Real-time log screening method, device and equipment

Abstract

The invention provides a real-time log screening method, device and equipment, and is applied to the technical field of log screening. The method comprises the following steps: acquiring a real-time log, and determining a log level of the real-time log according to a log type of the real-time log; and based on the log type and the color list corresponding to the log type, performing eye-catching display on the real-time log, and performing eye-catching display on keywords in the real-time log according to a preset keyword color list. And in response to the real-time log screening instruction, screening matched logs from the real-time logs according to a log screening strategy in the real-time log screening instruction. According to the method, the target real-time log is screened out from the matched logs by utilizing the screening mode in the real-time log screening instruction, and is output and displayed, so that the real-time log and the keywords can be obviously displayed, the readability and the readability of the logs are improved, and developers and operation and maintenance personnel can identify and position problems more quickly.

Description

Technical Field

[0001] The present application relates to the technical field of log screening, and in particular to a real-time log screening method, device and equipment. Background Art

[0002] In the field of modern software development and operation and maintenance, especially in complex distributed systems and microservice architectures, logs are a window into the operating status of the system, and their importance is self-evident. At present, the traditional log output method is to output the text content of the log in real time in the form of black background and white text when the system generates the log. In this case, although there are textual differences in the log output, in the actual server operation scenario, when there are multi-threaded and large-scale logs, this text difference is often not enough to quickly capture important information. It is difficult to find whether the program event of concern has occurred, as well as the information content of the log input and output. Summary of the invention

[0003] The purpose of this application is to provide a real-time log screening method, device and equipment to solve the problem that the current real-time log output method is difficult to quickly capture important information, it is difficult to find out whether the program event of concern has occurred, and the information content of the log input and output.

[0004] In a first aspect, an embodiment of the present application provides a real-time log screening method, the method comprising: obtaining a real-time log, and determining the log level of the real-time log according to the log type of the real-time log. The real-time log is prominently displayed based on the log type and the color list corresponding to the log type, and the keywords in the real-time log are prominently displayed according to the preset keyword color list. In response to the real-time log screening instruction, matching logs are screened out from the real-time log according to the log screening strategy in the real-time log screening instruction. Using the screening method in the real-time log screening instruction, the target real-time log is screened out from the matching log and output for display.

[0005] The real-time log screening method provided in the embodiment of the present application can improve the readability and legibility of the log by prominently displaying the real-time log and keywords, so that developers and operation and maintenance personnel can identify and locate problems more quickly.

[0006] In a possible implementation, the log screening strategy includes one or more of the following strategies: a statistical value of a keyword, a value range of a keyword, and location information of a target real-time log.

[0007] In one possible implementation, when the log screening strategy is the statistical value of the keyword, the matching log is screened out from the real-time log according to the log screening strategy in the real-time log screening instruction, including: the current value and the historical value of the keyword. The historical value is determined based on the historical log before the real-time log. The current value and the historical value are statistically analyzed using a preset indicator counter to obtain a matching log.

[0008] In a possible implementation, the preset indicator counters include a counting indicator counter, a measurement indicator counter, a historical log distribution counter, and a summary indicator counter.

[0009] When the preset indicator counter is a counting indicator counter, the preset indicator counter is used to perform statistical analysis on the current value and the historical value to obtain a matching log, including: accumulating and calculating the current value and the historical value based on the counting indicator counter to obtain a cumulative sum. Using the keyword and the cumulative sum, the matching log is determined.

[0010] Or, when the preset indicator counter is a metering indicator counter, the preset indicator counter is used to perform statistical analysis on the current value and the historical value to obtain a matching log, including: based on multiple variable values ​​in the current value of the metering indicator counter and multiple variable values ​​in the historical value. Perform real-time metering on multiple variable values ​​in the current value and multiple variable values ​​in the historical value to obtain a metering result. Use the keyword and the metering result to determine the matching log.

[0011] Or, when the preset indicator counter is a historical log distribution counter, the preset indicator counter is used to perform statistical analysis on the current value and the historical value to obtain a matching log, including: time information corresponding to the current value and time information corresponding to the historical value. Based on the historical log distribution counter, a statistical distribution calculation is performed on the current value, the current time information, the historical value, and the time information corresponding to the historical value to obtain a first statistical distribution graph. The matching log is determined using the keyword and the first statistical distribution graph.

[0012] Or, when the preset indicator counter is a summary indicator counter, the preset indicator counter is used to perform statistical analysis on the current value and the historical value to obtain a matching log, including: performing error distribution statistics on the current value and the historical value based on the summary indicator counter to obtain a second statistical distribution graph. The error distribution statistics are used to count the error information in the current value and the historical value. The matching log is determined using the keyword and the second statistical distribution graph.

[0013] In a possible implementation, when the log screening condition is a value range of a keyword, matching logs are screened out from the real-time logs according to the log screening policy in the real-time log screening instruction, including: based on the value range of the keyword, matching logs are screened out from the real-time logs. The value of the keyword of the matching log belongs to the value range.

[0014] In a possible implementation, when the log screening condition is the location information of the target real-time log, matching logs are screened out from the real-time log according to the log screening policy in the real-time log screening instruction, including: screening out matching logs from the real-time log based on the location information.

[0015] In a possible implementation, the log screening method provided by the embodiment of the present application further includes: historical logs before the real-time log. According to the log screening strategy in the real-time log screening instruction, the historical matching logs are screened out from the historical logs. The target historical logs are screened out from the historical matching logs using the screening method in the real-time log screening instruction.

[0016] In a possible implementation, the screening mode includes displaying only matching logs and not displaying matching logs. When the screening mode is to display only matching logs, the target real-time log is screened out from the matching logs using the screening mode, including: determining the matching log as the target real-time log.

[0017] Or, when the filtering method is not to display matching logs, the target real-time logs are filtered out from the matching logs using the filtering method, including: determining the logs other than the matching logs in the real-time logs as the target real-time logs.

[0018] In a possible implementation manner, the eye-catching display includes one or more of the following: colored display, highlighted display, bold display, and italic display.

[0019] In a second aspect, an embodiment of the present application provides a real-time log screening device, which includes: an acquisition module, a processing module, and a display module.

[0020] Among them, the acquisition module is used for real-time logs.

[0021] The processing module is used to determine the log level of the real-time log according to the log type of the real-time log after the module receives the real-time log.

[0022] The display module is used to prominently display the real-time log based on the log type and the color list corresponding to the log type, and to prominently display the keywords in the real-time log according to the preset keyword color list.

[0023] The processing module is further used to respond to the real-time log screening instruction and screen out matching logs from the real-time logs according to the log screening strategy in the real-time log screening instruction. The target real-time log is screened out from the matching logs using the screening method in the real-time log screening instruction and output for display.

[0024] In a third aspect, an embodiment of the present application provides a real-time log screening device, which has the function of implementing the real-time log screening method of the first aspect or any possible implementation method. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0025] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is run on a computer, the computer can execute the real-time log screening method of the first aspect or any possible implementation method.

[0026] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the real-time log screening method of the first aspect or any possible implementation method.

[0027] Among them, the technical effects brought about by any design method in the second to fifth aspects can refer to the technical effects brought about by different possible implementation methods in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0029] Figure 1 A structural schematic diagram of a real-time log screening device provided in an embodiment of the present application;

[0030] Figure 2 A flowchart of a real-time log screening method provided in an embodiment of the present application;

[0031] Figure 3 A structural schematic diagram of a real-time log screening device provided in an embodiment of the present application;

[0032] Figure 4 A structural diagram of a real-time log screening system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0034] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0035] At present, the traditional log output method is to output the text content of the log in real time in the form of black background and white text when the system generates the log. In this case, although the logs have textual differences when they are output (for example, DEBUG, INFO, ERROR), in the actual server operation scenario, when there are multi-threaded and large-volume logs, such textual differences are often not enough to quickly capture important information, and it is difficult to find whether the program events of concern have occurred, as well as the information content of the log input and output.

[0036] Based on this, an embodiment of the present application provides a real-time log screening method, the method comprising: obtaining a real-time log, and determining the log level of the real-time log according to the log type of the real-time log. The real-time log is prominently displayed based on the log type and the color list corresponding to the log type, and the keywords in the real-time log are prominently displayed according to the preset keyword color list. In response to the real-time log screening instruction, matching logs are screened out from the real-time log according to the log screening strategy in the real-time log screening instruction. Using the screening method in the real-time log screening instruction, the target real-time log is screened out from the matching log and output for display. The real-time log screening method provided in the embodiment of the present application can improve the readability and legibility of the log by prominently displaying the real-time log and keywords, so that developers and operation and maintenance personnel can identify and locate problems more quickly.

[0037] The implementation of the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0038] On the one hand, a real-time log screening method provided in an embodiment of the present application can be executed by a real-time log screening device. Figure 1 As shown, the real-time log screening device 100 may include: a processor 101 and a memory 102. The memory 102 may be a memory in the processor 101.

[0039] The processor 101 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0040] The memory 102 may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. Among them, the nonvolatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM) and direct memory bus random access memory (DR RAM) or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory can be independent and connected to the processor 101 through a communication line. The memory 102 can also be integrated with the processor 101.

[0041] The memory 102 stores computer executable instructions for implementing the solution of the present application, and is executed by the processor 101. The processor 101 is used to execute the computer executable instructions stored in the memory 102, thereby implementing a real-time log screening method provided in the following embodiment of the present application.

[0042] On the one hand, the embodiment of the present application discloses a real-time log screening method, which can be Figure 1 The real-time log screening device 100 shown in FIG. Figure 2 As shown, the method may include the following steps.

[0043] S201, obtaining a real-time log, and determining a log level of the real-time log according to the log type of the real-time log.

[0044] Exemplarily, firstly, a log detection command is configured in the application program to obtain real-time logs when logs are generated.

[0045] After obtaining the real-time log, the log level of the real-time log can be determined according to the log type of the real-time log. For example, the log type may include: application log, security log, audit log, debug log, etc. When the log type is an application log, the log level can be determined based on the content of the real-time log and the impact of the real-time log on the system operation. When the log type is a security log, the log level can be determined based on the security-related events recorded in the real-time log, such as login attempts, permission changes, etc., which should usually be set to a higher level, such as WARNING or ERROR. When the log type is an audit log, the log is generally used to record user activities and system operations, and the log level is usually the INFO level. When the log type is a debug log, the log is generally used in the development and testing phases to record detailed execution process information, and the log level is usually the DEBUG level.

[0046] S202: highlighting the real-time log based on the log type and the color list corresponding to the log type, and highlighting the keywords in the real-time log according to the preset keyword color list.

[0047] Among them, the eye-catching display may include one or more of the following display modes: colored display, highlighted display, bold display, and italic display.

[0048] For example, different color lists can be defined for different log levels (INFO, WARN, ERROR, DEBUG, etc.), logs of different levels can be displayed in color, and keywords (e.g., info, keyword) in the real-time logs that have been displayed in color can be highlighted according to the preset keyword color list.

[0049] In this process, by combining the real-time log eye-catching display with the keyword eye-catching display, the user can focus only on the real-time information of interest and ignore the real-time log information that is not of interest. At the same time, different eye-catching colors are defined for different log levels. In the process of eye-catching display of keywords in the real-time log, the real-time log content saved in the file system will not be changed, and the log file content of other situations for checking the real-time log will not be affected.

[0050] S203 , in response to the real-time log screening instruction, screening out matching logs from the real-time logs according to the log screening policy in the real-time log screening instruction.

[0051] The screening strategy includes the statistical value of the keyword, the value range of the keyword, and the location information of the target real-time log.

[0052] In one possible implementation, when the log screening strategy is the statistical value of a keyword, the real-time log screening device obtains the current value and the historical value of the keyword. The historical value is determined based on the historical log before the real-time log. The current value and the historical value are statistically analyzed using a preset indicator counter to obtain a matching log.

[0053] Among them, the preset indicator counters may include counting indicator counters, measurement indicator counters, historical log distribution counters, and summary indicator counters.

[0054] In a possible implementation, when the preset indicator counter is a counting indicator counter, the real-time log screening device accumulates and calculates the current value and the historical value based on the counting indicator counter to obtain the accumulated sum, and determines the matching log by using the keyword and the accumulated sum.

[0055] For example, when the target field is the amount field, there are three values ​​for the field, two of which are historical values ​​and one is a current value. The real-time log screening device uses the indicator counter to add the three values ​​of the amount field (two historical values ​​and one current value) to obtain the cumulative sum, and then uses the amount field and the cumulative sum to determine the matching logs in the real-time day.

[0056] In another possible implementation, when the preset indicator counter is a measurement indicator counter, the real-time log screening device obtains multiple variable values ​​in the current value and multiple variable values ​​in the historical value based on the measurement indicator counter. The multiple variable values ​​in the current value and the multiple variable values ​​in the historical value are measured in real time to obtain the measurement result. The matching log is determined using the keyword and the measurement result.

[0057] For example, when the real-time log screening device counts the number of people online in the community, it uses the metering indicator counter to count the number of active users. It then adds up the number of people who log into the community, the number of people who click in the community, the number of people who log out of the community, etc., to get the number of active users in a certain short period of time.

[0058] In another possible implementation, when the preset indicator counter is a historical log distribution counter, the real-time log screening device obtains the time information corresponding to the current value and the time information corresponding to the historical value. Based on the historical log distribution counter, the current value, the current time information, the historical value, and the time information corresponding to the historical value are statistically calculated to obtain a first statistical distribution graph. The matching log is determined using the keyword and the first statistical distribution graph.

[0059] For example, the real-time log screening device uses the historical log distribution statistics device to count the data distribution of key fields in a certain historical time period, such as the heartbeat interval of the community statistics device: 0.1, 0.5, 1.5, 2.5, and outputs a line graph of the heartbeat interval.

[0060] Another possible implementation method is that when the preset indicator counter is a summary indicator counter, the real-time log screening device performs error distribution statistics on the current value and the historical value based on the summary indicator counter to obtain a second statistical distribution graph; the error distribution statistics are used to count the error information in the current value and the historical value. The matching log is determined using the keyword and the second statistical distribution graph.

[0061] For example, the real-time log screening device uses a summary indicator counter to count the distribution of key fields, such as the number of errors and the areas where the errors frequently occur, and then outputs a dot distribution graph with the number of errors and the areas where the errors frequently occur.

[0062] When the log filtering condition is a keyword value range, the real-time log filtering device filters out matching logs from real-time logs based on the keyword value range. The keyword value of the matching log falls within the value range.

[0063] When the log filtering condition is the location information of the target real-time log, the real-time log filtering device filters out matching logs from the real-time log based on the location information.

[0064] S204, using the screening method in the real-time log screening instruction, screen out the target real-time log from the matching logs and output it for display.

[0065] In a possible implementation, the real-time log screening device can also obtain the historical logs before the real-time log. According to the log screening strategy in the real-time log screening instruction, the historical matching logs are screened out from the historical logs. Using the screening method in the real-time log screening instruction, the target historical logs are screened out from the historical matching logs.

[0066] The real-time log screening method provided in the embodiment of the present application can improve the readability and legibility of the log by prominently displaying the real-time log and keywords, so that developers and operation and maintenance personnel can identify and locate problems more quickly.

[0067] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the working principle of the device. It is understandable that in order to realize the above functions, the real-time log screening device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0068] The embodiment of the present application can divide the functional modules of the real-time log screening device according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or software functional module.

[0069] It should be noted that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. Figure 3 FIG. 2 shows a possible schematic diagram of the composition of the real-time log screening device involved in the above-mentioned embodiments. Figure 3 As shown, the real-time log screening device 300 may include: an acquisition module 301 , a processing module 302 , and a display module 303 .

[0070] The acquisition module 301 is used to support the real-time log screening device 300 to execute S201 in a real-time log screening method provided in the real-time example of the present application.

[0071] The processing module 302 is used to support the real-time log screening device 300 to execute S202 or S204 in a real-time log screening method provided in the real-time example of the present application.

[0072] The display module 303 is used to support the real-time log screening device 300 to execute S203 of a real-time log screening method provided by the real-time example of the present application.

[0073] It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0074] The real-time log screening device 300 provided in the embodiment of the present application is used to perform the above Figure 2 The real-time log filtering method shown can therefore achieve the same effect as the above-mentioned real-time log filtering method.

[0075] The embodiment of the present application also provides a real-time log screening device, which can be the real-time log screening device described in the above embodiment. Figure 1 The real-time log screening device 100 shown can execute the real-time log screening method and related steps in the above method embodiment.

[0076] The embodiment of the present application also provides a computer-readable storage medium on which instructions are stored. When the instructions are executed, the real-time log screening method and related steps in the above method embodiment are executed.

[0077] The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer executes the real-time log screening method and related steps in the above method embodiment.

[0078] In some embodiments, the methods described herein may be implemented as computer program instructions encoded in a machine-readable format on a computer-readable storage medium or encoded on other non-transitory media or articles of manufacture.

[0079] The present application embodiment also provides a real-time log screening system 400, such as Figure 4 As shown, the real-time log screening system 400 includes at least one processor 401 and at least one interface circuit 402 .

[0080] As an example, when the real-time log screening system 400 includes a processor and an interface circuit, the processor may be Figure 4 The processor 401 shown in the solid line frame (or the processor 401 shown in the dotted line frame) may be Figure 4 The interface circuit 402 shown in the solid line frame (or the interface circuit 402 shown in the dotted line frame) is shown in the solid line frame. When the chip system 400 includes two processors and two interface circuits, the two processors include Figure 4 The processor 401 shown in the solid line frame and the processor 401 shown in the dotted line frame, the two interface circuits include Figure 4 The interface circuit 402 shown in the solid line frame and the interface circuit 402 shown in the dotted line frame are not limited to this.

[0081] The processor 401 and the interface circuit 402 may be interconnected via a line. For example, the interface circuit 402 may be used to receive a signal. In another example, the interface circuit 402 may be used to send a signal to another device (e.g., the processor 401). For example, the interface circuit 402 may read a computer instruction stored in a memory and send the computer instruction to the processor 401. The processor 401 executes the instruction and implements the various steps in the above embodiments in combination with the input and output devices, such as implementing Figure 2 The various steps performed in the method embodiment shown. Of course, the chip system may also include other discrete devices, which are not specifically limited in the embodiment of the present application.

[0082] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0083] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0084] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0085] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0086] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0087] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A real-time log screening method, characterized in that: The method comprises: Obtain a real-time log, and determine a log level of the real-time log according to the log type of the real-time log; The real-time log is prominently displayed based on the log type and the color list corresponding to the log type, and the keywords in the real-time log are prominently displayed according to the preset keyword color list; In response to the real-time log screening instruction, according to the log screening policy in the real-time log screening instruction, screening out matching logs from the real-time log; The target real-time log is filtered out from the matching logs by using the filtering method in the real-time log filtering instruction and is output for display.

2. The method according to claim 1, characterized in that The log screening strategy includes one or more of the following strategies: the statistical value of the keyword, the value range of the keyword, and the location information of the target real-time log.

3. The method according to claim 1 or 2, characterized in that: When the log screening strategy is a statistical value of the keyword, screening out matching logs from the real-time log according to the log screening strategy in the real-time log screening instruction includes: Obtaining the current value and the historical value of the keyword; the historical value is determined according to the historical log before the real-time log; The current value and the historical value are statistically analyzed using a preset indicator counter to obtain the matching log.

4. The method according to claim 3, characterized in that The preset indicator counters include counting indicator counters, measurement indicator counters, historical log distribution counters, and summary indicator counters; When the preset indicator counter is the counting indicator counter, the using the preset indicator counter to perform statistical analysis on the current value and the historical value to obtain the matching log includes: Based on the counting indicator counter, the current value and the historical value are cumulatively calculated to obtain a cumulative sum; Determine the matching log using the keyword and the accumulated sum; Or, when the preset indicator counter is the measurement indicator counter, the using of the preset indicator counter to perform statistical analysis on the current value and the historical value to obtain the matching log includes: Acquire multiple variable values ​​in the current value and multiple variable values ​​in the historical value based on the measurement indicator counter; Performing real-time measurement on a plurality of variable values ​​in the current value and a plurality of variable values ​​in the historical value to obtain a measurement result; Determine the matching log using the keyword and the measurement result; Or, when the preset indicator counter is the historical log distribution counter, the using of the preset indicator counter to perform statistical analysis on the current value and the historical value to obtain the matching log includes: Obtaining time information corresponding to the current value and time information corresponding to the historical value; Based on the historical log distribution statistics device, a statistical distribution calculation is performed on the current value, the current time information, the historical value and the time information corresponding to the historical value to obtain a first statistical distribution graph; Determine the matching log using the keyword and the first statistical distribution graph; Or, when the preset indicator counter is the summary indicator counter, the using the preset indicator counter to perform statistical analysis on the current value and the historical value to obtain the matching log includes: Based on the summary indicator counter, error distribution statistics are performed on the current value and the historical value to obtain a second statistical distribution graph; the error distribution statistics are used to count error information in the current value and the historical value; The matching log is determined using the keyword and the second statistical distribution graph.

5. The method according to claim 1 or 2, characterized in that: When the log screening condition is the value range of the keyword, screening out matching logs from the real-time log according to the log screening strategy in the real-time log screening instruction includes: Based on the value range of the keyword, the matching log is screened out from the real-time log; the value of the keyword of the matching log belongs to the value range.

6. The method according to claim 1 or 2, characterized in that: When the log screening condition is the location information of the target real-time log, screening out matching logs from the real-time log according to the log screening strategy in the real-time log screening instruction includes: The matching log is screened out from the real-time log based on the location information.

7. The method according to claim 1, characterized in that The method further comprises: Obtain the historical log before the real-time log; Filtering historical matching logs from the historical logs according to the log filtering strategy in the real-time log filtering instruction; The target historical log is filtered out from the historical matching logs by using the filtering method in the real-time log filtering instruction.

8. The method according to claim 1, characterized in that The screening method includes displaying only the matching logs or not displaying the matching logs; When the screening mode is to display only the matching logs, the using of the screening mode to screen out the target real-time logs from the matching logs includes: Determining that the matching log is the target real-time log; Or, when the screening method is not to display the matching log, using the screening method to screen out the target real-time log from the matching log includes: Determine the logs other than the matching logs in the real-time logs as the target real-time logs.

9. The method according to claim 1, characterized in that: The eye-catching display includes one or more of the following: colored display, highlighted display, bold display, and italic display.

10. A real-time log screening device, characterized in that: The device comprises: Acquisition module, used to obtain real-time logs; A processing module, configured to determine the log level of the real-time log according to the log type of the real-time log after the acquisition module acquires the real-time log; A display module, configured to prominently display the real-time log based on the log type and the color list corresponding to the log type, and prominently display the keywords in the real-time log according to a preset keyword color list; The processing module is also used to respond to the real-time log filtering instruction, filter out matching logs from the real-time log according to the log filtering strategy in the real-time log filtering instruction; and use the filtering method in the real-time log filtering instruction to filter out the target real-time log from the matching log and output it for display.

11. A real-time log screening device, characterized in that: The real-time log screening device comprises a processor and a memory, wherein the memory stores machine executable instructions that can be executed by the processor, and the processor executes the machine executable instructions to implement the real-time log screening method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the real-time log screening method according to any one of claims 1 to 9.

Images