Log analysis method and device, electronic equipment and storage equipment

Abstract

The invention provides a log analysis method and device, electronic equipment and a storage medium, and relates to the technical field of data processing, in particular to the field of large models, knowledge maps and artificial intelligence. According to the specific implementation scheme, a user behavior log of at least one crashed user is obtained, and a target behavior description text of the crashed user is generated according to the user behavior log; generating a target operation path diagram of the crashed user based on the target behavior description text; and performing path clustering on the target operation path diagram of the collapsed user to obtain at least one path class cluster, and analyzing the path class cluster to obtain a collapse analysis result.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, specifically to the field of large models, knowledge graphs and artificial intelligence, and in particular to a log analysis method, device, electronic device and storage medium. Background Art

[0002] When an application crashes, the user behavior path needs to be analyzed. The current system usually relies on manual extraction and analysis of user behavior logs when analyzing user behavior paths. The logs have poor readability, the interpretation process is cumbersome, and it is impossible to achieve intelligence and automation, making it difficult to cope with complex user behavior data. Summary of the invention

[0003] The present disclosure provides a log analysis method, device, electronic device and storage medium.

[0004] According to one aspect of the present disclosure, a log analysis method is provided, comprising:

[0005] Obtaining a user behavior log of at least one crashed user, and generating a target behavior description text of the crashed user according to the user behavior log;

[0006] Based on the target behavior description text, generating a target operation path map of the crashed user;

[0007] Perform path clustering on the target operation path graph of the crashed user to obtain at least one path cluster, and analyze the path cluster to obtain a crash analysis result.

[0008] According to another aspect of the present disclosure, there is provided a log analysis device, comprising:

[0009] A first acquisition module, configured to acquire a user behavior log of at least one crashed user, and generate a target behavior description text of the crashed user according to the user behavior log;

[0010] A second acquisition module is used to generate a target operation path map of the crashed user based on the target behavior description text;

[0011] The path analysis module is used to perform path clustering on the target operation path graph of the crash user, obtain at least one path cluster, and analyze the path cluster to obtain a crash analysis result.

[0012] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0013] at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the method described in the embodiment of the first aspect.

[0016] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to execute the method described in the embodiment of the first aspect.

[0017] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program, wherein the computer program implements the method described in the embodiment of the first aspect when executed by a processor.

[0018] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0020] Figure 1 is a schematic diagram of a log analysis method provided by an embodiment of the present disclosure;

[0021] Figure 2 is a schematic diagram of another log analysis method provided by an embodiment of the present disclosure;

[0022] Figure 3 is a schematic diagram of another log analysis method provided by an embodiment of the present disclosure;

[0023] Figure 4 is a schematic diagram of another log analysis method provided by an embodiment of the present disclosure;

[0024] Figure 5 It is a logic diagram of a log analysis method provided by an embodiment of the present disclosure;

[0025] Figure 6 is a structural block diagram of a log analysis device provided by an embodiment of the present disclosure;

[0026] Figure 7 is a schematic block diagram of an example electronic device for implementing an embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0028] Data processing is the collection, storage, retrieval, processing, transformation and transmission of data. It runs through all areas of social production and social life. Its basic purpose is to extract and derive valuable and meaningful data for certain specific people from large amounts of disorganized and difficult to understand data.

[0029] A large model refers to a machine learning model with large-scale parameters and complex computing structure. It is usually built by a deep neural network and has billions or even hundreds of billions of parameters. The purpose is to improve the model's expressiveness and predictive performance and to be able to handle more complex tasks and data.

[0030] Knowledge Graph is a graph-based data structure consisting of nodes and edges. Each node represents an "entity" and each edge represents the "relationship" between entities. It is essentially a semantic network that uses visualization technology to describe knowledge resources and their carriers, and mine, analyze, construct, draw and display knowledge and their mutual connections. It displays complex knowledge fields through data mining, information processing, knowledge measurement and graph drawing.

[0031] Artificial Intelligence (AI) is a new technical science that studies and develops theories, methods, technologies and application systems for simulating, extending and expanding human intelligence. It is an important part of the intelligent discipline. Research in this field includes robotics, speech recognition, image recognition, natural language processing and expert systems. Artificial intelligence can simulate the information process of human consciousness and thinking.

[0032] Figure 1 is a schematic diagram of a log analysis method provided by an embodiment of the present disclosure; Figure 1 As shown, the method comprises the following steps:

[0033] S101, obtaining a user behavior log of at least one crashed user, and generating a target behavior description text of the crashed user according to the user behavior log.

[0034] Crashed users are users who encounter an application that suddenly stops working and exits due to a code defect or operating system defect while using the application, making it impossible for the user to continue using the application.

[0035] The user behavior log is a log that records user activity data, including the user's access, browsing, clicking, and searching behaviors. It may also include the user's uniform resource locator and timestamp information. The user behavior log can be used to understand user behavior or make product improvements and optimizations. In this embodiment, the user behavior log may include information such as the user's operation records before and after the crash occurs, network status, and device status.

[0036] Optionally, the user behavior log can be parsed to extract key information in the user behavior log, such as the page the user entered, the operations performed, and the network environment in which the user is located, and a target behavior description text of the crashed user is generated based on the extracted key information. The target behavior description text at least includes the page the user entered, the operations performed, and the network environment in which the user is located, for example, the user enters a video playback page under a Wireless Fidelity (WIFI) network.

[0037] S102, generating a target operation path map of the crashed user based on the target behavior description text.

[0038] In some implementations, the target operation path graph can arrange user operations in chronological order to reproduce the user's actual operation path. The target operation path graph can be presented in the form of a graph structure. For example, each operation behavior is used as a node, and the operation behaviors that have transitions are connected. For example, a click behavior and a search behavior. The user performs a search behavior after the click behavior, and there is a connection between the click behavior and the search behavior. In this way, the user operation behaviors are connected in chronological order to reproduce the user's actual operation path.

[0039] S103, performing path clustering on the target operation path graph of the crashed user to obtain at least one path cluster, and analyzing the path cluster to obtain a crash analysis result.

[0040] In some implementations, similarity calculation can be performed on the target operation path graphs of the crashed user based on a pre-trained model, and the target operation paths with similarity greater than a preset similarity threshold can be clustered to obtain a path cluster, which includes one or more identical or similar target operation path graphs. Analysis is performed based on the identical or similar target operation path graphs to determine the common operations of the user before the crash event occurs, thereby obtaining more accurate and reliable crash analysis results.

[0041] In this embodiment, a target behavior description text of the crashing user is generated by acquiring the user behavior log of the crashing user, and a target operation path map of the crashing user is generated with a clear and accurate target behavior description text, thereby reproducing the operation behavior of the crashing user, and performing path clustering based on the target operation path map of the crashing user when the crash occurs, to obtain path clusters consisting of the same or similar target operation path maps, thereby determining the common features between the crashing users based on the path clusters, obtaining accurate crash analysis results, and improving the efficiency and accuracy of log analysis in crash events.

[0042] Figure 2 is a schematic diagram of another log analysis method provided by an embodiment of the present disclosure; Figure 2 As shown, the method comprises the following steps:

[0043] S201, obtaining a user behavior log of at least one crashed user.

[0044] In some implementations, crash events can be monitored, and in response to monitoring crash events, the crash events are parsed to obtain detailed information about the crash events; the identifier of the crashing user and the crash time period are extracted from the detailed information about the crash events; optionally, the crash time can be monitored by a crash monitoring platform, and when a crash event is monitored, the crash monitoring platform parses the crash time to obtain detailed information about the crash event, and then extracts the identifier of the crashing user and the crash time period from the detailed information, so as to timely process and analyze the crash event.

[0045] Optionally, in this embodiment, the identifier of the crashed user may be a called user identification number (CUID), and the crash time period may be a time period of 3 hours before and after the crash occurs, so as to ensure the integrity of the user behavior log.

[0046] After obtaining the identification of the crashing user and the crash time period, the user behavior log of the crashing user can be obtained based on the identification of the crashing user and the crash time period to ensure the integrity of the log acquisition; optionally, a log retrieval task can be generated based on the identification of the crashing user and the crash time period, and the user behavior log can be retrieved in the log database according to the log retrieval task.

[0047] It can be understood that the log retrieval task is used to retrieve the user behavior log of the crashed user, based on parameters such as the user CUID and the crash time period, to ensure that the behavior log related to the user can be accurately retrieved and located, thereby retrieving accurate user behavior logs from the log database according to the log retrieval task.

[0048] In this embodiment, the retrieval of user behavior logs can be achieved through the positioning platform. The crash monitoring platform and the positioning platform are connected through an interface. After the crash monitoring platform monitors the crash event and obtains the user CUID and the crash time period, the interface of the positioning platform is called to create a log retrieval task. When the log retrieval task is created, parameters such as the user CUID and the crash time period need to be passed so that the positioning platform can accurately retrieve the behavior logs related to the user based on the user CUID and the crash time period. After the log retrieval task is successfully created, the user behavior log related to the crash user is retrieved from the log database based on the CUID and the crash time period in the log retrieval task.

[0049] In the embodiments of the present disclosure, the implementation method of step S201 can be implemented by any of the methods in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0050] S202: Generate an initial behavior description text of the crashed user according to the user behavior log.

[0051] In some implementations, the user behavior log can be parsed to obtain candidate key fields; target key fields can be filtered from the candidate key fields; optionally, the candidate key fields can be timestamp, page name, operation type, error message, network status, etc., the extracted candidate key fields are compared with preset rules, and those that meet the preset rules are further processed as target key fields. For example, in this embodiment, the crash time is mainly caused by user operation behavior, then the candidate key fields related to the user operation behavior can be filtered out as target key fields for analysis, such as operation type, page name and network status as target key fields.

[0052] Furthermore, the field value of the target key field can be obtained; based on the field value of the target key field, the description information of the target key field is generated; based on the description information of the target key field, the initial behavior description text is generated to ensure that the key field information in the initial behavior description text is more concise and complete.

[0053] The field value is the specific content of the target key field. Each field has its corresponding field value, and the field values ​​together constitute a complete data record. Optionally, the field value of the target key field can be matched with the record in the database to determine whether the field value matches the record item in the database. In response to the existence of a matching record item for the field value, a description text of the target key field is generated based on the matching record item. In response to the absence of a matching record item for the field value, a description text of the target key field is generated based on a preset default rule, such as using a default value or a general description text to ensure the integrity of the description text during user analysis.

[0054] In some implementations, it is also possible to determine whether the target key field is a field carrying a label, and whether the field carrying a label is an important field or a key field; in response to the target key field being a field carrying a label, a highlight parameter is configured for the description text of the target key field, such as highlighting the description text by bolding, italicizing, or underlining the text, so as to help users quickly identify key content.

[0055] Furthermore, an initial behavior description text is generated based on the description information of the target key field. The initial behavior description text may include the page entered by the user, the operations performed, and the network environment in which the user is located, etc., which is specifically based on the filtered target key field.

[0056] S203, optimizing the initial behavior description text through the pre-trained large model to generate the target behavior description text.

[0057] Optionally, an application programming interface (API) may be called to input an initial behavior description text into the big model through the API interface, and the big model may perform text optimization on the initial behavior description text to generate a target behavior description text; the target behavior description text is a language expression that is easier to understand and more natural.

[0058] For example, the initial behavior description text may be "on Wi-Fi network, feed_video_landing page, short video". After the initial behavior description text is input into the large model for text optimization, the target behavior description text may be "the user enters the video playback page under Wi-Fi connection and watches a short video".

[0059] S204, generating a target operation path map of the crashed user based on the target behavior description text.

[0060] In the embodiments of the present disclosure, the implementation method of step S204 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0061] S205, performing path clustering on the target operation path graph of the crashed user to obtain at least one path cluster, and analyzing the path cluster to obtain a crash analysis result.

[0062] In the embodiments of the present disclosure, the implementation method of step S205 can be implemented by any of the methods in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0063] In this embodiment, by monitoring crash events, after determining that a crash event has occurred, the crash user identifier and the crash time period are obtained based on the detailed information of the crash event, and a log retrieval task is generated based on the crash user identifier and the crash time period. The user behavior log of the crash user is determined based on the log retrieval task to ensure that the obtained user behavior log is more complete, and the target key fields are screened based on the complete user behavior log, and the initial behavior description text is determined based on the description information of the target key fields. The initial behavior description text is further optimized based on the pre-trained large model to obtain a target behavior description text with a clearer and easier-to-understand description, and then the target operation path map is obtained based on the target behavior description text, and the target operation path map is path clustered to obtain accurate crash analysis results.

[0064] Figure 3 is a schematic diagram of another log analysis method provided by an embodiment of the present disclosure; Figure 3 As shown, the method comprises the following steps:

[0065] S301, obtaining a user behavior log of at least one crashed user, and generating a target behavior description text of the crashed user according to the user behavior log.

[0066] In the embodiments of the present disclosure, the implementation method of step S301 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0067] S302: Determine an operation position and operation information of the operation position according to the target behavior description text, where the operation information includes an operation type and an operation time.

[0068] The operation location and operation information of the operation location are extracted from the target behavior description text. Optionally, the operation location can be the page operated by the user, and the operation type in the operation information can be a specific operation, such as browsing, clicking, exiting or searching, etc. The specific operation behavior types are not described in detail. The operation time is the time when the user performs the operation behavior.

[0069] S303: Generate an initial operation path of the crashed user according to the operation position and the operation information of the operation position.

[0070] Optionally, the initial operation path of the crashing user is a text description of the user's operation behavior in chronological order, that is, the operation behavior path of the crashing user is determined according to the operation position and the operation information of the operation position. For example, the initial operation path may be that the crashing user operates from position A to position B, and from position B to position C, and the operation path of the crashing user is described in text form.

[0071] S304, determining the operation position as a node, and constructing edges between nodes based on the operation information to convert the graph structure of the initial operation path to generate a target operation path graph.

[0072] It can be understood that, with each operation position as a node, the switching of the operation type and the operation time between the operation positions are determined according to the operation information, so as to construct the edges between the nodes, connect the corresponding nodes with the operation position conversion, and convert the text description of the user operation behavior in the initial operation path into the corresponding graph structure, so as to obtain the target operation path graph; optionally, the corresponding graph structure generation tool can be called to convert the initial operation path into a graph structure, and the behavior trajectory of the user operation position can be reflected in the target operation path graph. Based on the target operation path, the behavior trajectory of the crashed user can be intuitively determined to facilitate the analysis of the user's operation behavior.

[0073] S305, performing path clustering on the target operation path graph of the crashed user, obtaining at least one path cluster, and analyzing the path cluster to obtain a crash analysis result.

[0074] In some implementations, the target operation path graph of the crashed user can be input into the big model, and the big model obtains the similarity between the target operation path graphs, and clusters the paths according to the similarity to obtain at least one path cluster, wherein the path cluster includes multiple similar or identical target operation path graphs. The big model can be a big language model to obtain more accurate path clusters with stronger natural language understanding capabilities.

[0075] Optionally, the large model can be a generative model that combines the functions of graph structure and information retrieval, so that the target operation graph of the graph structure can be processed according to the large model. The large model uses the similarity analysis in the graph structure to obtain the similarity between the target operation path graphs, and clusters the paths according to the similarity. The target operation path graphs with the same or similar characteristics are clustered to obtain corresponding path clusters. The common factors causing the crash are analyzed based on the same or similar target operation path graphs of the crashed users, thereby improving the accuracy of crash identification.

[0076] In some implementations, it is also possible to obtain crash-related issues corresponding to the path cluster input by the user; input the crash-related issues into the big model, and the big model analyzes the target operation path graph within the path cluster based on the crash-related issues to obtain the crash analysis results corresponding to the path cluster. That is, the user and the big model can have a dialogue and ask questions to determine the crash-related issues corresponding to the path cluster. For example, if the question is "What are the user operation behaviors before the crash event occurs", after receiving the crash-related issues, the big model can analyze the target operation path graph within the path cluster to obtain a crash analysis result that is more in line with the user's wishes, identify the common problems of the crashed users and the correlation between them and the user's operation path, and obtain the crash analysis results.

[0077] Furthermore, according to at least one of the contents in the crash analysis results, the target behavior description text, and the path cluster, a push message can be generated and sent to the terminal device associated with the business personnel. It is understandable that the crash analysis results, the target behavior description text, and the path cluster all include the operation behavior information of the crashed user, and the push message is generated and sent to the terminal device associated with the business personnel. The business personnel can view the detailed analysis results or description text to determine the key operation reasons that caused the crash and perform processing such as application optimization.

[0078] In the embodiments of the present disclosure, the implementation method of step S305 can be implemented by any of the methods in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0079] In this embodiment, after determining the target behavior description text, the operation position and the operation information of the operation position in the target behavior description text are extracted, and then the initial operation path expressed in the text is generated according to the operation position and the operation information of the operation position, and the graph structure is converted with the initial operation path to generate a target operation path graph to reproduce the user operation behavior of the crashed user, and perform a more accurate crash analysis based on the user operation behavior. The large model calculates the similarity between the target operation path graphs to obtain a more accurate path cluster, and the path analysis efficiency is high. Further, the crash analysis can be performed through a dialogue inquiry with the large model, that is, inputting crash-related questions, and the large model performs a targeted analysis of the target operation path graph in the path cluster based on the crash-related questions to obtain a crash analysis result that is more in line with the user's wishes. The crash analysis result can also be fed back to the terminal device associated with the business personnel, so that the business personnel can view and optimize it, thereby improving the user experience.

[0080] Figure 4 is a schematic diagram of another log analysis method provided by an embodiment of the present disclosure; Figure 4 As shown, the method comprises the following steps:

[0081] S401, obtaining a user behavior log of at least one crashed user.

[0082] In the embodiments of the present disclosure, the implementation method of step S401 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0083] S402: Generate an initial behavior description text of the crashed user according to the user behavior log.

[0084] In the embodiments of the present disclosure, the implementation method of step S402 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0085] S403, optimizing the initial behavior description text through the pre-trained large model to generate the target behavior description text.

[0086] In the embodiments of the present disclosure, the implementation method of step S403 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0087] S404: Determine the operation position and operation information of the operation position according to the target behavior description text, where the operation information includes the operation type and operation time.

[0088] In the embodiments of the present disclosure, the implementation method of step S404 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0089] S405: Generate an initial operation path of the crashed user according to the operation position and the operation information of the operation position.

[0090] In the embodiments of the present disclosure, the implementation method of step S405 can be implemented by any of the methods in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0091] S406, determining the operation position as a node, and constructing edges between nodes based on the operation information to convert the graph structure of the initial operation path to generate a target operation path graph.

[0092] In the embodiments of the present disclosure, the implementation method of step S406 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0093] S407, performing path clustering on the target operation path graph of the crashed user, obtaining at least one path cluster, and analyzing the path cluster to obtain a crash analysis result.

[0094] In the embodiments of the present disclosure, the implementation method of step S407 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0095] In this embodiment, after determining that a crash event has occurred, a log retrieval task is generated according to the detailed information of the crash event, and the user behavior log of the crashing user is determined according to the log retrieval task to ensure that the obtained user behavior log is more complete. The initial behavior description text is determined according to the complete user behavior log, and the initial behavior description text is further optimized according to the pre-trained large model to obtain a target behavior description text with a clearer and easier to understand description, and the operation position and the operation information of the operation position in the target behavior description text with a clearer and more accurate description are extracted, and then the initial operation path expressed in the text is generated according to the operation position and the operation information of the operation position, and the initial operation path is converted into a graph structure to generate a target operation path graph to reproduce the user operation behavior of the crashing user. The large model performs path clustering according to the target operation path graph to obtain path clusters composed of the same or similar target operation path graphs, and the acquisition of path clusters is more accurate and the path analysis efficiency is higher, which correspondingly increases the efficiency and accuracy of log analysis, and further determines the common characteristics between the crashing users according to the path clusters, obtains accurate crash analysis results and feeds them back to the terminal device associated with the business personnel, so that the business personnel can view and optimize them easily.

[0096] Based on the above embodiments, Figure 5 It is a logic diagram of a log analysis method provided by an embodiment of the present disclosure. The CUID and crash time period of the crashing user when the crash occurs are obtained by monitoring crash events, a log retrieval task is generated according to the CUID and crash time period of the crashing user, the user behavior log is obtained from the log database, and the initial behavior description text is determined by parsing the user behavior log, that is, the screening of target key fields and the matching of field values ​​of target key fields. The text of the initial behavior description text is further optimized based on a large model to obtain a target behavior description text, the user's operation position and operation information of the operation position are extracted according to the target behavior description text, thereby generating a target operation path map, clustering the paths of the same or similar target operation path maps to obtain path clusters, and then analyzing according to the path clusters to obtain crash analysis results and feed them back to the terminal device associated with the business personnel, thereby realizing a comprehensive and accurate analysis of the crash log.

[0097] Figure 6 is a structural block diagram of a log analysis device provided by an embodiment of the present disclosure; Figure 6 As shown, the method comprises the following steps:

[0098] A first acquisition module 601 is used to acquire a user behavior log of at least one crashed user, and generate a target behavior description text of the crashed user according to the user behavior log;

[0099] The second acquisition module 602 is used to generate a target operation path map of the crashed user based on the target behavior description text;

[0100] The path analysis module 603 is used to perform path clustering on the target operation path graph of the crashed user, obtain at least one path cluster, and analyze the path cluster to obtain a crash analysis result.

[0101] In some implementations, the first acquisition module 601 includes:

[0102] Generate the initial behavior description text of the crashed user based on the user behavior log;

[0103] The initial behavior description text is optimized through the pre-trained large model to generate the target behavior description text.

[0104] In some implementations, the first acquisition module 601 includes:

[0105] Parse user behavior logs to obtain candidate key fields;

[0106] Filter the target key field from the candidate key fields and obtain the description information of the target key field;

[0107] Generate initial behavior description text based on the description information of the target key fields.

[0108] In some implementations, the first acquisition module 601 includes:

[0109] Get the field value of the target key field;

[0110] Generate description information of the target key field based on the field value of the target key field.

[0111] In some implementations, the first acquisition module 601 includes:

[0112] Get the field value of the target key field and determine whether the field value matches the record item in the database;

[0113] In response to the existence of a matching record item for the field value, generating a description text of the target key field based on the matching record item;

[0114] In response to the absence of a matching record item for the field value, a description text of the target key field is generated based on a preset default rule.

[0115] In some implementations, the first acquisition module 601 further includes:

[0116] Determine whether the target key field is a field that carries a label;

[0117] In response to the target key field being a field carrying a label, a highlight parameter is configured for a description text of the target key field.

[0118] In some implementations, the first acquisition module 601 includes:

[0119] Call the application programming interface API interface, input the initial behavior description text into the big model through the API interface, and the big model optimizes the initial behavior description text to generate the target behavior description text.

[0120] In some implementations, the second acquisition module 602 includes:

[0121] Determine the operation position and operation information of the operation position according to the target behavior description text, and the operation information includes the operation type and operation time;

[0122] Generate an initial operation path of the crashed user based on the operation location and the operation information of the operation location;

[0123] The operation position is determined as a node, and the edges between the nodes are constructed based on the operation information to transform the graph structure of the initial operation path and generate a target operation path graph.

[0124] In some implementations, the path analysis module 603 includes:

[0125] The target operation path graph of the crashed user is input into the big model, the big model obtains the similarity between the target operation path graphs, and clusters the paths according to the similarity to obtain at least one path cluster, wherein the path cluster includes multiple similar or identical target operation path graphs.

[0126] In some implementations, the path analysis module 603 includes:

[0127] Get the crash-related issues corresponding to the path cluster input by the user;

[0128] The crash-related problems are input into the big model, and the big model analyzes the target operation path graph within the path cluster based on the crash-related problems to obtain the crash analysis results corresponding to the path cluster.

[0129] In some implementations, the path analysis module 603 further includes:

[0130] According to the crash analysis result, the target behavior description text and at least one content in the path cluster, push information is generated and sent to a terminal device associated with the business personnel.

[0131] In some implementations, the first acquisition module 601 includes:

[0132] Get the crash user's ID and crash time period;

[0133] Based on the crash user's identifier and the crash time period, obtain the crash user's user behavior log.

[0134] In some implementations, the first acquisition module 601 includes:

[0135] Based on the identifier of the crashed user and the crash time period, a log retrieval task is generated, and the user behavior log is retrieved from the log database according to the log retrieval task.

[0136] In some implementations, the first acquisition module 601 includes:

[0137] Monitor the crash event, and in response to the monitored crash event, analyze the crash event to obtain detailed information of the crash event;

[0138] Extract the crash user's identity and crash time period from the crash event details.

[0139] In this embodiment, after determining that a crash event has occurred, a log retrieval task is generated according to the detailed information of the crash event, and the user behavior log of the crashing user is determined according to the log retrieval task to ensure that the obtained user behavior log is more complete. The initial behavior description text is determined according to the complete user behavior log, and the initial behavior description text is further optimized according to the pre-trained large model to obtain a target behavior description text with a clearer and easier to understand description, and the operation position and the operation information of the operation position in the target behavior description text with a clearer and more accurate description are extracted, and then the initial operation path expressed in the text is generated according to the operation position and the operation information of the operation position, and the initial operation path is converted into a graph structure to generate a target operation path graph to reproduce the user operation behavior of the crashing user. The large model performs path clustering according to the target operation path graph to obtain path clusters composed of the same or similar target operation path graphs, and the acquisition of path clusters is more accurate and the path analysis efficiency is higher, which correspondingly increases the efficiency and accuracy of log analysis, and further determines the common characteristics between the crashing users according to the path clusters, obtains accurate crash analysis results and feeds them back to the terminal device associated with the business personnel, so that the business personnel can view and optimize them easily.

[0140] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0141] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0142] Figure 7 A schematic block diagram of an example electronic device that can be used to implement an embodiment of the present disclosure is shown. The electronic device 700 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0143] like Figure 7 As shown, the device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0144] A number of components in the device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0145] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as the log analysis method. For example, in some embodiments, the log analysis method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the log analysis method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the log analysis method in any other appropriate manner (e.g., by means of firmware).

[0146] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0147] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0148] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0149] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0150] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0151] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0152] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0153] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A log analysis method, in, include: Obtaining a user behavior log of at least one crashed user, and generating a target behavior description text of the crashed user according to the user behavior log; Based on the target behavior description text, generating a target operation path map of the crashed user; Perform path clustering on the target operation path graph of the crashed user to obtain at least one path cluster, and analyze the path cluster to obtain a crash analysis result.

2. The method according to claim 1, in, The step of generating a target behavior description text of the crashed user according to the user behavior log includes: Generating an initial behavior description text of the crashed user according to the user behavior log; The initial behavior description text is optimized through a pre-trained large model to generate the target behavior description text.

3. The method according to claim 2, in, The step of generating an initial behavior description text of the crashed user according to the user behavior log includes: Parsing the user behavior log to obtain candidate key fields; Filtering a target key field from the candidate key fields, and obtaining description information of the target key field; The initial behavior description text is generated according to the description information of the target key field.

4. The method according to claim 3, in, The obtaining of description information of the target key field includes: Obtaining the field value of the target key field; Generate description information of the target key field according to the field value of the target key field.

5. The method according to claim 4, in, The obtaining of description information of the target key field includes: Obtaining the field value of the target key field, and determining whether the field value matches a record item in the database; In response to the existence of a matching record item for the field value, generating a description text of the target key field based on the matching record item; In response to the absence of a matching record item for the field value, a description text of the target key field is generated based on a preset default rule.

6. The method according to claim 4, in, After generating the description information of the target key field according to the field value of the target key field, the method further includes: Determine whether the target key field is a field carrying a tag; In response to the target key field being a field carrying a tag, a highlight parameter is configured for the description text of the target key field.

7. The method according to claim 2, in, The step of optimizing the initial behavior description text by using the pre-trained large model to generate the target behavior description text includes: An application programming interface (API) is called, and the initial behavior description text is input into the large model through the API interface. The large model performs text optimization on the initial behavior description text to generate the target behavior description text.

8. The method according to claim 1, in, The step of generating a target operation path map of the crashed user based on the target behavior description text includes: Determine an operation position and operation information of the operation position according to the target behavior description text, wherein the operation information includes an operation type and an operation time; generating an initial operation path of the crashed user according to the operation position and the operation information of the operation position; The operation position is determined to be a node, and edges between the nodes are constructed based on the operation information to convert the graph structure of the initial operation path to generate the target operation path graph.

9. The method according to claim 8, in, The performing path clustering on the target operation path graph of the crashed user to obtain at least one path cluster includes: The target operation path graph of the crashed user is input into the big model, the big model obtains the similarity between the target operation path graphs, and performs path clustering according to the similarity to obtain at least one path cluster, wherein the path cluster includes multiple similar or identical target operation path graphs.

10. The method according to claim 1, in, The analyzing the path cluster to obtain a crash analysis result includes: Obtaining crash-related issues corresponding to the path cluster input by the user; The crash-related problems are input into the large model, and the large model analyzes the target operation path graph within the path cluster based on the crash-related problems to obtain a crash analysis result corresponding to the path cluster.

11. The method according to claim 1, in, After analyzing the path cluster to obtain the crash analysis result, the method further includes: Generate push information according to the crash analysis result, the target behavior description text and at least one content in the path cluster, and send the push information to a terminal device associated with the business personnel.

12. The method according to any one of claims 1 to 11, in, The obtaining of the user behavior log of at least one crashed user includes: Obtaining the identifier of the crashed user and the crash time period; Based on the identifier of the crashed user and the crash time period, a user behavior log of the crashed user is obtained.

13. The method according to claim 12, in, The acquiring the user behavior log of the crash user based on the identifier of the crash user and the crash time period includes: Based on the identifier of the crashed user and the crash time period, a log retrieval task is generated, and the user behavior log is retrieved from a log database according to the log retrieval task.

14. The method according to claim 12, in, The obtaining the identifier of the crashed user and the crash time period includes: Monitoring a crash event, and in response to monitoring a crash event, parsing the crash event to obtain detailed information of the crash event; The identifier of the crash user and the crash time period are extracted from the detailed information of the crash event.

15. A log analysis device, include: A first acquisition module, configured to acquire a user behavior log of at least one crashed user, and generate a target behavior description text of the crashed user according to the user behavior log; A second acquisition module is used to generate a target operation path map of the crashed user based on the target behavior description text; The path analysis module is used to perform path clustering on the target operation path graph of the crash user, obtain at least one path cluster, and analyze the path cluster to obtain a crash analysis result.

16. The device according to claim 15, in, The first acquisition module includes: Generating an initial behavior description text of the crashed user according to the user behavior log; The initial behavior description text is optimized through a pre-trained large model to generate the target behavior description text.

17. The device according to claim 16, in, The first acquisition module includes: Parsing the user behavior log to obtain candidate key fields; Filtering a target key field from the candidate key fields, and obtaining description information of the target key field; The initial behavior description text is generated according to the description information of the target key field.

18. The device according to claim 17, in, The first acquisition module includes: Obtaining the field value of the target key field; Generate description information of the target key field according to the field value of the target key field.

19. The device according to claim 18, in, The first acquisition module includes: Obtaining the field value of the target key field, and determining whether the field value matches a record item in the database; In response to the existence of a matching record item for the field value, generating a description text of the target key field based on the matching record item; In response to the absence of a matching record item for the field value, a description text of the target key field is generated based on a preset default rule.

20. The device according to claim 18, in, The first acquisition module further includes: Determine whether the target key field is a field carrying a tag; In response to the target key field being a field carrying a tag, a highlight parameter is configured for the description text of the target key field.

21. The device according to claim 16, in, The first acquisition module includes: An application programming interface (API) is called, and the initial behavior description text is input into the large model through the API interface. The large model performs text optimization on the initial behavior description text to generate the target behavior description text.

22. The device according to claim 15, in, The second acquisition module includes: Determine an operation position and operation information of the operation position according to the target behavior description text, wherein the operation information includes an operation type and an operation time; generating an initial operation path of the crashed user according to the operation position and the operation information of the operation position; The operation position is determined to be a node, and edges between the nodes are constructed based on the operation information to convert the graph structure of the initial operation path to generate the target operation path graph.

23. The device according to claim 22, in, The path analysis module comprises: The target operation path graph of the crashed user is input into the big model, the big model obtains the similarity between the target operation path graphs, and performs path clustering according to the similarity to obtain at least one path cluster, wherein the path cluster includes multiple similar or identical target operation path graphs.

24. The device according to claim 15, in, The path analysis module comprises: Obtaining crash-related issues corresponding to the path cluster input by the user; The crash-related problems are input into the large model, and the large model analyzes the target operation path graph within the path cluster based on the crash-related problems to obtain a crash analysis result corresponding to the path cluster.

25. The device according to claim 15, in, The path analysis module further includes: Generate push information according to the crash analysis result, the target behavior description text and at least one content in the path cluster, and send the push information to a terminal device associated with the business personnel.

26. The device according to any one of claims 15 to 25, in, The first acquisition module includes: Obtaining the identifier of the crashed user and the crash time period; Based on the identifier of the crashed user and the crash time period, a user behavior log of the crashed user is obtained.

27. The device according to claim 26, in, The first acquisition module includes: Based on the identifier of the crashed user and the crash time period, a log retrieval task is generated, and the user behavior log is retrieved from a log database according to the log retrieval task.

28. The device according to claim 26, in, The first acquisition module includes: Monitoring a crash event, and in response to monitoring a crash event, parsing the crash event to obtain detailed information of the crash event; The identifier of the crash user and the crash time period are extracted from the detailed information of the crash event.

29. An electronic device, include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 14.

30. A non-transitory computer-readable storage medium storing computer instructions, in, The computer instructions are used to cause the computer to execute the method according to any one of claims 1-14.

31. A computer program product comprising a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 14.

Images