Log data query method, device, equipment and medium

Abstract

This application relates to a log data query method, apparatus, device, and medium, belonging to the field of cloud technology. The method includes: determining a target node matching the query time range from a log query time tree; each node in the log query time tree records the log query time range; the time range recorded by the target node intersects with the query time range; determining a target subtree from the subtrees under the target node; traversing leaf nodes starting from the edge leaf nodes of the target subtree, stopping the traversal after reaching the target leaf node; the time values ​​within the target time range recorded in the target leaf node have corresponding log data on the disk; determining the time values ​​recorded by the target leaf node that correspond to the log data and are in a critical state, obtaining the boundary time values ​​corresponding to the query time range; and retrieving the log data matching the query time range from the disk based on the boundary time values. This method can improve the efficiency of log data query.

Description

Technical Field

[0001] This application relates to data query technology, and more particularly to the field of cloud technology, and in particular to a log data query method, apparatus, device and medium. Background Technology

[0002] Log data generated from daily business interactions is typically stored on disk. Since log data is generally quite large, it is highly likely to be distributed across multiple sectors of the disk. This presents a significant challenge for querying log data. For example, using binary search to retrieve log data within a specific time range from the disk can easily result in scattered access. That is, log data located in the middle of the binary search sequence is likely to be distributed across multiple sectors. Each read of log data in the middle requires a read / write operation on that corresponding sector. Multiple read / write operations across multiple sectors can be time-consuming, leading to low efficiency in log data retrieval. Summary of the Invention

[0003] Therefore, it is necessary to provide a log data query method, apparatus, device, and medium that can improve the efficiency of log data query in order to address the above-mentioned technical problems.

[0004] Firstly, this application provides a log data query method, the method comprising:

[0005] The target node matching the query time range is determined from the log query time tree; each node in the log query time tree is used to record the time range for log query; the time range recorded in the target node and the query time range have an intersection;

[0006] Determine the target subtree for finding the boundary time value from the subtree under the target node;

[0007] The leaf node traversal process starts from the edge leaf node of the target subtree and stops after traversing to the target leaf node; the time values ​​within the target time range recorded in the target leaf node exist as corresponding log data on the disk.

[0008] Determine the time value of the target leaf node that corresponds to log data and is in a critical state, so as to obtain the boundary time value corresponding to the query time range;

[0009] Log data matching the query time range is retrieved from the disk based on the boundary time value.

[0010] Secondly, this application provides a log data query device, the device comprising:

[0011] The determination module is used to determine the target node that matches the query time range from the log query time tree; each node in the log query time tree is used to record the time range for log query; the time range recorded in the target node has an intersection with the query time range;

[0012] The determining module is further configured to determine, from the subtree under the target node, a target subtree for finding boundary time values;

[0013] The traversal module is used to traverse leaf nodes starting from the edge leaf nodes of the target subtree and stop traversing after reaching the target leaf node; the time values ​​within the target time range recorded in the target leaf node exist as corresponding log data on the disk.

[0014] The determining module is also used to determine the time value of the target leaf node that corresponds to log data and is in a critical state, so as to obtain the boundary time value corresponding to the query time range;

[0015] The acquisition module is used to acquire log data from the disk that matches the query time range based on the boundary time value.

[0016] In one embodiment, the target node has at least two subtrees; the determining module is further configured to, when the query time range intersects with the time range of one of the records in the at least two subtrees under the target node, use the intersecting subtree as the target subtree for finding the boundary time value.

[0017] In one embodiment, the subtree under the target node includes a left subtree and a right subtree; the boundary time value includes a lower boundary time value; the determining module is further configured to, if the query time range intersects with the time ranges recorded by the left subtree and the right subtree respectively, use the left subtree as the target subtree if the lower boundary time value needs to be found; the traversal module is further configured to perform leaf node traversal processing starting from the left edge leaf node of the left subtree, and stop traversing after reaching the target leaf node.

[0018] In one embodiment, the traversal module is further configured to perform leaf node traversal processing starting from the left edge leaf node of the right subtree if the target leaf node has not been reached from the left subtree, and stop traversing after reaching the target leaf node.

[0019] In one embodiment, the subtree under the target node includes a left subtree and a right subtree; the boundary time value includes an upper boundary time value; the determining module is further configured to, if the upper boundary time value needs to be found, take the right subtree as the target subtree when the query time range intersects with the time ranges recorded by the left subtree and the right subtree; the traversal module is further configured to perform leaf node traversal processing starting from the right edge leaf node in the right subtree, and stop traversing after reaching the target leaf node.

[0020] In one embodiment, the traversal module is further configured to perform leaf node traversal processing starting from the right edge leaf node of the left subtree if the target leaf node has not been reached from the right subtree, and stop traversing after reaching the target leaf node.

[0021] In one embodiment, the determining module is further configured to use the endpoint time value in the target time range as the starting time value of the current round, and the query time range as the target search range of the current round, and perform log time value search processing in the target search range starting from the starting time value; the log time value is the time value corresponding to log data; after finding the log time value, the query time range is updated based on the log time value to obtain the updated time range; the log time value is used as the starting time value of the next round of search, the updated time range is used as the target search range of the next round, and the log time value search processing in the target search range starting from the starting time value is returned to perform the next round of search until the search end condition is met, and the last log time value found is used as the time value corresponding to log data and in a critical state recorded by the target leaf node to obtain the boundary time value corresponding to the query time range.

[0022] In one embodiment, the endpoint time value is the time value corresponding to the offset of the log data storage file on the disk pointed to by the target leaf node; the determining module is further configured to use the time value corresponding to the offset as the starting time value of this round, use the query time range as the target search range of this round, and update the offset of the data storage file on the disk pointed to by the target leaf node from the starting time value, so as to perform log time value search processing in the target search range.

[0023] In one embodiment, the determining module is further configured to update the upper limit of the query time range using the log time value when the lower boundary time value corresponding to the query time range is found, so as to obtain the updated time range.

[0024] In one embodiment, the determining module is further configured to update the lower limit of the query time range using the log time value when the upper boundary time value corresponding to the query time range is found, so as to obtain the updated time range.

[0025] In one embodiment, the boundary time value includes a lower boundary time value and an upper boundary time value; the acquisition module is further configured to acquire log data corresponding to each log data number within the target number range from the disk, as log data matching the query time range; wherein, the target number range is a number range consisting of the log data number corresponding to the lower boundary time value as the starting value of the range and the log data number corresponding to the upper boundary time value as the ending value of the range.

[0026] Thirdly, this application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the various method embodiments of this application.

[0027] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the various method embodiments of this application.

[0028] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the various method embodiments of this application.

[0029] The aforementioned log data query method, apparatus, device, medium, and computer program product determine the target node matching the query time range from the log query time tree. Each node in the log query time tree records the time range for log queries. The time range recorded in the target node overlaps with the query time range. Since the log query time tree records the time range for log queries, the data volume is relatively small. Therefore, the storage space occupied by the log query time tree is smaller than that occupied by storing log data, requiring fewer sectors. The target subtree for finding boundary time values ​​is determined from the subtree under the target node. Leaf node traversal is performed starting from the edge leaf node of the target subtree, stopping after reaching the target leaf node. The time values ​​within the target time range recorded in the target leaf node have corresponding log data on the disk. The time values ​​recorded in the target leaf node that correspond to log data and are in a critical state are determined to obtain the boundary time values ​​corresponding to the query time range. Based on the boundary time values, log data matching the query time range is retrieved from the disk. Since the storage space occupied by the log query time tree is not as large as that occupied by storing log data, the number of read and write operations on the sector is reduced, saving the query time of log data and thus improving the query efficiency of log data. Attached Figure Description

[0030] Figure 1 This is a diagram illustrating the application environment of a log data query method in one embodiment.

[0031] Figure 2 This is a flowchart illustrating a log data query method in one embodiment;

[0032] Figure 3 This is a schematic diagram of the log query time tree structure in one embodiment;

[0033] Figure 4 This is a schematic diagram illustrating the principle of binary search in one embodiment;

[0034] Figure 5 This is a schematic diagram illustrating the intersection of the query time range and the subtrees under the target node in one embodiment;

[0035] Figure 6 This is a flowchart illustrating the steps for querying boundary time values ​​in one embodiment.

[0036] Figure 7 This is a flowchart illustrating the log data query method in another embodiment;

[0037] Figure 8 This is a structural block diagram of a log data query device in one embodiment;

[0038] Figure 9This is an internal structural diagram of a computer device in one embodiment;

[0039] Figure 10 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0041] The log data query method provided in this application can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be located in the cloud or on other servers. Terminal 102 can be, but is not limited to, various desktop computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Terminal 102 and server 104 can be directly or indirectly connected via wired or wireless communication; this application does not impose any restrictions on this connection.

[0042] Server 104 can determine the target node matching the query time range from the log query time tree; each node in the log query time tree records the time range for log queries; the time range recorded in the target node intersects with the query time range. Server 104 can determine the target subtree for finding boundary time values ​​from the subtree under the target node, and perform leaf node traversal starting from the edge leaf node of the target subtree, stopping the traversal after reaching the target leaf node; the time values ​​within the target time range recorded in the target leaf node have corresponding log data on the disk. Server 104 can determine the time values ​​recorded in the target leaf node that have corresponding log data and are in a critical state, to obtain the boundary time values ​​corresponding to the query time range. Server 104 can retrieve the log data matching the query time range from the disk based on the boundary time values.

[0043] It is understood that terminal 102 can obtain the query time range and send it to server 104, so that server 104 can determine the target node matching the query time range from the log query time tree. It is also understood that server 104 can send the log data matching the obtained query time range to terminal 102 for corresponding business processing. This embodiment does not limit this; it is understood that... Figure 1 The application scenarios shown are for illustrative purposes only and are not limited to these.

[0044] In one embodiment, such as Figure 2 As shown, a log data query method is provided. This method can be applied to computer devices, which can be terminals or servers. It can be executed independently by the terminal or server, or through interaction between the terminal and server. This embodiment illustrates the method applied to a computer device as an example, including the following steps:

[0045] Step 202: Determine the target node that matches the query time range from the log query time tree; each node in the log query time tree is used to record the time range for log queries; the time range recorded in the target node has an intersection with the query time range.

[0046] The query time range refers to the time range within which log data is being queried. For example, if a user wants to query log data falling within the time range of 10:00-11:00 yesterday, then that time range is the query time range. The target node is the node in the log query time tree that intersects with the query time range.

[0047] Specifically, each node in the log query time tree can record the time range for log queries, and the log query time tree can be stored on the computer device's disk. The computer device can determine the target node that matches the query time range entered by the user from the log query time tree located on the disk.

[0048] Step 204: Determine the target subtree from the subtree under the target node for finding the boundary time value.

[0049] Boundary time values ​​are those time values ​​within the query time range that correspond to log data and are at a critical point. For ease of understanding, consider this example: if a user inputs a query time range of 10:00-11:00, and there is no corresponding log data for any time point within the time ranges of 10:00-10:09 and 10:51-11:00, but log data is present for the time values ​​of 10:10 and 10:50, and log data may also be present for other time points within the 10:10-10:50 time range, then 10:10 and 10:50 are considered boundary time values, falling at the critical point of the 10:10-10:50 time range.

[0050] Specifically, the number of subtrees under the target node is at least one, and the computer device can determine the target subtree for finding the boundary time value from the various subtrees under the target node.

[0051] In one embodiment, the computer device can determine the intersection of the query time range input by the user with each subtree under the target node, and determine the target subtree for finding the boundary time value from each subtree under the target node based on the intersection of the query time range with each subtree under the target node.

[0052] Step 206: Start traversing the leaf nodes from the edge leaf nodes of the target subtree, and stop traversing after reaching the target leaf node; the time values ​​within the target time range recorded in the target leaf node have corresponding log data on the disk.

[0053] In this context, leaf nodes are leaf nodes in the log query time tree that have no outgoing degree. They can be understood as having no successor nodes, or being the terminal node of a branch in the log query time tree. Edge leaf nodes are leaf nodes located at the edges of the target subtree. They can be understood as including left and right edge leaf nodes. The left edge leaf node is the leftmost leaf node in the target subtree. The right edge leaf node is the rightmost leaf node in the target subtree. Target leaf nodes are leaf nodes whose recorded time values ​​within the specified time range have corresponding log data on disk. The target time range is the time range recorded by the target leaf node.

[0054] Specifically, the computer device can traverse the leaf nodes from the edge of the target subtree to the adjacent leaf nodes in turn, stopping the traversal upon reaching the target leaf node. In other words, the computer device can traverse the leaf nodes from the edge of the target subtree to the adjacent leaf nodes in turn. Once the time value within the time range recorded in the currently traversed leaf node exists as corresponding log data on the disk, the computer device can use this currently traversed leaf node as the target leaf node and stop traversing the leaf nodes; that is, the leaf nodes after the target leaf node will not be traversed.

[0055] In one embodiment, the computer can determine the attribute information of the boundary time value to be searched. Then, based on this attribute information, the computer device can determine whether to perform leaf node traversal starting from the edge leaf node of the target subtree or from the right leaf node of the target subtree. The boundary time value attribute information indicates whether the boundary time value to be searched is the lower boundary time value or the upper boundary time value corresponding to the query time range. The lower boundary time value is the smaller of the two boundary time values ​​corresponding to the query time range, and the upper boundary time value is the larger of the two boundary time values ​​corresponding to the query time range.

[0056] It can be understood that the time value of 10:10 in the example above is the lower boundary time value corresponding to the query time range, and the time value of 10:50 is the upper boundary time value corresponding to the query time range.

[0057] In one embodiment, the log query time tree can specifically be a multi-branch search tree used to record the time range for log queries, such as a binary search tree and a ternary search tree, etc. This embodiment does not limit this.

[0058] In one embodiment, the log query time tree is a binary search tree used to record the time range for log queries. For example... Figure 3As shown, the log query time tree includes 7 nodes (i.e., nodes 1 to 7). If the time range recorded by this log query time tree is [min, max], then node 1 is the root node of the log query time tree, and the time range recorded by node 1 is also [min, max]. Here, min represents the minimum value of the time range recorded by the log query time tree, and max represents the maximum value of the time range recorded by the log query time tree. The median value 1 is the time value located in the middle position within the time range [min, max]. Based on the median value 1, the time range of node 1 can be divided into two parts, forming nodes 2 and 3 respectively. The time range recorded by node 2 is [min, median value 1], and the time range recorded by node 3 is [median value 1, max]. Similarly, the median value 2 is the time value located in the middle position within the time range [min, median value 1], and the median value 3 is the time value located in the middle position within the time range [median value 1, max]. Based on the median value 2, the time range of node 2 can be divided into two parts, forming nodes 4 and 5 respectively. Based on the median value 3, the time range of node 3 can be divided into two parts, forming node 6 and node 7 respectively. It can be understood that nodes 4 through 7 have no successor nodes; nodes 4 through 7 are the leaf nodes of the log query time tree.

[0059] Step 208: Determine the time values ​​of the target leaf node records that correspond to log data and are in a critical state, so as to obtain the boundary time values ​​corresponding to the query time range.

[0060] Specifically, the computer device can determine the time values ​​that correspond to log data and are in a critical state in the target leaf node records, so as to obtain the boundary time values ​​corresponding to the query time range. It can be understood that there may be multiple time values ​​within the query time range input by the user, each of which corresponds to log data. The computer device can determine the time value in a critical state from these multiple time values ​​that correspond to log data, and use the determined time value as the boundary time value corresponding to the query time range.

[0061] In one embodiment, the target time range has two endpoint time values, namely the start value and the end value of the target time range. The computer device can start from any endpoint time value in the target time range and traverse each time value in the direction of the other endpoint time value to find the time value in the target time range that corresponds to log data and is in a critical state, so as to obtain the boundary time value corresponding to the query time range.

[0062] Step 210: Retrieve log data from the disk that matches the query time range based on the boundary time value.

[0063] In one embodiment, each boundary time value corresponding to the query time range corresponds to a log data identifier stored on the disk. The computer device can retrieve log data matching the query time range from the disk based on the log data identifier corresponding to each boundary time value.

[0064] In the above log data query method, a target node matching the query time range is determined from the log query time tree. Each node in the log query time tree records the time range for log queries. The time range recorded in the target node overlaps with the query time range. Since the log query time tree records the time range for log queries, the data volume is relatively small. Therefore, the storage space occupied by the log query time tree is smaller than that occupied by storing log data, requiring fewer sectors. A target subtree for finding boundary time values ​​is determined from the subtree under the target node. Leaf node traversal is performed starting from the edge leaf node of the target subtree, stopping after reaching the target leaf node. The time values ​​within the target time range recorded in the target leaf node have corresponding log data on the disk. The time values ​​recorded in the target leaf node that correspond to log data and are in a critical state are determined to obtain the boundary time values ​​corresponding to the query time range. Based on the boundary time values, log data matching the query time range is retrieved from the disk. Since the storage space occupied by the log query time tree is not as large as that occupied by storing log data, the number of read and write operations on the sector is reduced, saving the query time of log data and thus improving the query efficiency of log data.

[0065] Meanwhile, since this application performs leaf node traversal starting from the edge leaf node of the target subtree and stops traversing after reaching the target leaf node, it can accurately find the boundary time value corresponding to the query time range without traversing all leaf nodes, saving the search time for boundary time values ​​and further improving the efficiency of log data query.

[0066] It's important to note that traditional log querying methods can be implemented using binary search. If log data is stored in memory, binary search is highly efficient for in-memory log queries because the data isn't stored in sectors. However, considering the massive volume of log data, storing it in memory is costly and carries a higher risk of data loss. Therefore, log data is typically stored on disk, often spread across multiple sectors. Directly using binary search to retrieve log data within a specific time range from disk results in scattered access, leading to low query efficiency.

[0067] To make it easier to understand, here is an example, such as Figure 4 As shown, each gray rectangle 401 represents a time value, which can be understood as being sorted from left to right. 402 represents a sector on the disk. If a binary search is used directly to query log data within a time range from the disk, the binary search process requires read and write operations on multiple sectors. Each sector access takes time, resulting in low log data query efficiency. This application introduces a log query time tree to record the time range for log queries. The data volume is smaller; therefore, the storage space occupied by the log query time tree is smaller than that occupied by storing the log data itself, requiring fewer sectors. This reduces sector read and write operations, saving log data query time and thus improving log data query efficiency.

[0068] In one embodiment, there are at least two subtrees under the target node; determining the target subtree for finding the boundary time value from the subtrees under the target node includes: if the query time range intersects with the time range of one of the records in the at least two subtrees under the target node, the subtree with the intersection is used as the target subtree for finding the boundary time value.

[0069] Specifically, the target node has at least two subtrees, and the computer device can determine the intersection of the query time range with the time ranges of records in each subtree under the target node. If the query time range intersects with the time range of one of the records in at least two subtrees under the target node, the intersecting subtree is used as the target subtree for finding the boundary time value.

[0070] In one embodiment, the log query time tree is a binary search tree used to record the time range for log queries, where the subtree under the target node includes a left subtree and a right subtree. For example... Figure 5 As shown, Figure 5 Part (a) represents the query time range entered by the user, which is [query-min, query-max]. Figure 5 In part (b), the gray rectangle represents the target node. The time range recorded by this target node is [node-min, node-max], and the median value is the time value located in the middle of the time range [node-min, node-max]. Based on the median value, the target node can be divided into a left subtree and a right subtree. The time range recorded by the left subtree is [node-min, median value], and the time range recorded by the right subtree is [median value, node-max]. If the query time range intersects with the time range recorded by the left subtree of the target node (i.e., ...), Figure 5In case 1) of part (b), the computer device can use the left subtree with intersection as the target subtree for finding boundary time values. If the query time range intersects with the time range of the records in the right subtree under the target node (i.e., Figure 5 In case 2) of part (b), the computer device can use the right subtree with intersection as the target subtree for finding boundary time values.

[0071] In the above embodiments, when the time range of the query overlaps with the time range of one of the records in at least two subtrees under the target node, since the boundary time value to be searched can only exist in the overlapping subtrees, the overlapping subtrees can be directly used as the target subtrees for searching the boundary time value, which can improve the query efficiency of the boundary time value.

[0072] In one embodiment, the subtree under the target node includes a left subtree and a right subtree; the boundary time value includes a lower boundary time value; determining the target subtree for finding the boundary time value from the subtrees under the target node includes: if the query time range intersects with the time ranges recorded by both the left and right subtrees, and the lower boundary time value needs to be found, then the left subtree is taken as the target subtree; performing leaf node traversal processing starting from the edge leaf node of the target subtree, and stopping the traversal after reaching the target leaf node, includes: performing leaf node traversal processing starting from the left edge leaf node of the left subtree, and stopping the traversal after reaching the target leaf node.

[0073] Specifically, the log query time tree is a binary search tree used to record the time range for log queries. The subtrees under the target node include a left subtree and a right subtree, and the boundary time values ​​include a lower boundary time value and an upper boundary time value. The computer device can determine the intersection of the query time range with the time ranges recorded in each subtree under the target node. If the query time range intersects with the time ranges recorded in both the left and right subtrees (i.e., ...), Figure 5 In case 3) of part (b), if it is necessary to find the lower boundary time value, the computer device can then look up the left subtree (i.e., Figure 5 The target subtree is the subtree whose time range is [node - min, median value]. The leaf nodes are traversed starting from the left edge leaf node of the left subtree, and the traversal stops after reaching the target leaf node.

[0074] In the above embodiments, when the query time range intersects with the time ranges recorded in both the left and right subtrees, it indicates that the boundary time value to be searched may exist in either the left or right subtree. Since the time values ​​recorded by each node in the log query time tree increase sequentially from left to right at each level, the probability that the lower boundary time value exists in the left subtree is greater than that in the right subtree. Therefore, if the lower boundary time value needs to be searched, the left subtree can be directly used as the target subtree, and the search for the lower boundary time value can be performed starting from the left subtree. This improves the query efficiency for the lower boundary time value.

[0075] In one embodiment, the method further includes: performing leaf node traversal starting from the left edge leaf node of the right subtree if the target leaf node has not been reached from the left subtree, and stopping the traversal after reaching the target leaf node.

[0076] Specifically, in the case not from the left subtree (i.e., Figure 5 When traversing the subtree whose time range is [node - min, median value] to reach the target leaf node, the computer device can start from the right subtree (i.e., Figure 5 The process starts from the left edge leaf node of the subtree whose time range is [middle value, node - max] and stops traversing after reaching the target leaf node.

[0077] In the above embodiments, if the target leaf node is not reached by traversing from the left subtree, it indicates that the boundary time value to be searched exists in the right subtree. Since the time values ​​recorded by each node in the log query time tree increase sequentially from left to right for each level, directly traversing the leaf nodes starting from the left edge leaf node of the right subtree can improve the query efficiency of the boundary time value.

[0078] In one embodiment, the subtree under the target node includes a left subtree and a right subtree; the boundary time value includes an upper boundary time value; determining the target subtree for finding the boundary time value from the subtree under the target node includes: if the query time range intersects with the time ranges recorded by both the left and right subtrees, and the upper boundary time value needs to be found, then the right subtree is taken as the target subtree; performing leaf node traversal processing starting from the edge leaf node of the target subtree, and stopping the traversal after reaching the target leaf node, includes: performing leaf node traversal processing starting from the right edge leaf node in the right subtree, and stopping the traversal after reaching the target leaf node.

[0079] Specifically, the log query time tree is a binary search tree used to record the time range for log queries. The subtrees under the target node include a left subtree and a right subtree, and the boundary time values ​​include a lower boundary time value and an upper boundary time value. The computer device can determine the intersection of the query time range with the time ranges recorded in each subtree under the target node. If the query time range intersects with the time ranges recorded in both the left and right subtrees (i.e., ...), Figure 5 In case 3) of part (b), if it is necessary to find the upper boundary time value, the computer device can then look up the right subtree (i.e., Figure 5 The target subtree is the subtree whose time range is [intermediate value, node - max]. The leaf nodes are traversed starting from the right edge leaf node of the right subtree, and the traversal stops after reaching the target leaf node.

[0080] In the above embodiments, when the query time range intersects with the time ranges recorded in both the left and right subtrees, it indicates that the boundary time value to be searched may exist in either the left or right subtree. Since the time values ​​recorded by each node in the log query time tree increase sequentially from left to right at each level, the probability that the upper boundary time value exists in the right subtree is greater than that in the left subtree. Therefore, if the upper boundary time value needs to be searched, the search should begin with traversing the right subtree, directly using it as the target subtree, thus improving the query efficiency of the upper boundary time value.

[0081] In one embodiment, the method further includes: performing leaf node traversal starting from the right edge leaf node of the left subtree if the target leaf node has not been reached from the right subtree, and stopping the traversal after reaching the target leaf node.

[0082] Specifically, in the absence of the right subtree (i.e., Figure 5 In the case where the time range recorded in the subtree is [median value, node - max], the computer device can traverse to the target leaf node from the left subtree (i.e., Figure 5 The leaf node traversal process starts from the right edge leaf node of the subtree whose time range is [node-min, median value] and stops traversing after reaching the target leaf node.

[0083] In the above embodiments, if the target leaf node is not reached by traversing from the right subtree, it indicates that the boundary time value to be searched exists in the left subtree. Since the time values ​​recorded by each node in the log query time tree increase sequentially from left to right for each level, directly traversing the leaf nodes starting from the right edge leaf node of the left subtree can improve the query efficiency of the boundary time value.

[0084] In one embodiment, such as Figure 6As shown, the time values ​​corresponding to log data and in a critical state recorded in the target leaf node are determined to obtain the boundary time values ​​corresponding to the query time range, including:

[0085] Step 602: Take the endpoint time value in the target time range as the starting time value of this round, and take the query time range as the target search range of this round. Start the log time value search process in the target search range from the starting time value; the log time value is the time value corresponding to the log data.

[0086] Here, the endpoint time value is the time value corresponding to the endpoint within the target time range. The starting time value of this round is the time value of the first lookup in this round of log time value lookup processing. The target lookup range of this round is the time range within which log time value lookup processing is performed in this round. It can be understood that the starting time value and the target lookup range are continuously updated.

[0087] Specifically, the target time range includes two endpoint time values. The computer device can use either of these endpoint time values ​​as the starting time value for this round, and use the query time range input by the user as the target search range for this round. Then, the computer device can start the log time value search process within the target search range from the starting time value.

[0088] Step 604: After finding the log time value, update the query time range based on the log time value to obtain the updated time range.

[0089] Specifically, after the computer device finds the log time value in the target search range, it can update the query time range entered by the user based on the found log time value to obtain the updated time range.

[0090] Step 606: Use the log time value as the starting time value for the next round of search, use the updated time range as the target search range for the next round, and return to perform log time value search processing within the target search range starting from the starting time value to perform the next round of search until the search end condition is met. Use the last log time value found as the time value of the target leaf node that has corresponding log data and is in a critical state to obtain the boundary time value corresponding to the query time range.

[0091] The search termination condition is the condition that causes the iterative process of searching for log timestamps to stop.

[0092] In one embodiment, the search termination condition can be either traversing every time value in the target time range or reaching a preset number of iterations.

[0093] Specifically, the computer device can use the log time value found in the current round as the starting time value for the next round of search, use the updated time range in the current round as the target search range for the next round, use the next round as the current round, and return to start the log time value search process in the target search range from the starting time value to perform the next round of search, until the search end condition is met. The computer device can use the last log time value found as the time value of the target leaf node that corresponds to the log data and is in a critical state, so as to obtain the boundary time value corresponding to the query time range.

[0094] In the above embodiments, by iteratively searching for log time values ​​within the target search range, and updating the query time range based on the log time value each time a log time value is found, the search range can be narrowed step by step. This allows for the rapid identification of time values ​​that correspond to log data and are in a critical state, thereby improving the efficiency of finding boundary time values ​​and further enhancing the efficiency of log data query.

[0095] In one embodiment, the endpoint time value is the time value corresponding to the offset of the log data storage file on the disk pointed to by the target leaf node; taking the endpoint time value in the target time range as the starting time value of this round, taking the query time range as the target search range of this round, and performing log time value search processing in the target search range starting from the starting time value, includes: taking the time value corresponding to the offset as the starting time value of this round, taking the query time range as the target search range of this round, and updating the offset of the data storage file on the disk pointed to by the target leaf node starting from the starting time value, so as to perform log time value search processing in the target search range.

[0096] Log data storage files are files used to store log data.

[0097] Specifically, the endpoint time value is the time value corresponding to the offset of the log data storage file on the disk pointed to by the target leaf node. The computer device can use the time value corresponding to the offset as the starting time value of this round, and the query time range as the target search range of this round. Starting from the starting time value, the offset of the data storage file on the disk pointed to by the target leaf node is updated to read log data from the corresponding position of the log data storage file on the disk, thereby realizing the log time value lookup processing within the target search range.

[0098] In one embodiment, reference Figure 3 If node 7 is a found target leaf node, since the time range recorded by node 7 is [median value 3, max], therefore, if the endpoint time value is "median value 3", then the "median value 3" recorded in the log data storage file (i.e., Figure 3The time value corresponding to 301 in the table is the time value corresponding to the offset of the log data storage file on the disk pointed to by node 7. Computer devices can access this data from... Figure 3 The time value corresponding to 301 in the algorithm is used to update the offset of the data storage file on the disk pointed to by the target leaf node. This allows log data to be read from the corresponding position in the log data storage file on the disk, thus enabling log time value lookup within the target search range. In essence, if the found time value has a corresponding log data number in the log data storage file, it indicates that the searched time value corresponds to log data in the log data storage file, and this searched time value is the found log time value. The log data number is used to uniquely identify the log data. It can be understood that the log data number is one way to represent log data.

[0099] In the above embodiments, by using the time value corresponding to the offset as the starting time value of this round, the offset of the data storage file in the disk pointed to by the target leaf node is continuously updated from the starting time value, so as to quickly read the corresponding data from the disk and perform log time value lookup processing within the target lookup range, thereby improving the lookup efficiency of boundary time values ​​and further improving the query efficiency of log data.

[0100] In one embodiment, after finding the log time value, the query time range is updated based on the log time value to obtain the updated time range, including: if the lower boundary time value corresponding to the query time range is found, the upper limit value of the query time range is updated using the log time value to obtain the updated time range.

[0101] The upper limit of the query time range refers to the largest time value among all time values ​​within the query time range.

[0102] Specifically, the boundary time values ​​corresponding to the query time range include an upper boundary time value and a lower boundary time value. When searching for the lower boundary time value corresponding to the query time range, the computer device can use the log time value to update the upper limit of the query time range to obtain the updated time range.

[0103] For example, if the query time range is [min, max], and the log time value found in [min, max] is V1, then the computer device can use the log time value V1 to update the upper limit value max of the query time range [min, max] to obtain the updated time range [min, V1].

[0104] In the above embodiments, when searching for the lower boundary time value corresponding to the query time range, since the final lower boundary time value found must be the log time value that is closest to the lower limit value in the query time range, updating the upper limit value of the query time range with the log time value to obtain the updated time range can improve the query efficiency of the lower boundary time value.

[0105] In one embodiment, after finding the log time value, the query time range is updated based on the log time value to obtain the updated time range. This includes: if the upper boundary time value corresponding to the query time range is found, the lower boundary value of the query time range is updated using the log time value to obtain the updated time range.

[0106] The lower limit of the query time range refers to the smallest time value among all time values ​​within the query time range.

[0107] Specifically, the boundary time values ​​corresponding to the query time range include an upper boundary time value and a lower boundary time value. When searching for the upper boundary time value corresponding to the query time range, the computer device can use the log time value to update the lower boundary value of the query time range to obtain the updated time range.

[0108] For example, if the query time range is [min, max], and the log time value found from [min, max] is V2, then the computer device can use the log time value V2 to update the lower limit value min of the query time range [min, max] to obtain the updated time range [V2, max].

[0109] In the above embodiments, when searching for the upper and lower boundary time values ​​corresponding to the query time range, since the upper boundary time value found is always the log time value that is closest to the upper limit of the query time range, updating the lower limit of the query time range with the log time value to obtain the updated time range can improve the query efficiency of the upper boundary time value.

[0110] In one embodiment, the boundary time value includes a lower boundary time value and an upper boundary time value; retrieving log data matching the query time range from the disk based on the boundary time value includes: retrieving log data corresponding to each log data number within the target number range from the disk as log data matching the query time range; wherein, the target number range is a number range formed by taking the log data number corresponding to the lower boundary time value as the starting value of the range and the log data number corresponding to the upper boundary time value as the ending value of the range.

[0111] Specifically, the boundary time values ​​include a lower boundary time value and an upper boundary time value. The computer device can obtain the log data number corresponding to the lower boundary time value and the log data number corresponding to the upper boundary time value. The computer device can construct a target number range by using the log data number corresponding to the lower boundary time value as the starting value of the range and the log data number corresponding to the upper boundary time value as the ending value of the range. The computer device can retrieve the log data corresponding to each log data number within the target number range from the disk as the log data matching the query time range.

[0112] In the above embodiments, since the target number range is a range consisting of the log data number corresponding to the lower boundary time value as the starting value and the log data number corresponding to the upper boundary time value as the ending value, each log data number included in the target number range corresponds to each log time value in the query time range. Therefore, the log data corresponding to each log data number in the target number range can be obtained from the disk and directly used as the log data that matches the query time range, further improving the query efficiency of log data.

[0113] like Figure 7 As shown, in one embodiment, a log data query method is provided. This method can be applied to a computer device, which can be a terminal or a server. It can be executed independently by the terminal or server, or through interaction between the terminal and the server. This embodiment uses the application of this method to a computer device as an example for illustration. The method specifically includes the following steps:

[0114] Step 702: Determine the target node that matches the query time range from the log query time tree; each node in the log query time tree is used to record the time range for log query; the time range recorded in the target node has an intersection with the query time range.

[0115] Step 704: If the query time range intersects with the time range of one of the records in the left and right subtrees of the target node, the intersecting subtree is used as the target subtree for finding the boundary time value; the boundary time value includes the lower boundary time value and the upper boundary time value.

[0116] Step 706: If the query time range intersects with the time ranges recorded in both the left and right subtrees, and the lower boundary time value needs to be found, then the left subtree is taken as the target subtree; leaf node traversal is performed starting from the left edge leaf node of the left subtree, and traversal stops after reaching the target leaf node; if the target leaf node is not reached from the left subtree, leaf node traversal is performed starting from the left edge leaf node of the right subtree, and traversal stops after reaching the target leaf node.

[0117] Step 708: If the query time range intersects with the time ranges recorded in both the left and right subtrees, and the upper boundary time value needs to be found, then the right subtree is taken as the target subtree; leaf node traversal is performed starting from the right edge leaf node in the right subtree, and traversal stops after reaching the target leaf node; if the target leaf node is not reached from the right subtree, leaf node traversal is performed starting from the right edge leaf node in the left subtree, and traversal stops after reaching the target leaf node.

[0118] Step 710: Start traversing the leaf nodes from the edge leaf nodes of the target subtree, and stop traversing after reaching the target leaf node; the time values ​​within the target time range recorded in the target leaf node have corresponding log data on the disk.

[0119] Step 712: Take the endpoint time value in the target time range as the starting time value of this round, and take the query time range as the target search range of this round. Start the log time value search process in the target search range from the starting time value; the log time value is the time value corresponding to the log data.

[0120] Step 714: After finding the log time value, update the query time range based on the log time value to obtain the updated time range.

[0121] Step 716: Use the log time value as the starting time value for the next round of search, use the updated time range as the target search range for the next round, and return to perform log time value search processing within the target search range starting from the starting time value to perform the next round of search until the search end condition is met. Use the last log time value found as the time value of the target leaf node that has corresponding log data and is in a critical state to obtain the boundary time value corresponding to the query time range.

[0122] Step 718: Obtain the log data corresponding to each log data number within the target number range from the disk, as the log data matching the query time range; wherein, the target number range is the number range formed by taking the log data number corresponding to the lower boundary time value as the range starting value and the log data number corresponding to the upper boundary time value as the range ending value.

[0123] This application also provides an application scenario in which the above-described log data query method is applied. Specifically, this log data query method can be applied to a scenario where log data is queried based on a binary search tree. It can be understood that the log query time tree is a log query time binary tree. The computer device can determine the target node matching the query time range from the log query time binary tree; each node in the log query time binary tree records the time range for log queries; the time range recorded in the target node intersects with the query time range. When the query time range intersects with the time range of one of the records in the left and right subtrees of the target node, the intersecting subtree is used as the target subtree for finding the boundary time value; the boundary time value includes the lower boundary time value and the upper boundary time value.

[0124] When the query time range intersects with the time ranges recorded in both the left and right subtrees, if the lower boundary time value needs to be found, the computer can use the left subtree as the target subtree; traversing the leaf nodes starts from the left edge leaf node of the left subtree and stops traversing after reaching the target leaf node; if the target leaf node is not reached from the left subtree, traversing the leaf nodes starts from the left edge leaf node of the right subtree and stops traversing after reaching the target leaf node. Similarly, when the query time range intersects with the time ranges recorded in both the left and right subtrees, if the upper boundary time value needs to be found, the computer can use the right subtree as the target subtree; traversing the leaf nodes starts from the right edge leaf node of the right subtree and stops traversing after reaching the target leaf node; if the target leaf node is not reached from the right subtree, traversing the leaf nodes starts from the right edge leaf node of the left subtree and stops traversing after reaching the target leaf node.

[0125] The computer device can traverse leaf nodes starting from the edge leaf nodes of the target subtree, stopping the traversal upon reaching the target leaf node. The time values ​​within the target time range recorded in the target leaf node contain corresponding log data on the disk. The endpoint time value within the target time range is used as the starting time value for this round, and the query time range is used as the target search range for this round. Log time value searches are performed within the target search range starting from the starting time value; each log time value corresponds to a time with log data. After finding a log time value, the query time range is updated based on the log time value, resulting in the updated time range. The log time value is used as the starting time value for the next round of searching, and the updated time range is used as the target search range for the next round. The process continues until the search termination condition is met. The last log time value found is used as the time value recorded in the target leaf node that corresponds to log data and is in a critical state, thus obtaining the boundary time value corresponding to the query time range.

[0126] Computer devices can retrieve the log data corresponding to each log data number within the target number range from the disk, and use it as log data to match the query time range; wherein, the target number range is the number range formed by taking the log data number corresponding to the lower boundary time value as the range starting value and the log data number corresponding to the upper boundary time value as the range ending value.

[0127] This application also provides another application scenario where the aforementioned log data query method is applied. Specifically, this log data query method can be applied to scenarios where log data queries are implemented based on a multi-way search tree. It can be understood that the log query time tree can be a log query time multi-way tree, such as a log query time ternary tree or a log query time quadtree. It can be understood that each node in the log query time multi-way tree records the time range available for log queries. Based on the log query time multi-way tree, fast queries of log data on disk can be achieved, improving the efficiency of log data querying.

[0128] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially, these steps are not necessarily executed in that order. Unless otherwise expressly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the above embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0129] In one embodiment, such as Figure 8 As shown, a log data query device 800 is provided. This device can be a software module, a hardware module, or a combination of both, integrated into a computer device. Specifically, the device includes:

[0130] The determination module 802 is used to determine the target node that matches the query time range from the log query time tree; each node in the log query time tree is used to record the time range for log query; the time range recorded in the target node has an intersection with the query time range.

[0131] The determination module 802 is also used to determine the target subtree for finding the boundary time value from the subtree under the target node.

[0132] Traversal module 804 is used to traverse leaf nodes starting from the edge leaf nodes of the target subtree and stop traversing after reaching the target leaf node; the time values ​​within the target time range recorded in the target leaf node exist as corresponding log data on the disk.

[0133] The determination module 802 is also used to determine the time value of the target leaf node record that has corresponding log data and is in a critical state, so as to obtain the boundary time value corresponding to the query time range.

[0134] The acquisition module 806 is used to retrieve log data from the disk that matches the query time range based on the boundary time value.

[0135] In one embodiment, there are at least two subtrees under the target node; the determining module 802 is further configured to, when there is an intersection between the query time range and the time range of one of the records in the at least two subtrees under the target node, use the intersecting subtree as the target subtree for finding the boundary time value.

[0136] In one embodiment, the subtree under the target node includes a left subtree and a right subtree; the boundary time value includes a lower boundary time value; the determination module 802 is further configured to, when the query time range intersects with the time ranges recorded by the left subtree and the right subtree respectively, if the lower boundary time value needs to be found, take the left subtree as the target subtree; the traversal module 804 is further configured to perform leaf node traversal processing starting from the left edge leaf node of the left subtree, and stop traversing after reaching the target leaf node.

[0137] In one embodiment, the traversal module 804 is further configured to perform leaf node traversal processing starting from the left edge leaf node of the right subtree if the target leaf node has not been reached from the left subtree, and to stop traversing after reaching the target leaf node.

[0138] In one embodiment, the subtree under the target node includes a left subtree and a right subtree; the boundary time value includes an upper boundary time value; the determination module 802 is further configured to, when the query time range intersects with the time ranges recorded by the left and right subtrees respectively, if the upper boundary time value needs to be found, take the right subtree as the target subtree; the traversal module 804 is further configured to perform leaf node traversal processing starting from the right edge leaf node in the right subtree, and stop traversing after reaching the target leaf node.

[0139] In one embodiment, the traversal module 804 is further configured to perform leaf node traversal processing starting from the right edge leaf node of the left subtree if the target leaf node has not been reached from the right subtree, and to stop traversing after reaching the target leaf node.

[0140] In one embodiment, the determining module 802 is further configured to use the endpoint time value in the target time range as the starting time value of the current round, and the query time range as the target search range of the current round, and perform log time value search processing in the target search range starting from the starting time value; the log time value is the time value corresponding to the log data; after finding the log time value, the query time range is updated based on the log time value to obtain the updated time range; the log time value is used as the starting time value of the next round of search, the updated time range is used as the target search range of the next round, and the log time value search processing in the target search range starting from the starting time value is returned to perform the next round of search, until the search end condition is met, and the last log time value found is used as the time value corresponding to the log data recorded in the target leaf node and is in a critical state, so as to obtain the boundary time value corresponding to the query time range.

[0141] In one embodiment, the endpoint time value is the time value corresponding to the offset of the log data storage file on the disk pointed to by the target leaf node; the determining module 802 is further configured to use the time value corresponding to the offset as the starting time value of this round, use the query time range as the target search range of this round, and update the offset of the data storage file on the disk pointed to by the target leaf node from the starting time value, so as to perform log time value search processing within the target search range.

[0142] In one embodiment, the determining module 802 is further configured to update the upper limit of the query time range using the log time value when searching for the lower boundary time value corresponding to the query time range, thereby obtaining the updated time range.

[0143] In one embodiment, the determining module 802 is further configured to update the lower limit of the query time range using the log time value when the upper limit time value corresponding to the query time range is found, so as to obtain the updated time range.

[0144] In one embodiment, the boundary time value includes a lower boundary time value and an upper boundary time value; the acquisition module 806 is further configured to acquire log data corresponding to each log data number within the target number range from the disk, as log data matching the query time range; wherein, the target number range is a number range formed by taking the log data number corresponding to the lower boundary time value as the starting value of the range and the log data number corresponding to the upper boundary time value as the ending value of the range.

[0145] The aforementioned log data query device determines a target node matching the query time range from the log query time tree. Each node in the log query time tree records the time range for log queries; the time range recorded in the target node overlaps with the query time range. Since the log query time tree records the time range for log queries, the data volume is relatively small. Therefore, the storage space occupied by the log query time tree is smaller than that occupied by storing log data, requiring fewer sectors. The device then determines a target subtree from the subtree under the target node to find boundary time values. Leaf node traversal is performed starting from the edge leaf node of the target subtree, stopping upon reaching the target leaf node. The time values ​​within the target time range recorded in the target leaf node have corresponding log data on the disk. The device identifies the time values ​​recorded in the target leaf node that correspond to log data and are in a critical state, thus obtaining the boundary time values ​​corresponding to the query time range. Based on these boundary time values, the device retrieves the log data matching the query time range from the disk. Since the storage space occupied by the log query time tree is not as large as that occupied by storing log data, the number of read and write operations on the sector is reduced, saving the query time of log data and thus improving the query efficiency of log data.

[0146] Each module in the aforementioned log data query device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0147] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media to run. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements a log data query method.

[0148] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 10 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a log data query method. The display unit of the computer device is used to form a visually visible image. It can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0149] Those skilled in the art will understand that Figure 9 and Figure 10The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0150] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0151] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0152] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0153] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0154] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0155] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0156] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A log data query method characterized by, The method includes: The target node matching the query time range is determined from the log query time tree; each node in the log query time tree is used to record the time range for log query; the time range recorded in the target node and the query time range have an intersection; Determine the target subtree for finding the boundary time value from the subtree under the target node; The leaf node traversal process starts from the edge leaf node of the target subtree and stops after traversing to the target leaf node; the time values ​​within the target time range recorded in the target leaf node exist as corresponding log data on the disk. The endpoint time value in the target time range is used as the starting time value of this round, and the query time range is used as the target search range of this round. Log time value search processing is performed in the target search range starting from the starting time value; the log time value is the time value corresponding to log data. After finding the log time value, the query time range is updated based on the log time value to obtain the updated time range; The log time value is used as the starting time value for the next round of search, the updated time range is used as the target search range for the next round, and the log time value search process is performed in the target search range starting from the starting time value to perform the next round of search until the search end condition is met. The last log time value found is used as the time value of the target leaf node that has corresponding log data and is in a critical state, so as to obtain the boundary time value corresponding to the query time range. Log data matching the query time range is retrieved from the disk based on the boundary time value.

2. The method according to claim 1, characterized in that, The target node has at least two subtrees; Determining the target subtree from the subtree under the target node for finding the boundary time value includes: If the query time range intersects with the time range of one of the records in at least two subtrees under the target node, the intersecting subtree is used as the target subtree for finding the boundary time value.

3. The method according to claim 1, characterized in that, The subtree under the target node includes the left subtree and the right subtree; the boundary time value includes the lower boundary time value; Determining the target subtree from the subtree under the target node for finding the boundary time value includes: If the query time range intersects with the time ranges recorded in both the left and right subtrees, and the lower boundary time value needs to be found, then the left subtree is taken as the target subtree. The step of traversing leaf nodes starting from the edge leaf nodes of the target subtree and stopping the traversal after reaching the target leaf node includes: The leaf node traversal process starts from the left edge leaf node of the left subtree and stops after reaching the target leaf node.

4. The method according to claim 3, characterized in that, The method further includes: If the target leaf node is not reached from the left subtree, leaf node traversal is performed starting from the left edge leaf node of the right subtree, and traversal stops after reaching the target leaf node.

5. The method according to claim 1, characterized in that, The subtree under the target node includes the left subtree and the right subtree; the boundary time value includes the upper boundary time value; Determining the target subtree from the subtree under the target node for finding the boundary time value includes: If the query time range intersects with the time ranges recorded in both the left and right subtrees, and the upper boundary time value needs to be found, then the right subtree is taken as the target subtree. The step of traversing leaf nodes starting from the edge leaf nodes of the target subtree and stopping the traversal after reaching the target leaf node includes: The leaf node traversal process starts from the right edge leaf node in the right subtree and stops after reaching the target leaf node.

6. The method according to claim 5, characterized in that, The method further includes: If the target leaf node is not reached from the right subtree, leaf node traversal is performed starting from the right edge leaf node of the left subtree, and traversal stops after reaching the target leaf node.

7. The method according to claim 1, characterized in that, The endpoint time value is the time value corresponding to the offset of the log data storage file in the disk pointed to by the target leaf node; The step of using the endpoint time value in the target time range as the starting time value of this round, and the query time range as the target search range of this round, and performing log time value search processing in the target search range starting from the starting time value, includes: The time value corresponding to the offset is used as the starting time value of this round, and the query time range is used as the target search range of this round. Starting from the starting time value, the offset of the data storage file in the disk pointed to by the target leaf node is updated to perform log time value lookup processing in the target search range.

8. The method according to claim 1, characterized in that, After finding the log time value, updating the query time range based on the log time value to obtain the updated time range includes: If the lower boundary time value corresponding to the query time range is found, the upper limit value of the query time range is updated using the log time value to obtain the updated time range.

9. The method according to claim 1, characterized in that, After finding the log time value, updating the query time range based on the log time value to obtain the updated time range includes: If the upper boundary time value corresponding to the query time range is found, the lower boundary value of the query time range is updated using the log time value to obtain the updated time range.

10. The method according to any one of claims 1 to 9, characterized in that, The boundary time values ​​include a lower boundary time value and an upper boundary time value; the step of retrieving log data from the disk that matches the query time range based on the boundary time values ​​includes: Retrieve the log data corresponding to each log data number within the target number range from the disk, and use it as the log data that matches the query time range; The target number range is a range that starts with the log data number corresponding to the lower boundary time value and ends with the log data number corresponding to the upper boundary time value.

11. A log data query device, characterized in that, The device includes: The determination module is used to determine the target node that matches the query time range from the log query time tree; each node in the log query time tree is used to record the time range for log query; the time range recorded in the target node has an intersection with the query time range; The determining module is further configured to determine, from the subtree under the target node, a target subtree for finding boundary time values; The traversal module is used to traverse leaf nodes starting from the edge leaf nodes of the target subtree and stop traversing after reaching the target leaf node; the time values ​​within the target time range recorded in the target leaf node exist as corresponding log data on the disk. The determining module is further configured to use the endpoint time value in the target time range as the starting time value of the current round, and the query time range as the target search range of the current round, and perform log time value search processing in the target search range starting from the starting time value; the log time value is the time value corresponding to log data; after finding the log time value, the query time range is updated based on the log time value to obtain the updated time range; the log time value is used as the starting time value of the next round of search, the updated time range is used as the target search range of the next round, and the log time value search processing in the target search range starting from the starting time value is returned to perform the next round of search, until the search end condition is met, and the last log time value found is used as the time value corresponding to the log data recorded in the target leaf node and in the critical state to obtain the boundary time value corresponding to the query time range; The acquisition module is used to acquire log data from the disk that matches the query time range based on the boundary time value.

12. The log data query device according to claim 11, characterized in that, The target node has at least two subtrees; the determining module is further configured to, when the query time range intersects with the time range of one of the records in the at least two subtrees under the target node, use the intersecting subtree as the target subtree for finding the boundary time value.

13. The log data query device according to claim 11, characterized in that, The subtree under the target node includes a left subtree and a right subtree; the boundary time value includes a lower boundary time value; the determining module is further configured to, when the query time range intersects with the time ranges recorded by the left subtree and the right subtree respectively, if it is necessary to find the lower boundary time value, then the left subtree is used as the target subtree; The traversal module is also used to perform leaf node traversal processing starting from the left edge leaf node of the left subtree, and stop traversing after reaching the target leaf node.

14. The log data query device according to claim 13, characterized in that, The traversal module is also used to perform leaf node traversal processing starting from the left edge leaf node of the right subtree if the target leaf node has not been reached from the left subtree, and to stop traversing after reaching the target leaf node.

15. The log data query device according to claim 11, characterized in that, The subtree under the target node includes a left subtree and a right subtree; the boundary time value includes an upper boundary time value; the determining module is further configured to, if the upper boundary time value needs to be found, take the right subtree as the target subtree when the query time range intersects with the time ranges recorded by the left subtree and the right subtree; the traversal module is further configured to perform leaf node traversal processing starting from the right edge leaf node in the right subtree, and stop traversing after reaching the target leaf node.

16. The log data query device according to claim 15, characterized in that, The traversal module is also used to perform leaf node traversal starting from the right edge leaf node of the left subtree if the target leaf node has not been reached from the right subtree, and to stop traversing after reaching the target leaf node.

17. The log data query device according to claim 11, characterized in that, The endpoint time value is the time value corresponding to the offset of the log data storage file in the disk pointed to by the target leaf node; the determining module is further configured to use the time value corresponding to the offset as the starting time value of this round, use the query time range as the target search range of this round, and update the offset of the data storage file in the disk pointed to by the target leaf node from the starting time value, so as to perform log time value search processing in the target search range.

18. The log data query device according to claim 11, characterized in that, The determining module is further configured to update the upper limit of the query time range using the log time value when the lower boundary time value corresponding to the query time range is found, so as to obtain the updated time range.

19. The log data query device according to claim 11, characterized in that, The determining module is further configured to update the lower limit of the query time range using the log time value when the upper boundary time value corresponding to the query time range is found, so as to obtain the updated time range.

20. The log data query device according to any one of claims 11 to 19, characterized in that, The boundary time value includes a lower boundary time value and an upper boundary time value; the acquisition module is also used to acquire the log data corresponding to each log data number within the target number range from the disk, as the log data matching the query time range; wherein, the target number range is a number range formed by taking the log data number corresponding to the lower boundary time value as the range starting value and the log data number corresponding to the upper boundary time value as the range ending value.

21. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 10.

22. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 10.

23. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 10.

Images