Log analysis method and system

Abstract

This specification discloses a log analysis method and system. The method includes: obtaining a log analysis request instruction; inputting the log analysis request instruction into a natural language processing (NLP) model; determining, based on the NLP model, a function call interface corresponding to the log analysis request instruction and log analysis parameters corresponding to the log analysis request instruction; calling a function in a function library corresponding to the function call interface according to the function call interface, and using the log analysis parameters as input parameters of the function; processing logs in the log repository through the function and its input parameters to obtain a log processing result corresponding to the log analysis request instruction. The system is implemented based on the above method.

Description

Technical Field

[0001] The embodiments in this specification mainly relate to the field of log analysis technology, specifically a log analysis method and system. Background Art

[0002] Log analysis refers to the process of parsing, processing, and analyzing log files generated by systems, applications, or network devices. By analyzing log data, useful information about system operating status, user behavior, and troubleshooting can be obtained.

[0003] Existing technologies typically employ log analysis tools (such as ELK (Elasticsearch, Logstash, Kibana), Splunk, Apache Hadoop, etc.) for log analysis. While these tools can assist in log analysis, the specific operations involved may not be very convenient, and the format and content of the log analysis may be somewhat limited. Summary of the Invention

[0004] This specification addresses the problems existing in the prior art by proposing a log analysis method and system, the technical solution of which is as follows:

[0005] Firstly, embodiments of this specification provide a log analysis method, including:

[0006] Retrieve log analysis request commands;

[0007] Input the log analysis request command into the natural language processing model, and determine the function call interface corresponding to the log analysis request command and the log analysis parameters corresponding to the log analysis request command based on the natural language processing model;

[0008] The function corresponding to the function call interface in the function library is called according to the function call interface, and the log analysis parameters are used as the input parameters of the function.

[0009] The logs in the log repository are processed by function and function input parameters to obtain log processing results corresponding to log analysis requests.

[0010] Secondly, embodiments of this specification provide a log analysis system, including:

[0011] The request instruction acquisition module is used to acquire log analysis request instructions;

[0012] The interface and parameter determination module is used to input log analysis request instructions into the natural language processing model, and determine the function call interface corresponding to the log analysis request instructions and the log analysis parameters corresponding to the log analysis request instructions based on the natural language processing model.

[0013] The function call module is used to call the corresponding function in the function library according to the function call interface, and to use the log analysis parameters as the input parameters of the function.

[0014] The log processing result acquisition module is used to process logs in the log repository through function and function input parameters to obtain log processing results corresponding to log analysis request instructions.

[0015] Thirdly, embodiments of this specification provide an electronic device, including:

[0016] Memory, used to store programs;

[0017] The processor is used to run programs stored in memory to execute the log analysis method of the first aspect.

[0018] Fourthly, embodiments of this specification provide a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement the log analysis method of the first aspect.

[0019] Beneficial effects

[0020] The log analysis method and system of this specification embodiment allows users to analyze logs simply by issuing a log analysis request command. The log analysis system can automatically obtain primary and secondary keywords based on a natural language processing model, and can automatically determine the function call interface corresponding to the log analysis request command through the primary keyword, as well as the log analysis parameters corresponding to the log analysis request command through the primary keyword and / or secondary keyword. It can also automatically call the function functions in the function library through the determined function call interface and log analysis parameters to analyze and process the logs, so as to obtain the log processing results required by the user, making the log analysis operation very convenient. In addition, the function functions in the function library can be created according to usage requirements, enabling the log analysis method and system of this embodiment to perform various forms of log analysis and processing, and has wide applicability.

[0021] Further or more detailed beneficial effects will be described in conjunction with specific embodiments in the detailed implementation. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating the log analysis method provided in Embodiment 1 of this specification;

[0024] Figure 2 This is a flowchart illustrating the process of obtaining log analysis request instructions provided in Embodiment 1 of this specification;

[0025] Figure 3 This is a flowchart illustrating how all initial log analysis request commands are processed to obtain log analysis request commands, as provided in Embodiment 1 of this specification.

[0026] Figure 4 This is a schematic diagram of the function call interface and log analysis parameter determination process provided in Embodiment 1 of this specification;

[0027] Figure 5 This is another flowchart illustrating the log analysis method provided in Embodiment 1 of this specification;

[0028] Figure 6 This is a flowchart illustrating the process of obtaining primary and secondary keywords from log analysis request instructions using a large natural language model, as provided in Embodiment 1 of this specification.

[0029] Figure 7 This is a flowchart illustrating the process of determining the function call interface corresponding to the log analysis request instruction through the main keyword, as provided in Embodiment 1 of this specification.

[0030] Figure 8 This is a flowchart illustrating the process of obtaining the similarity value between the main keyword and each interface identification code, as provided in Embodiment 1 of this specification.

[0031] Figure 9 This is another flowchart illustrating the log analysis method provided in Embodiment 1 of this specification;

[0032] Figure 10 This is a schematic diagram of the log analysis system provided in Embodiment 2 of this specification;

[0033] Figure 11 This is a schematic diagram of the electronic device provided in Embodiment 3 of this specification. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings.

[0035] The terms "first," "second," "third," etc., in the description, claims, and accompanying drawings are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus.

[0036] Example 1:

[0037] A log analysis method, such as Figure 1 As shown, it includes:

[0038] Step 102. Obtain the log analysis request command.

[0039] Log analysis requirements may include:

[0040] Log Quantity Statistics: Counts the total number of log records within a given date range. Log Level Distribution: Counts the number of log records at different levels (e.g., errors, warnings, messages). Log Source Analysis: Counts the number of log records generated from different sources (e.g., different applications, modules, or users). Error Type Analysis: Identifies the different error types that occurred within the given date range and counts the number of each error type. Error Frequency Analysis: Counts the frequency of different errors occurring within the given date range. Time Distribution Analysis: Counts the number of log records within different time periods within the given date range.

[0041] Log analysis request commands correspond to log analysis requests. Specifically, when the log analysis request is "Calculate the average value of abnormal logs over the past 5 days", the log analysis request command is "Calculate the average value of abnormal logs over the past 5 days". When the log analysis request is "Calculate the number of warnings from the previous 8 days to the previous 3 days", the log analysis request command is "Calculate the number of warnings from the previous 8 days to the previous 3 days".

[0042] This embodiment can obtain log analysis request commands through a log analysis system, such as... Figure 2 As shown, the specific instructions for obtaining log analysis requests in this embodiment include:

[0043] Step 202. Obtain the instruction input start signal.

[0044] The log analysis system has a command input interface (a) with a "Start Command Input" button. When a user wants to perform log analysis, they can press the "Start Command Input" button on interface a, which generates a command input start signal. The log analysis system then receives this signal and redirects the user from interface a to interface b, where the user can input specific log analysis requests.

[0045] Step 204. Determine the input instruction type and obtain the initial log analysis request instruction corresponding to the input instruction type.

[0046] The input command type can be text type, that is, the user directly enters the text of the log analysis request command. For example, when the log analysis request command is "to calculate the average value of the abnormal logs in the past 5 days", then the user can directly enter the text "to calculate the average value of the abnormal logs in the past 5 days".

[0047] The input command type can also be an image type, that is, the user directly inputs an image with the log analysis request command. For example, when the log analysis request command is "to calculate the average value of abnormal logs in the past 5 days", then the user can directly input an image with the text "to calculate the average value of abnormal logs in the past 5 days".

[0048] The input command type can also be voice type, that is, the user directly inputs a voice command with log analysis request. For example, when the log analysis request is "to calculate the average value of abnormal logs in the past 5 days", then the user can directly input the voice command "to calculate the average value of abnormal logs in the past 5 days".

[0049] The command input interface b has options for the type of command to input, such as "text type", "image type", "voice type" etc. The "text type" option has a corresponding area for filling in log analysis request commands, the "image type" option has a corresponding area for uploading images of log analysis request commands, and the "voice type" option has a corresponding area for uploading voice of log analysis request commands.

[0050] When the input command type is text, the user simply selects the "Text" option and then enters the corresponding log analysis request command text in the log analysis request command field. The log analysis system then receives the initial log analysis request command. When the input command type is image, the user selects the "Image" option and then uploads the corresponding log analysis request command image in the log analysis request command image upload field. The log analysis system then receives the initial log analysis request command. When the input command type is voice, the user selects the "Voice" option and then uploads the corresponding log analysis request command voice in the log analysis request command voice upload field. The log analysis system then receives the initial log analysis request command.

[0051] Step 206. Obtain the instruction input end signal.

[0052] The log analysis system's command input interface b also features a "Command Input End" button. After the user has entered the log analysis request text, uploaded the log analysis request image, or uploaded the log analysis request voice, the user can press the "Command Input End" button on the command input interface b. This will generate a command input end signal. Upon receiving this signal, the log analysis system indicates that the initial log analysis request command acquisition operation is complete and can proceed to step 208.

[0053] Step 208. Process the initial log analysis request instruction to obtain the log analysis request instruction.

[0054] Once the log analysis system receives the end signal of the instruction input, it will process the initial log analysis request instruction to obtain the required log analysis request instruction.

[0055] like Figure 3 As shown, in this embodiment, the initial log analysis request instruction is processed to obtain the log analysis request instruction, specifically including:

[0056] Step 302. Determine if there is an initial log analysis request instruction of image type. If there is an initial log analysis request instruction of image type, convert the initial log analysis request instruction of image type to an initial log analysis request instruction of text type.

[0057] When the log analysis system receives an initial log analysis request command of type image, it needs to extract the text from the image and use the extracted text as a new initial log analysis request command, thus changing the initial log analysis request command of type image to that of type text.

[0058] Step 304. Determine if there is an initial log analysis request command of voice type. If there is an initial log analysis request command of voice type, convert the initial log analysis request command of voice type into an initial log analysis request command of text type.

[0059] When the log analysis system receives an initial log analysis request command of voice type, it needs to convert the voice into text and use the converted text as a new initial log analysis request command, thereby changing the voice type initial log analysis request command into a text type initial log analysis request command.

[0060] Step 306. Concatenate the initial log analysis request instructions of text type to obtain the log analysis request instructions.

[0061] Scenario 1: A log analysis request instruction includes only one type of input instruction, and the log analysis request instruction is entered or uploaded as a whole in one go.

[0062] For example, if the initial log analysis request instruction obtained in step 208 is a text-based initial log analysis request instruction, this step directly uses that text-based initial log analysis request instruction as the final log analysis request instruction. Specifically, if the initial log analysis request instruction obtained in step 208 is "calculate the average value of abnormal logs in the past 5 days", and this initial log analysis request instruction is text-based, then step 306 directly uses "calculate the average value of abnormal logs in the past 5 days" as the final log analysis request instruction.

[0063] For example, if the initial log analysis request instruction obtained in step 208 is an image-type initial log analysis request instruction, then step 302 is needed to convert the image-type initial log analysis request instruction into a text-type initial log analysis request instruction, and then step 306 is needed to use the newly obtained text-type initial log analysis request instruction as the final log analysis request instruction. Specifically, if the initial log analysis request instruction obtained in step 208 is "count the number of warnings from the previous 8 days to the previous 3 days", and this initial log analysis request instruction is an image type, then step 302 is needed to extract the text "count the number of warnings from the previous 8 days to the previous 3 days" from the image, and then step 306 is needed to use the text "count the number of warnings from the previous 8 days to the previous 3 days" as the final log analysis request instruction.

[0064] For example, if the initial log analysis request instruction obtained in step 208 is a voice-type initial log analysis request instruction, then step 304 is needed to convert the voice-type initial log analysis request instruction into a text-type initial log analysis request instruction, and then step 306 is needed to use the newly obtained text-type initial log analysis request instruction as the final log analysis request instruction. Specifically, if the initial log analysis request instruction obtained in step 208 is "statistics the frequency of log errors in the past week", and this initial log analysis request instruction is a voice-type instruction, then step 304 is needed to convert the voice into the text "statistics the frequency of log errors in the past week", and then step 306 is needed to use the text "statistics the frequency of log errors in the past week" as the final log analysis request instruction.

[0065] Scenario 2: A log analysis request includes multiple input command types.

[0066] For example, in step 204, the user input the text "Statistics on the past 5 days" through the command input interface b, uploaded an image with the text "Abnormal logs", and uploaded a voice message with the content "Average". Then, in step 208, the log analysis system obtains the initial log analysis request command of the text type "Statistics on the past 5 days", the initial log analysis request command of the image type "Abnormal logs", and the initial log analysis request command of the voice type "Average".

[0067] At this point, the log analysis system will convert the initial log analysis request command "Abnormal Logs" (image type) into a text type in step 302, and convert the initial log analysis request command "Average Value" (voice type) into a text type in step 304. Finally, in step 306, all the initial log analysis request commands "Statistics of the last 5 days", "Abnormal Logs", and "Average Value" will be concatenated to obtain the final log analysis request command "Statistics of the average value of abnormal logs in the last 5 days".

[0068] Scenario 3: A log analysis request command includes only one type of input command, but is divided into multiple parts for input or upload.

[0069] For example, in step 204, the user selects the "Voice Type" option through the command input interface b, and then uploads three voice messages in the log analysis request command voice upload area: "Statistics of the past 5 days", "Abnormal logs", and "Average". Then, in step 208, the log analysis system obtains the initial log analysis request commands of the voice types: "Statistics of the past 5 days", "Abnormal logs", and "Average".

[0070] At this point, the log analysis system will convert the initial voice log analysis request commands "statistics of the past 5 days", "abnormal logs", and "average" into text-based initial log analysis request commands "statistics of the past 5 days", "abnormal logs", and "average" in step 304. Finally, in step 306, all the text-based initial log analysis request commands "statistics of the past 5 days", "abnormal logs", and "average" will be concatenated to obtain the final log analysis request command "statistics of the average value of abnormal logs in the past 5 days".

[0071] Entering initial log analysis requests directly in text format ensures high accuracy, but text input is cumbersome. Uploading voice requests is convenient, but errors in voice-to-text conversion can lower accuracy. Uploading image requests is convenient and accurate, but not always suitable. For example, if the initial request for a log analysis was "Calculate the average of abnormal logs over the past 5 days," and this was entered directly as text with a screenshot, subsequent log analyses with the same request can use an image instead. However, if the request changes to "Calculate the average of abnormal logs over the past 7 days," an image cannot be used.

[0072] In summary, this embodiment allows you to select the most suitable method to input the initial log analysis request command based on the actual situation, so that the log analysis system can obtain the corresponding log analysis request command.

[0073] like Figure 1 As shown, the log analysis method in this embodiment further includes:

[0074] Step 104. Input the log analysis request command into the natural language processing model, and determine the function call interface corresponding to the log analysis request command and the log analysis parameters corresponding to the log analysis request command based on the natural language processing model.

[0075] Once the log analysis system receives a log analysis request, it inputs the request into a Natural Language Model (NLP). The NLP helps determine the function call interface and log analysis parameters. The NLP is a model trained using machine learning and artificial intelligence techniques, capable of understanding natural language. This model is trained on a large-scale corpus to learn the grammatical, semantic, and contextual features of language, thus enabling it to understand and process human language. In other words, the NLP can understand and process the log analysis request in this embodiment.

[0076] like Figure 4 As shown, in this embodiment, determining the function call interface corresponding to the log analysis request command based on the natural language large model and determining the log analysis parameters corresponding to the log analysis request command specifically includes:

[0077] Step 402. Obtain the primary and secondary keywords in the log analysis request instructions through the natural language processing model.

[0078] like Figure 5 As shown, prior to step 102, the log analysis method of this embodiment further includes:

[0079] Step 502. Obtain historical log analysis requests, mark the historical log analysis requests with primary and secondary keywords, and train the natural language processing model using the historical log analysis requests marked with primary and secondary keywords.

[0080] Before officially using the Natural Language Processing (NLP) model, it needs to be trained using a large number of historical log analysis requests. These historical log analysis requests require manual labeling of primary and secondary keywords. For example, when the historical log analysis request is "Calculate the average value of abnormal logs over the past 5 days," "over the past 5 days" and "abnormal" can be manually labeled as secondary keywords, and "average value" as the primary keyword, based on the semantics of the request. Similarly, when the historical log analysis request is "Calculate the number of warnings from the previous 8 days to the previous 3 days," "from the previous 8 days to the previous 3 days" can be manually labeled as secondary keywords, and "warnings" as the primary keyword, based on the semantics of the request. In short, this step trains the NLP model using a sufficient number of historical log analysis requests with primary and secondary keyword labeling, enabling the NLP model to be used in step 402.

[0081] Return to step 402, as follows Figure 6 As shown, in this embodiment, the main keywords and secondary keywords obtained from log analysis request instructions through a natural language processing model specifically include:

[0082] Step 602. Obtain keywords from the log analysis request instructions.

[0083] The Natural Language Processing (NLP) model can directly retrieve all keywords from log analysis requests. In this embodiment, if the current log analysis request is "calculate the average value of abnormal logs over the past 5 days," the log analysis system inputs this request into the pre-trained NLP model, and the NLP model automatically outputs all the keywords: "past 5 days," "abnormal," and "average."

[0084] Step 604. Obtain the intent matching score for each keyword, determine the keyword with the highest intent matching score as the primary keyword for the log analysis request command, and determine the remaining keywords as secondary keywords for the log analysis request command.

[0085] After the log analysis system obtains all the keywords, it also acquires the intent matching score for each keyword. The keyword with the highest intent matching score is designated as the primary keyword, and the remaining keywords are designated as secondary keywords. For example, in this embodiment, the intent matching score for the keyword "last 5 days" is 22, the keyword "abnormal" is 33, and the keyword "average" is 45. Therefore, the log analysis system will use "average" as the primary keyword and "last 5 days" and "abnormal" as secondary keywords.

[0086] Furthermore, this embodiment obtains the probability of keywords as the main intent of log analysis requests through a natural language big data model, and determines the intent matching score of keywords based on the probability.

[0087] In addition to directly outputting all keywords in a log analysis request, the natural language processing model can also directly output the probability of each keyword representing the primary intent of that log analysis request. For example, in this embodiment, the probability of the keyword "last 5 days" representing the primary intent of the log analysis request "to calculate the average value of abnormal logs over the last 5 days" is 22%; the probability of the keyword "abnormal" representing the primary intent of the log analysis request "to calculate the average value of abnormal logs over the last 5 days" is 33%; and the probability of the keyword "average value" representing the primary intent of the log analysis request "to calculate the average value of abnormal logs over the last 5 days" is 45%. Therefore, the log analysis system can determine that the intent matching score for the keyword "last 5 days" is 22 points, the intent matching score for the keyword "abnormal" is 33 points, and the intent matching score for the keyword "average value" is 45 points.

[0088] Once the log analysis system has determined the primary and secondary keywords in the log analysis request instruction in step 402 (assuming the log analysis request instruction in step 402 is "to calculate the average value of abnormal logs in the last 5 days", the final determined primary keyword is "average value", and the secondary keywords are "last 5 days" and "abnormal"), it will continue to step 404.

[0089] Step 404. Determine the function call interface corresponding to the log analysis request command by using the main keyword.

[0090] This embodiment includes a function library containing multiple functions, such as time functions, average functions, outlier functions, variance functions, etc. In this embodiment, a log analysis request can only call one function, and which function is called is determined by the primary keyword. For example, when the primary keyword is "last 5 days", the time function is called; when the primary keyword is "outlier", the outlier function is called; and when the primary keyword is "average", the average function is called.

[0091] Each function needs to be invoked through its corresponding function call interface. For example, the average value function can be directly invoked through function call interface 1, the time function through function call interface 2, and the outlier function through function call interface 3. Therefore, after obtaining the main keyword "average value," it is necessary to first find function call interface 1 through the main keyword "average value," and then invoke the average value function through function call interface 1. Thus, this embodiment requires first finding the function call interface corresponding to the main keyword (i.e., the log analysis request command) through the main keyword.

[0092] like Figure 7 As shown, in this embodiment, determining the function call interface corresponding to the log analysis request command through the main keyword specifically includes:

[0093] Step 702. Obtain the similarity value between the main keyword and each interface identification code.

[0094] Each function call interface has a unique interface identification code. Assume this embodiment has function call interfaces 1, 2, and 3. The interface identification code for function call interface 1 could be XXXXXX1, for function call interface 2 it could be XXXXXX2, and for function call interface 3 it could be XXXXXX3.

[0095] This embodiment uses interface identification codes to determine the function call interface corresponding to the main keyword. Specifically, the function call interface with the highest similarity value between its interface identification code and the keyword is selected as the function call interface corresponding to the main keyword. Therefore, this embodiment needs to obtain the similarity value between the main keyword and each interface identification code.

[0096] like Figure 8 As shown, in this embodiment, obtaining the similarity value between the main keyword and each interface identification code specifically includes:

[0097] Step 802. Obtain the interface code identification word of an interface identification code.

[0098] Each function call interface has a corresponding interface code identifier. For example, the interface code identifier for function call interface number 1 is set to the identifier words "average", "average value", and "average number".

[0099] This step first obtains the interface code identification words of the interface call interface for function 1, namely, "average", "average value", and "average number".

[0100] Step 804. Perform similarity matching between the main keyword and each interface code identification word of the interface identification code to obtain the sub-similarity value between the main keyword and each interface code identification word.

[0101] Assuming the current primary keyword is "average value", this step performs similarity matching between the primary keyword "average value" and each API code recognition term in step 802 to obtain the sub-similarity value between the primary keyword "average value" and each API code recognition term. For example, the sub-similarity value between the primary keyword "average value" and the first API code recognition term "average" is 80, the sub-similarity value between the primary keyword "average value" and the second API code recognition term "average value" is 100, and the sub-similarity value between the primary keyword "average value" and the third API code recognition term "average number" is 90.

[0102] Step 806. Use the largest sub-similarity value as the similarity value between the main keyword and the interface identification code.

[0103] Following step 804, since the sub-similarity values ​​in step 804 are 80, 100 and 90, with 100 being the largest, 100 is used as the similarity value between the main keyword "average value" and the interface identification code of the function call interface No. 1.

[0104] Similarly, repeat steps 802 to 806, assuming the similarity value between the main keyword "average value" and the interface identification code of function call interface No. 2 is 77. Then repeat steps 802 to 806 again, assuming the similarity value between the main keyword "average value" and the interface identification code of function call interface No. 3 is 66.

[0105] At this point, return to step 702. The log analysis system in this embodiment has obtained the similarity values ​​between the main keyword "average value" and each interface identification code, which are 100 (interface identification code corresponding to function call interface 1), 77 (interface identification code corresponding to function call interface 2), and 66 (interface identification code corresponding to function call interface 3).

[0106] Step 704. Use the interface identification code with the highest similarity value as the interface identification code corresponding to the main keyword.

[0107] Following step 702, since the similarity values ​​in step 702 are 100, 66 and 77, with 100 being the largest, the interface identification code corresponding to 100 (i.e. XXXXXX1) is used as the interface identification code corresponding to the main keyword "average".

[0108] Step 706. Determine the corresponding function call interface based on the interface identification code.

[0109] Following step 704, since the function call interface corresponding to the interface identification code XXXXXX1 is function call interface 1, function call interface 1 is used as the function call interface corresponding to the primary keyword "average value".

[0110] Returning to step 404, this step uses the primary keyword "average value" to determine that the function call interface corresponding to the log analysis request command "calculate the average value of abnormal logs in the past 5 days" is function call interface number 1. Then proceed to step 406.

[0111] Step 406. Determine the log analysis parameters corresponding to the log analysis request command through primary keywords and / or secondary keywords.

[0112] When the log analysis request command is "calculate the average value of abnormal logs over the past 5 days", step 402 determines that the primary keyword of this log analysis request command is "average value", and the secondary keywords are "past 5 days" and "abnormal". In this embodiment, the secondary keyword "past 5 days" determines the first log analysis parameter as T(-5,0), where T represents the time range of log statistics, -5 represents the previous 5 days, and 0 represents the current day. The secondary keyword "abnormal" determines the second log analysis parameter as Y, where Y represents the abnormal values ​​of the statistical logs. However, the log analysis parameter cannot be obtained using the primary keyword "average value".

[0113] When the log analysis request command is "statistics on logs from the previous 8 days to the previous 3 days", step 402 determines that the primary keyword of this log analysis request command is "the previous 8 days to the previous 3 days", and the secondary keyword is none. In this embodiment, the primary keyword "the previous 8 days to the previous 3 days" determines the first log analysis parameter as T(-8,-3), where T represents the time range of log statistics, -8 represents the previous 8 days, and -3 represents the previous 3 days. Since there is no secondary keyword, the log analysis parameter cannot be obtained through the secondary keyword.

[0114] Assuming the log analysis request instruction in this embodiment is "to calculate the average value of abnormal logs in the past 5 days", then the log analysis parameters of the log analysis request instruction "to calculate the average value of abnormal logs in the past 5 days" can be determined as T(-5,0) and Y through the secondary keywords "past 5 days" and "abnormal" in step 406.

[0115] like Figure 1 As shown, the log analysis method in this embodiment further includes:

[0116] Step 106. Call the corresponding function in the function library according to the function call interface, and use the log analysis parameters as the input parameters of the function.

[0117] like Figure 9 As shown, prior to step 102, the log analysis method of this embodiment further includes:

[0118] Step 901. Create a function call interface. Each function call interface has a unique interface identification code, and each interface identification code has an interface code identification word.

[0119] Step 902. Create a function corresponding to the function call interface. The function takes log analysis parameters as input parameters and stores the created function in the function library.

[0120] This embodiment includes a function library, where functions can be created according to actual usage requirements. After a function is created, a function call interface is also created that allows direct invocation of that function. Furthermore, a unique interface identifier is assigned to this interface, and at least one identifier keyword is assigned to the identifier.

[0121] For example, in this embodiment, an average function can be created according to usage requirements and stored in the function library. A function call interface No. 1 is created for the average function, and an interface identification code XXXXXX1 is set for the function call interface No. 1. Finally, the interface identification code XXXXXX1 is set with the interface code identification words "average", "average value", and "average number".

[0122] This embodiment allows for various processing of logs, as long as the corresponding function and function call interface are created in advance. In other words, the log analysis method in this embodiment can perform various forms of analysis and processing on logs, making it widely applicable.

[0123] Returning to step 106, after step 104 has determined the function call interface and log analysis parameters based on the primary and secondary keywords of the log analysis request instruction, the log analysis system will directly call the corresponding function in the function function library according to the function call interface in step 106, and when calling the corresponding function, the log analysis parameters will be used as the input parameters of the function.

[0124] Step 108. Process the logs in the log repository using the function and its input parameters to obtain the log processing results corresponding to the log analysis request instructions.

[0125] Following step 106, the called function will process the logs in the log repository based on its input parameters. For example, if the called function is an averaging function with input parameters T(-5,0) and Y, it will first count the total number of abnormal logs in the log repository over the past 5 days, and then divide the total number by 5 to obtain the average value of the abnormal logs over the past 5 days.

[0126] The log analysis system in this embodiment also has a result display interface, through which the log processing results of this step can be displayed.

[0127] In this embodiment of the log analysis method, when a user needs to analyze logs, they only need to issue a log analysis request command. The log analysis system can automatically obtain primary and secondary keywords based on a natural language processing model, and can automatically determine the function call interface corresponding to the log analysis request command through the primary keyword, as well as the log analysis parameters corresponding to the log analysis request command through the primary keyword and / or secondary keyword. It can also automatically call the function functions in the function library through the determined function call interface and log analysis parameters to analyze and process the logs, so as to obtain the log processing results required by the user, making the log analysis operation very simple. In addition, the function functions in the function library can be created according to usage requirements, so that the log analysis method of this embodiment can perform various forms of log analysis and processing, and has wide applicability.

[0128] Example 2:

[0129] A log analysis system, such as Figure 10 As shown, it includes: a request instruction acquisition module, an interface and parameter determination module, a function call module, and a log processing result acquisition module.

[0130] The request instruction acquisition module is used to acquire log analysis request instructions. The interface and parameter determination module inputs the log analysis request instructions into the natural language processing model (NLP) and, based on the NLP, determines the corresponding function call interface and log analysis parameters. The function call module calls the corresponding function from the function library according to the function call interface, using the log analysis parameters as input parameters. The log processing result acquisition module processes the logs in the log repository using the function and its input parameters to obtain the log processing result corresponding to the log analysis request instruction.

[0131] The request instruction acquisition module includes: a start signal acquisition unit, an initial instruction acquisition unit, an end signal acquisition unit, and a request instruction determination unit.

[0132] The start signal acquisition unit is used to acquire the instruction input start signal. The initial instruction acquisition unit is used to determine the input instruction type and acquire the initial log analysis request instruction corresponding to the input instruction type. The end signal acquisition unit is used to acquire the instruction input end signal. The request instruction determination unit is used to process the initial log analysis request instruction to obtain the log analysis request instruction.

[0133] The request instruction determination unit includes: a first instruction determination and processing subunit, a second instruction determination and processing subunit, and an instruction splicing subunit.

[0134] The first instruction determination and processing subunit determines whether an initial log analysis request instruction of image type exists. If such an instruction exists, it converts it into a text-based initial log analysis request instruction. The second instruction determination and processing subunit determines whether an initial log analysis request instruction of voice type exists. If such an instruction exists, it converts it into a text-based initial log analysis request instruction. The instruction concatenation subunit concatenates the text-based initial log analysis request instructions to obtain the final log analysis request instruction.

[0135] The interface and parameter determination module includes: a primary and secondary keyword acquisition unit, an interface determination unit, and a parameter determination unit.

[0136] The primary and secondary keyword acquisition unit is used to obtain the primary and secondary keywords in the log analysis request command through a natural language processing model. The interface determination unit is used to determine the function call interface corresponding to the log analysis request command based on the primary keywords. The parameter determination unit is used to determine the log analysis parameters corresponding to the log analysis request command based on the primary and / or secondary keywords.

[0137] The log analysis system in this embodiment also includes a model training module.

[0138] The model training module is used to obtain historical instructions for log analysis requests, mark the historical instructions for log analysis requests with primary and secondary keywords, and train a large natural language model by using the historical instructions for log analysis requests marked with primary and secondary keywords.

[0139] The primary and secondary keyword acquisition units include: keyword acquisition sub-unit and intent matching score acquisition sub-unit.

[0140] The keyword acquisition subunit is used to acquire keywords from the log analysis request instructions. The intent matching score acquisition subunit is used to acquire the intent matching score of each keyword, and the keyword with the highest intent matching score is determined as the primary keyword of the log analysis request instruction, while the remaining keywords are determined as secondary keywords. The intent matching score acquisition subunit uses a natural language processing model to obtain the probability that a keyword is the primary intent of the log analysis request instruction, and determines the intent matching score of the keyword based on the probability.

[0141] The interface determination unit includes: a similarity value acquisition subunit, an interface identification code determination subunit, and an interface determination subunit.

[0142] The similarity value acquisition subunit is used to obtain the similarity value between the main keyword and each interface identification code. The interface identification code determination subunit is used to select the interface identification code with the highest similarity value as the interface identification code corresponding to the main keyword. The interface determination subunit is used to determine the corresponding function call interface based on the interface identification code.

[0143] The similarity value acquisition subunit includes: the interface code recognition word acquisition subunit, the sub-similarity value acquisition subunit, and the similarity value determination subunit.

[0144] The API identification term acquisition subunit is used to obtain the API identification term for an API identification code. The sub-similarity value acquisition subunit is used to perform similarity matching between the main keyword and each API identification term of the API identification code to obtain the sub-similarity value between the main keyword and each API identification term. The similarity value determination subunit is used to take the largest sub-similarity value as the similarity value between the main keyword and the API identification code.

[0145] The log analysis system in this embodiment also includes an interface creation module and a function creation module.

[0146] The interface creation module is used to create function call interfaces. Each function call interface has a unique interface identifier, and each interface identifier includes an interface code identification term. The function creation module is used to create function functions corresponding to the function call interfaces. These function functions use log analysis parameters as input parameters, and the created function functions are stored in the function library.

[0147] In this embodiment of the log analysis system, when a user needs to analyze logs, they only need to issue a log analysis request command. The log analysis system can automatically obtain primary and secondary keywords based on a natural language processing model, and can automatically determine the function call interface corresponding to the log analysis request command through the primary keyword, as well as the log analysis parameters corresponding to the log analysis request command through the primary keyword and / or secondary keyword. It can also automatically call the function functions in the function library through the determined function call interface and log analysis parameters to analyze and process the logs to obtain the log processing results required by the user, making log analysis operations very convenient. In addition, the function functions in the function library can be created according to usage requirements, enabling the log analysis system of this embodiment to perform various forms of log analysis and processing, making it widely applicable.

[0148] Example 3:

[0149] An electronic device, such as Figure 11 As shown, it includes: a memory and a processor. The memory is used to store programs. The processor is used to run the programs stored in the memory to execute the log analysis method in Example 1.

[0150] Specifically, the electronic device in this embodiment may include: at least one processor, at least one network interface, user interface, memory, and at least one communication bus.

[0151] The communication bus can be used to connect and communicate with the above-mentioned components.

[0152] The client interface may include buttons, and optional client interfaces may also include standard wired interfaces and wireless interfaces.

[0153] Network interfaces may include, but are not limited to, Bluetooth modules, NFC modules, Wi-Fi modules, etc.

[0154] A processor may include one or more processing cores. The processor connects various parts within the electronic device using various interfaces and lines, executing instructions, programs, code sets, or instruction sets stored in memory, and calling data stored in memory to perform various functions of the routing device and process data. Optionally, the processor can be implemented using at least one hardware form of DSP, FPGA, or PLA. The processor can integrate one or more of the following: CPU, GPU, and modem. The CPU primarily handles the operating system, client interface, and applications; the GPU is responsible for rendering and drawing the content required for display; and the modem handles wireless communication. It is understood that the modem may also be implemented as a separate chip without being integrated into the processor.

[0155] The memory may include RAM or ROM. Optionally, the memory may include a non-transitory computer-readable medium. The memory may be used to store instructions, programs, code, code sets, or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch functionality, sound playback functionality, image playback functionality, etc.), instructions for implementing the various method embodiments described above, etc.; the data storage area may store data involved in the various method embodiments described above, etc. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0156] Example 4:

[0157] A computer-readable storage medium stores computer program instructions thereon, which, when executed by a processor, implement the log analysis method of Embodiment 1. If the components of the electronic device in Embodiment 3 are implemented as software functional units and sold or used as independent products, they can be stored in the computer-readable storage medium of this embodiment.

[0158] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this specification is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., Digital Versatile Discs (DVDs)), or semiconductor media (e.g., Solid State Disks (SSDs)).

[0159] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks. Unless otherwise specified, the technical features of this embodiment and its implementation can be combined arbitrarily.

[0160] The embodiments described above are merely preferred embodiments of this specification and are not intended to limit the scope of this specification. Any modifications and improvements made by those skilled in the art to the technical solutions of this specification without departing from the spirit of this specification should fall within the protection scope defined by the claims of this specification.

Claims

1. A log analysis method, comprising: Retrieve log analysis request commands; The log analysis request instruction is input into the natural language processing model, and the function call interface corresponding to the log analysis request instruction and the log analysis parameters corresponding to the log analysis request instruction are determined based on the natural language processing model. The function corresponding to the function call interface in the function function library is called according to the function call interface, and the log analysis parameters are used as the input parameters of the function. The logs in the log repository are processed using the function and its input parameters to obtain the log processing result corresponding to the log analysis request instruction. The step of inputting the log analysis request instruction into the natural language processing model, and determining the function call interface corresponding to the log analysis request instruction and the log analysis parameters corresponding to the log analysis request instruction based on the natural language processing model includes: The primary and secondary keywords in the log analysis request instructions are obtained through the natural language processing model. The main keyword is used to determine the function call interface corresponding to the log analysis request instruction; The log analysis parameters corresponding to the log analysis request instruction are determined by the primary keyword and / or the secondary keyword. The main and secondary keywords obtained from the log analysis request command through a large natural language model include: Retrieve keywords from the log analysis request command; Obtain the intent matching score of each keyword, determine the keyword with the highest intent matching score as the primary keyword of the log analysis request instruction, and determine the remaining keywords as secondary keywords of the log analysis request instruction; The step of determining the function call interface corresponding to the log analysis request instruction through the main keyword includes: Obtain the similarity value between the main keyword and each interface identification code; The interface identification code with the highest similarity value is used as the interface identification code corresponding to the main keyword; The corresponding function call interface is determined based on the interface identification code.

2. The log analysis method according to claim 1, obtaining the log analysis request instruction includes: Get the instruction input start signal; Determine the type of input instruction and obtain the initial log analysis request instruction corresponding to the type of input instruction; Obtain the end signal of instruction input; The initial log analysis request instruction is processed to obtain the log analysis request instruction.

3. The log analysis method according to claim 2, wherein processing the initial log analysis request instruction to obtain the log analysis request instruction includes: Determine whether there is an initial log analysis request instruction of image type. If there is an initial log analysis request instruction of image type, convert the initial log analysis request instruction of image type into an initial log analysis request instruction of text type. Determine whether there is an initial log analysis request instruction of voice type. If there is an initial log analysis request instruction of voice type, convert the initial log analysis request instruction of voice type into an initial log analysis request instruction of text type. The initial log analysis request instruction of the text type is concatenated to obtain the log analysis request instruction.

4. The log analysis method according to claim 1 further includes: Obtain historical log analysis requests, and mark the historical log analysis requests with primary and secondary keywords. Train the natural language processing model using the historical log analysis requests marked with primary and secondary keywords.

5. The log analysis method according to claim 1, wherein the probability of the keyword being the main intent of the log analysis request instruction is obtained through a natural language big data model, and the intent matching score of the keyword is determined through the probability.

6. The log analysis method according to claim 1, obtaining the similarity value between the main keyword and each interface identification code includes: Obtain an interface code identification word for the interface identification code; The main keyword is matched with each of the interface code identification words of the interface identification code to obtain the sub-similarity value between the main keyword and each of the interface code identification words. The largest sub-similarity value is taken as the similarity value between the main keyword and the interface identification code.

7. The log analysis method according to claim 1 further includes: Create a function call interface, wherein the function call interface has a unique interface identification code, and each interface identification code has an interface code identification word; Create a function corresponding to the function call interface, the function takes the log analysis parameters as input parameters, and store the created function in the function library.

8. A log analysis system, comprising: The request instruction acquisition module is used to acquire log analysis request instructions; The interface and parameter determination module is used to input the log analysis request instruction into the natural language processing model, and determine the function call interface corresponding to the log analysis request instruction and the log analysis parameters corresponding to the log analysis request instruction based on the natural language processing model. The function call module is used to call the function corresponding to the function call interface in the function function library according to the function call interface, and to use the log analysis parameters as the input parameters of the function. The log processing result acquisition module is used to process the logs in the log repository through the function and the input parameters of the function to obtain the log processing result corresponding to the log analysis request instruction; The interface and parameter determination module includes: The primary and secondary keyword acquisition unit is used to acquire the primary and secondary keywords in the log analysis request instruction through a natural language big data model. An interface determination unit is used to determine the function call interface corresponding to the log analysis request instruction based on the main keyword. The parameter determination unit is used to determine the log analysis parameters corresponding to the log analysis request instruction through the primary keyword and / or the secondary keyword; The primary and secondary keyword acquisition unit includes: The keyword acquisition subunit is used to acquire keywords from the log analysis request instruction; The intent matching score acquisition subunit is used to acquire the intent matching score of each keyword, determine the keyword with the highest intent matching score as the primary keyword of the log analysis request instruction, and determine the remaining keywords as secondary keywords of the log analysis request instruction. The interface determination unit includes: The similarity value acquisition subunit is used to acquire the similarity value between the main keyword and each interface identification code; The interface identification code determination subunit is used to select the interface identification code with the highest similarity value as the interface identification code corresponding to the main keyword. The interface determination subunit is used to determine the corresponding function call interface based on the interface identification code.

9. The log analysis system according to claim 8, wherein the request instruction acquisition module comprises: The start signal acquisition unit is used to acquire the instruction input start signal; An initial instruction acquisition unit is used to determine the type of input instruction and acquire the initial log analysis request instruction corresponding to the type of input instruction. The end signal acquisition unit is used to acquire the instruction input end signal; The request instruction determination unit is used to process the initial log analysis request instruction to obtain the log analysis request instruction.

10. The log analysis system according to claim 9, wherein the request instruction determination unit comprises: The first instruction determination and processing subunit is used to determine whether there is an initial log analysis request instruction of image type. When there is an initial log analysis request instruction of image type, the initial log analysis request instruction of image type is converted into an initial log analysis request instruction of text type. The second instruction determination and processing subunit is used to determine whether there is an initial log analysis request instruction of voice type. When there is an initial log analysis request instruction of voice type, the initial log analysis request instruction of voice type is converted into an initial log analysis request instruction of text type. The instruction splicing subunit is used to splice the initial log analysis request instruction of the text type to obtain the log analysis request instruction.

11. The log analysis system according to claim 8, further comprising: The model training module is used to acquire historical instructions for log analysis requests, mark the historical instructions for log analysis requests with primary and secondary keywords, and train the natural language large model using the historical instructions for log analysis requests marked with primary and secondary keywords.

12. In a log analysis system according to claim 8, the intent matching score acquisition subunit obtains the probability that the keyword is the main intent of the log analysis request instruction through a natural language big data model, and determines the intent matching score of the keyword through the probability.

13. The log analysis system according to claim 8, wherein the similarity value acquisition subunit comprises: The interface code identification word acquisition subunit is used to acquire an interface code identification word for the interface identification code; The sub-similarity value acquisition sub-unit is used to perform similarity matching between the main keyword and each of the interface code identification words of the interface identification code to obtain the sub-similarity value between the main keyword and each of the interface code identification words; The similarity value determination sub-unit is used to determine the maximum sub-similarity value as the similarity value between the main keyword and the interface identification code.

14. The log analysis system according to claim 8, further comprising: An interface creation module is used to create function call interfaces. Each function call interface has a unique interface identification code, and each interface identification code has an interface code identification word. The function creation module is used to create a function corresponding to the function call interface. The function takes the log analysis parameters as input parameters and stores the created function in the function library.

15. An electronic device comprising: Memory, used to store programs; A processor for running the program stored in the memory to perform the log analysis method according to any one of claims 1-7.

16. A computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the log analysis method of any one of claims 1-7.

Images