In this embodiment of the disclosure, the method for implementing step S605 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0170] S606, Based on the link topology diagram, determine one or more second downstream modules corresponding to the plaintext log module.

[0171] In this embodiment of the disclosure, the method for implementing step S606 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0172] S607, Determine the module corresponding to the requested data.

[0173] In this embodiment of the disclosure, the method for implementing step S607 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0174] S608, determine whether the returned field is in the request data of the plaintext log.

[0175] In this embodiment of the disclosure, the method for implementing step S608 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0176] S609, If the returned field is in the requested data, determine whether the requested data includes the key value of the returned field.

[0177] In this embodiment of the disclosure, the method for implementing step S609 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0178] S610, when the requested data includes a key value of a returned field, determine that the module corresponding to the plaintext log is the source module of the returned field.

[0179] In this embodiment of the disclosure, the method for implementing step S610 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0180] S611, if the returned field does not exist in the requested data, obtain the first similarity between the returned field and the requested data.

[0181] In this embodiment of the disclosure, the method for implementing step S611 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0182] S612, in response to the first similarity meeting the first set condition, determine the module corresponding to the plaintext log as the source module of the returned field.

[0183] In this embodiment of the disclosure, the method for implementing step S612 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0184] S613, in response to the request data not including the key value of the returned field, or the first similarity not meeting the first set condition, determine whether the returned field is in the corresponding returned data of the second downstream module.

[0185] In this embodiment of the disclosure, the method for implementing step S613 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0186] S614, If the returned field is in the returned data, determine whether the returned data includes the key value of the returned field.

[0187] In this embodiment of the disclosure, the method for implementing step S614 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0188] S615, in response to the return data including a key value of the return field, determine that the second downstream module is the source module of the return field.

[0189] In this embodiment of the disclosure, the method for implementing step S615 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0190] S616 If the returned field does not exist in the returned data, obtain the second similarity between the returned field and the returned data.

[0191] In this embodiment of the disclosure, the method for implementing step S616 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0192] S617, in response to the second similarity meeting the second set condition, determine the second downstream module as the source module of the returned field.

[0193] In this embodiment of the disclosure, the method for implementing step S617 can be implemented in any of the various embodiments of the disclosure, and no limitation is made here, nor will it be described in detail.

[0194] S618, in response to the return data not including the key value of the return field, or the second similarity not meeting the second set condition, determine that the return field is a special processing field in the module corresponding to the plaintext log.

[0195] In some implementations, if the returned data does not include the key value of the returned field, it can be determined that the second downstream module corresponding to the returned data is not the source module of the returned field, or if the second similarity does not meet the second set condition, it can be determined that the second downstream module corresponding to the returned data is not the source module of the returned field.

[0196] In other words, after traversing all the second downstream modules corresponding to the plaintext log module, if none of the second downstream modules are the source module of the returned field, then the returned field is determined to be a special processing field of the plaintext log module, which may be generated by the code of the plaintext log module.

[0197] S619, If any returned field is abnormal, locate the abnormal module based on the source module of any returned field.

[0198] Understandably, when any returned field is abnormal, the source module of the returned field can be determined based on the field source diagram, thereby locating the source module as the abnormal module, making the investigation of field abnormalities more efficient and accurate.

[0199] In this embodiment, plaintext logs are obtained through multiple methods to improve the efficiency of plaintext log acquisition. Each module is traversed, and the upstream and downstream relationships of the modules are determined based on the first service identifier. Then, the source module of the returned field is determined based on the upstream and downstream relationships. When determining the source module of the returned field, the source module of any returned field is determined through the judgment of multiple conditions to ensure the accuracy of the source module determination. This provides a more reliable foundation for the subsequent investigation of the source of abnormal fields. The corresponding source module is quickly located based on the abnormal returned field, and the specific abnormal module is determined, reducing the investigation cost and solving the current problem of no complete plaintext log analysis. The anomaly investigation effect is better.

[0200] Figure 7 This disclosure is a schematic diagram of the structure of an information processing device provided in an embodiment, such as... Figure 7 As shown, the device 700 includes:

[0201] The first acquisition module 701 is used to acquire plaintext logs from various modules within the server.

[0202] The second acquisition module 702 is used to acquire a link topology diagram between modules based on plaintext logs; wherein, the nodes of the link topology diagram are modules, and the edges between nodes indicate the upstream and downstream relationships between nodes;

[0203] The third acquisition module 703 is used to determine the source module of the fields returned in the plaintext log based on the link topology diagram.

[0204] In some implementations, after the third acquisition module 703, the following are also included:

[0205] If any returned field is abnormal, locate the abnormal module based on the source module of that returned field.

[0206] In some implementations, the second acquisition module 702 includes:

[0207] Starting from any given module, iterate through all modules on the server.

[0208] Get the first service identifier of the request downstream log in the plaintext log corresponding to the currently traversed module;

[0209] The first downstream module is located based on the first service identifier, and the first downstream module is marked as the downstream module of the currently traversed module;

[0210] Determine the link topology between modules based on the downstream modules corresponding to the module.

[0211] In some implementations, the plaintext log includes request data. The second acquisition module 702 includes:

[0212] Based on the link topology diagram, identify one or more second downstream modules corresponding to the plaintext log module;

[0213] Determine the module corresponding to the requested data;

[0214] Determine the source module of the returned fields from the second downstream module and the module corresponding to the requested data.

[0215] In some implementations, the second acquisition module 702 includes:

[0216] Determine if the returned field is in the request data of the plaintext log;

[0217] If the returned field is in the requested data, determine whether the requested data includes the key value of the returned field;

[0218] When the requested data includes a key value of a returned field, the module corresponding to the plaintext log is identified as the source module of the returned field.

[0219] When the requested data does not include the key value of the returned field, the source module of the returned field is determined from the second downstream module.

[0220] In some implementations, device 700 also includes:

[0221] If the returned field does not exist in the requested data, obtain the first similarity between the returned field and the requested data;

[0222] When the first similarity satisfies the first set condition, the module corresponding to the plaintext log is determined to be the source module of the returned field;

[0223] When the first similarity does not meet the first set condition, the source module of the returned field is determined from the second downstream module.

[0224] In some implementations, the plaintext log includes returned data, and device 700 includes:

[0225] For any second downstream module, determine whether the returned field is in the corresponding returned data of the second downstream module;

[0226] If the returned field is in the returned data, determine whether the returned data includes the key value of the returned field;

[0227] When the returned data includes a key value of a returned field, the second downstream module is determined to be the source module of the returned field;

[0228] When the returned data does not include the key value of the returned field, determine that the returned field is a special processing field in the module corresponding to the plaintext log.

[0229] In some implementations, device 700 also includes:

[0230] If the returned field does not exist in the returned data, obtain the second similarity between the returned field and the returned data;

[0231] When the second similarity satisfies the second set condition, the second downstream module is determined to be the source module of the returned field;

[0232] When the second similarity does not meet the second set condition, the returned field is determined to be a special processing field in the module corresponding to the plaintext log.

[0233] In some implementations, the second acquisition module 702 includes:

[0234] Get the first keyword;

[0235] First keyword identification is performed on plaintext logs; plaintext logs containing the first keyword are used as target plaintext logs.

[0236] Based on the link topology diagram between the target plaintext log acquisition modules.

[0237] In some implementations, the second acquisition module 702 includes:

[0238] Get the log whitelist;

[0239] Based on the log whitelist, identify the target plaintext log in the plaintext log;

[0240] Based on the link topology diagram between the target plaintext log acquisition modules.

[0241] In some implementations, the second acquisition module 702 includes:

[0242] Obtain the unique identifier corresponding to the target plaintext log;

[0243] Based on the request and return data in the target plaintext log, determine the first module that interacts with the module corresponding to the target plaintext log;

[0244] Based on the unique identifier, associate the target plaintext log with the first target plaintext log corresponding to the first module;

[0245] Based on the associated target plaintext logs, obtain the link topology diagram between modules.

[0246] In some implementations, the first acquisition module 701 includes:

[0247] Using a common logging software development kit, obtain the plaintext logs from each module on the server; or,

[0248] Based on the preset middleware, obtain the plaintext logs of each module on the server.

[0249] In this embodiment, plaintext logs corresponding to all modules on the server are obtained, providing a more accurate basis for subsequent anomaly investigation based on plaintext logs. The link topology diagram between modules is determined based on the plaintext logs corresponding to the modules, which more intuitively determines the upstream and downstream relationships between modules. Based on the link topology diagram between modules, the source module of the returned field is determined. In anomaly investigation, the corresponding source module can be quickly located based on the abnormal returned field, and the specific abnormal module can be identified, reducing the investigation cost and solving the current problem of lacking complete plaintext log analysis, resulting in better anomaly investigation effect.

[0250] The acquisition, storage, and application of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0251] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0252] Figure 8 A schematic block diagram of an example electronic device 800 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0253] like Figure 8 As shown, device 800 includes a computing unit 801, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 802 or a computer program loaded from storage unit 808 into random access memory (RAM) 803. RAM 803 may also store various programs and data required for the operation of device 800. The computing unit 801, ROM 802, and RAM 803 are interconnected via bus 804. Input / output (I / O) interface 805 is also connected to bus 804.

[0254] Multiple components in device 800 are connected to I / O interface 805, including: input unit 806, such as keyboard, mouse, etc.; output unit 807, such as various types of monitors, speakers, etc.; storage unit 808, such as disk, optical disk, etc.; and communication unit 809, such as network card, modem, wireless transceiver, etc. Communication unit 809 allows device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0255] The computing unit 801 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as information processing methods. For example, in some embodiments, the information processing method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of the information processing method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform information processing methods by any other suitable means (e.g., by means of firmware).

[0256] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0257] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0258] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0259] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0260] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0261] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0262] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0263] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. An information processing method, wherein, The method includes: Obtain plaintext logs from each module within the server, the plaintext logs including request data; The link topology graph between the modules is obtained based on the plaintext log; wherein, the nodes of the link topology graph are modules, and the edges between nodes indicate the upstream and downstream relationships between the nodes; Based on the link topology diagram, determine one or more second downstream modules corresponding to the module of the plaintext log; In response to the fact that the returned field in the plaintext log is in the request data, and the request data includes the key value of the returned field, the module corresponding to the plaintext log is determined to be the source module of the returned field; In response to the fact that the returned field in the plaintext log is in the request data, and the request data does not include the key value of the returned field, the source module of the returned field is determined from the second downstream module.

2. The method according to claim 1, wherein, After determining the source of the returned fields in the plaintext log based on the link topology diagram, the module further includes: If any returned field is abnormal, the abnormal module is located based on the source module of the returned field.

3. The method according to claim 1, wherein, The step of obtaining the link topology map between the modules based on the plaintext logs includes: Starting from any module, traverse all modules within the server. Get the first service identifier of the request downstream log in the plaintext log corresponding to the currently traversed module; Based on the first service identifier, the first downstream module is located and marked as the downstream module of the currently traversed module; Based on the downstream modules corresponding to the module, determine the link topology between the modules.

4. The method according to claim 1, wherein, The method further includes: Determine the key-value pairs corresponding to the returned fields; Based on the key-value pairs corresponding to the returned field and the key-value pairs in the request data, determine whether the returned field is in the request data.

5. The method according to claim 1, wherein, The method further includes: If the returned field does not exist in the requested data, obtain the first similarity between the returned field and the requested data; When the first similarity satisfies the first set condition, the module corresponding to the plaintext log is determined to be the source module of the returned field; When the first similarity does not meet the first set condition, the source module of the returned field is determined from the second downstream module.

6. The method according to claim 5, wherein, The plaintext log includes returned data, and the module for determining the source of the returned fields from the second downstream module includes: For any second downstream module, determine whether the returned field is in the returned data corresponding to the second downstream module; If the returned field is in the returned data, determine whether the returned data includes the key value of the returned field; When the returned data includes a key value of the returned field, the second downstream module is determined to be the source module of the returned field; When the returned data does not include the key value of the returned field, the returned field is determined to be a special processing field in the module corresponding to the plaintext log.

7. The method according to claim 6, wherein, The method further includes: If the returned field does not exist in the returned data, obtain the second similarity between the returned field and the returned data; When the second similarity satisfies the second set condition, the second downstream module is determined to be the source module of the returned field; When the second similarity does not meet the second set condition, the returned field is determined to be a special processing field in the module corresponding to the plaintext log.

8. The method according to any one of claims 1-7, wherein, Before obtaining the link topology map between the modules based on the plaintext logs, the process includes: Get the first keyword; The plaintext log is identified using the first keyword; the plaintext log including the first keyword is taken as the target plaintext log. Obtain the link topology diagram between the modules based on the target plaintext log.

9. The method according to any one of claims 1-7, wherein, Before obtaining the link topology map between the modules based on the plaintext logs, the process includes: Get the log whitelist; Based on the log whitelist, determine the target plaintext log in the plaintext log; Obtain the link topology diagram between the modules based on the target plaintext log.

10. The method according to claim 8, wherein, The step of obtaining the link topology map between the modules based on the plaintext logs includes: Obtain the unique identifier corresponding to the target plaintext log; Based on the request data and return data in the target plaintext log, determine the first module that interacts with the module corresponding to the target plaintext log; Based on the unique identifier, the target plaintext log is associated with the first target plaintext log corresponding to the first module; Based on the associated target plaintext logs, obtain the link topology diagram between the modules.

11. The method according to claim 10, wherein, The acquisition of plaintext logs from each module of the server includes: Using a common logging software development kit, obtain the plaintext logs from each module on the server; or, Based on the preset middleware, obtain the plaintext logs of each module on the server.

12. An information processing apparatus, comprising: The first acquisition module is used to acquire plaintext logs from various modules within the server, the plaintext logs including request data; The second acquisition module is used to acquire a link topology diagram between the modules based on the plaintext log; wherein, the nodes of the link topology diagram are modules, and the edges between nodes indicate the upstream and downstream relationships between the nodes; The third acquisition module is used to obtain information based on the link topology diagram. Identify one or more second downstream modules corresponding to the module of the plaintext log; In response to the fact that the returned field in the plaintext log is in the request data, and the request data includes the key value of the returned field, the module corresponding to the plaintext log is determined to be the source module of the returned field; In response to the fact that the returned field in the plaintext log is in the request data, and the request data does not include the key value of the returned field, the source module of the returned field is determined from the second downstream module.

13. The apparatus according to claim 12, wherein, Following the third acquisition module, the system further includes: If any returned field is abnormal, the abnormal module is located based on the source module of the returned field.

14. The apparatus according to claim 12, wherein, The second acquisition module includes: Starting from any module, traverse all modules within the server. Get the first service identifier of the request downstream log in the plaintext log corresponding to the currently traversed module; Based on the first service identifier, the first downstream module is located and marked as the downstream module of the currently traversed module; Based on the downstream modules corresponding to the module, determine the link topology between the modules.

15. The apparatus according to claim 12, wherein, The second acquisition module includes: Determine the key-value pairs corresponding to the returned fields; Based on the key-value pairs corresponding to the returned field and the key-value pairs in the request data, determine whether the returned field is in the request data.

16. The apparatus according to claim 12, wherein, The device further includes: If the returned field does not exist in the requested data, obtain the first similarity between the returned field and the requested data; When the first similarity satisfies the first set condition, the module corresponding to the plaintext log is determined to be the source module of the returned field; When the first similarity does not meet the first set condition, the source module of the returned field is determined from the second downstream module.

17. The apparatus according to claim 16, wherein, The plaintext log includes returned data, and the device includes: For any second downstream module, determine whether the returned field is in the returned data corresponding to the second downstream module; If the returned field is in the returned data, determine whether the returned data includes the key value of the returned field; When the returned data includes a key value of the returned field, the second downstream module is determined to be the source module of the returned field; When the returned data does not include the key value of the returned field, the returned field is determined to be a special processing field in the module corresponding to the plaintext log.

18. The apparatus according to claim 17, wherein, The device further includes: If the returned field does not exist in the returned data, obtain the second similarity between the returned field and the returned data; When the second similarity satisfies the second set condition, the second downstream module is determined to be the source module of the returned field; When the second similarity does not meet the second set condition, the returned field is determined to be a special processing field in the module corresponding to the plaintext log.

19. The apparatus according to any one of claims 12-18, wherein, The second acquisition module includes: Get the first keyword; The plaintext log is identified using the first keyword; the plaintext log including the first keyword is taken as the target plaintext log. Obtain the link topology diagram between the modules based on the target plaintext log.

20. The apparatus according to any one of claims 12-18, wherein, The second acquisition module includes: Get the log whitelist; Based on the log whitelist, determine the target plaintext log in the plaintext log; Obtain the link topology diagram between the modules based on the target plaintext log.

21. The apparatus according to claim 19, wherein, The second acquisition module includes: Obtain the unique identifier corresponding to the target plaintext log; Based on the request data and return data in the target plaintext log, determine the first module that interacts with the module corresponding to the target plaintext log; Based on the unique identifier, the target plaintext log is associated with the first target plaintext log corresponding to the first module; Based on the associated target plaintext logs, obtain the link topology diagram between the modules.

22. The apparatus according to claim 21, wherein, The first acquisition module includes: Using a common logging software development kit, obtain the plaintext logs from each module on the server; or, Based on the preset middleware, obtain the plaintext logs of each module on the server.

23. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-11.

24. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-11.

25. A computer program product comprising a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1-11.

Images