Log analysis and retrieval enhancement generation method and device based on large language model

Abstract

The invention relates to a log analysis and retrieval enhancement generation method and device based on a large language model, and the method comprises the steps: extracting a target log vector from a target log, and searching a log template similar to or the same as the target log vector in a log template library according to retrieval enhancement generation and a prefix analysis tree; if the similar or same log templates exist, storing the target logs in log groups corresponding to the similar or same log templates; and if no similar or same log template exists, analyzing a target log template of the target log by adopting a large language model, adding a new log group containing the target log in a log template library, and taking the target log template as a log template corresponding to the new log group. According to the method, the combination of the RAG technology and the LLM is used, and the target log is analyzed according to the log template library and the prefix analysis tree, so that the performance is improved while the accuracy of log template extraction is ensured.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of log parsing technology, and in particular to a log parsing and retrieval enhancement generation method and device based on a large language model. Background Art

[0002] With the development of computer technology, millions or even tens of millions of log data are generated in distributed systems, supercomputers, server applications or various software. Logs are record files automatically generated by the system during operation, recording various events, operations and status information of the system. They are of great significance in system diagnosis, security analysis and performance optimization because they provide a detailed record of system behavior to help engineers identify and solve problems. Extracting actionable parts from logs depends largely on the log parsing process, which converts raw logs into a structured format - log templates for use by downstream tasks such as anomaly detection, fault cause analysis, etc.

[0003] However, the continuous development and iteration of modern systems has led to faster changes in log templates, the emergence of a large number of new logs, and a significant increase in complexity, posing a major challenge to existing automatic parsing technologies. The emergence of large language models (LLMs) provides a new approach. With the extensive knowledge learned in the pre-training phase, large models have the ability to understand context, are equipped to process log data, and have strong generalization capabilities.

[0004] However, the LLM-based parsing method requires a lot of computing resources and training data, which increases the operation cost. In addition, the line-by-line parsing method based on LLM also brings high computing overhead. Summary of the invention

[0005] The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.

[0006] The main purpose of the embodiments of the present invention is to propose a log parsing and retrieval enhancement generation method and device based on a large language model, which can accurately and efficiently parse the target log in a streaming manner, while calling LLM as little as possible to reduce resource consumption.

[0007] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present invention provides a log parsing and retrieval enhancement generation method based on a large language model, the log parsing and retrieval enhancement generation method based on a large language model comprising: Get the target log; Extracting a target log vector from the target log; According to the search enhancement generation and prefix parsing tree, a log template similar to or identical to the target log vector is searched in a log template library; the log template library includes a plurality of log groups and a type of log template corresponding to each log group, and the prefix parsing tree includes a tag of any log template in the log template library; When the log template library contains a log template that is similar or identical to the target log vector, storing the target log in a log group corresponding to the similar or identical log template; When the log template library does not have a log template that is similar or identical to the target log vector, a large language model is used to parse the target log template of the target log, and a new log group containing the target log is added to the log template library, the target log template is used as the log template corresponding to the new log group, and a tag of the target log template is added to the prefix parsing tree.

[0008] The log parsing and retrieval enhancement generation method based on a large language model provided in this application has at least the following beneficial effects: (1) Compared with the traditional LLM large language model parsing method, this method uses a combination of retrieval enhancement generation and LLM, and parses the target log based on the log template library and prefix parse tree, ensuring the accuracy of log template extraction while improving performance; and only when the corresponding log group is not found in the log template library, the LLM technology is used to parse the target log, reducing the number of LLM calls and reducing the computational overhead.

[0009] (2) The log template library constructed by the method can be gradually improved based on each log data, realizing the process of online log parsing, and can parse log data in a streaming and timely manner.

[0010] (3) This method can realize log parsing with zero-sample training. It only needs to initialize the log templates of several log groups. For unseen logs, LLM can better generalize the unseen log templates.

[0011] In some embodiments, the step of generating and prefix parsing a tree based on retrieval enhancement, searching a log template in a log template library that is similar or identical to the target log vector, includes: According to the prefix parse tree, a vector-based dense search and a keyword-based sparse search are used to perform a mixed search on the target log vector and the log vectors of the logs in the log group, and the top N log templates are sorted from the mixed search results according to the Reranker model; N is a positive integer greater than 1; Similar or identical log templates are selected from the N log templates according to the large language model.

[0012] In some embodiments, when the log template library contains a log template similar to the target log vector, storing the target log in a log group corresponding to the similar log template includes: When the log template library contains a log template similar to the target log vector, parsing the target log template of the target log according to the large language model; When the target log template exists in the log template mapping table, the mark of the target log template is added in the prefix parsing tree, and the target log is stored in the log group corresponding to the similar log template; the log template mapping table contains the mapping relationship between the log group in the log template library and the corresponding class of log templates.

[0013] In some embodiments, after the target log template of the target log is parsed according to the large language model, the method further includes: If the target log template does not exist in the log template mapping table, judging whether the log group corresponding to the similar log template can be integrated with the target log according to the large language model; In the case that the similar log template is capable of integrating the target log, the target log template and the similar log template are integrated into a new log template, and the mapping relationship between the new log template and the corresponding log group is added to the log template mapping table, and the mark of the new log template is added to the prefix parsing tree, and the target log is stored in the log group corresponding to the new log template.

[0014] In some embodiments, after adding the marker of the target log template in the prefix parsing tree, the method further includes: A mapping relationship between the target log template and the new log group is constructed in the log template mapping table.

[0015] In some embodiments, the step of using a large language model to parse a target log template of the target log includes: Only regular expressions are used to extract log content from the target log; A large language model is used to parse the log content to obtain a target log template of the target log.

[0016] In some embodiments, in the process of extracting log content from the target log using regular expressions, spaces are used for word segmentation.

[0017] To achieve the above purpose, a second aspect of an embodiment of the present invention provides a log parsing and retrieval enhancement generation device based on a large language model, comprising: Data acquisition module, used to obtain target logs; A vector extraction module, used to extract a target log vector from the target log; A retrieval template module, used to search for a log template similar to or identical to the target log vector in a log template library according to retrieval enhancement generation and prefix parsing tree; the log template library contains a plurality of log groups and a type of log template corresponding to each of the log groups, and the prefix parsing tree contains a tag of any log template in the log template library; The log allocation module is used to store the target log in the log group corresponding to the similar or identical log template when the log template library contains a log template similar to or identical to the target log vector; and is used to parse the target log template of the target log using a large language model when the log template library does not contain a log template similar to or identical to the target log vector, add a new log group containing the target log in the log template library, use the target log template as the log template corresponding to the new log group, and add a tag of the target log template in the prefix parsing tree.

[0018] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present invention provides an electronic device, comprising: at least one control processor and a memory for communicating with the at least one control processor; the memory stores instructions that can be executed by the at least one control processor, and the instructions are executed by the at least one control processor so that the at least one control processor can execute the above-mentioned log parsing and retrieval enhancement generation method based on a large language model.

[0019] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present invention provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the above-mentioned log parsing and retrieval enhancement generation method based on a large language model.

[0020] It can be understood that the beneficial effects of the second to fourth aspects compared with the related art are the same as the beneficial effects of the first aspect compared with the related art. Please refer to the relevant description in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0022] Figure 1 It is a schematic diagram of a log parsing and retrieval enhancement generation method based on a large language model provided in an embodiment of the present application; Figure 2 is a schematic diagram of a prefix parsing tree provided in an embodiment of the present application; Figure 3 is a schematic diagram of a log template library provided in an embodiment of the present application; Figure 4 is a specific flow chart of step S130 provided in an embodiment of the present application; Figure 5 is a schematic diagram of a log template mapping table provided in an embodiment of the present application; Figure 6 It is a schematic diagram of log template library matching provided in an embodiment of the present application; Figure 7 It is a schematic diagram of a log parsing and retrieval enhancement generation device based on a large language model provided in an embodiment of the present application; Figure 8 It is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0024] like Figure 1 The present application provides an embodiment, providing a log parsing and retrieval enhancement generation method based on a large language model, the method comprising: Step S110, obtaining the target log.

[0025] Step S120: extracting a target log vector from the target log.

[0026] Step S130, based on the retrieval enhancement generation and prefix parsing tree, search for a log template similar to or identical to the target log vector in the log template library; the log template library contains several log groups and a type of log template corresponding to each log group, the prefix parsing tree contains the mark of any log template in the log template library, and each leaf node in the prefix parsing tree has a pointer to the log template in the log template library.

[0027] Step S140, when the log template library contains a log template that is similar or identical to the target log vector, the target log is stored in the log group corresponding to the similar or identical log template; when the log template library does not contain a log template that is similar or identical to the target log vector, the large language model is used to parse the target log template of the target log, and a new log group containing the target log is added to the log template library, the target log template is used as the log template corresponding to the new log group, and the mark of the target log template is added to the prefix parsing tree.

[0028] In the above step S110, the target log refers to the log to be parsed and processed. Parsing the log here refers to the process of finding the log template corresponding to the log.

[0029] In the above step S120, the target log vector refers to the log vector extracted from the target log according to the embedding model (such as embed_log), that is, the vector expression form of the target log. The log vector is extracted to facilitate subsequent processing.

[0030] First, the following concepts are explained: (1) Retrieval-Augmented Generation (RAG): It is an artificial intelligence technology that combines information retrieval technology with language generation models.

[0031] (2) Log template library, such as Figure 3 ,The log template library contains several log groups, one log group contains several log data, and all logs in a log group have the same type of log template, that is, a log group is a collection of logs with the same type of log template. It should be noted that the log template here can be a log template extracted from the log based on the embedding model or LLM (where the log template is a vector representation).

[0032] (3) Prefix parse tree, such as Figure 2 , each leaf node in the tree represents a tag (i.e., a token). The wildcard tag "<*>" serves as a universal matcher for any token. Importantly, not only leaf nodes, but all nodes except the root node can have pointers to log groups and log templates that match the token extending from the root node. A token is a tag in a log. By classifying tokens in a log, they can be classified as templates.

[0033] Because the target log vector can be split into multiple tokens, the leaf nodes in the prefix parse tree represent the tokens of the log templates in the log target library. Therefore, based on the prefix parse tree, it is possible to find a log template that is similar or identical to the target log vector in the log template library. The means of judging similarity is generally to match the token of the target log vector with the log template token in the log template library. For details, please refer to the introduction of the subsequent embodiments. In this embodiment, a retrieval enhancement generation method is added. The retrieval means generated by retrieval enhancement is used to find log templates related to the target log vector (including similar or identical) from the log template vector. There is no need to manually adjust hyperparameters such as the similarity threshold, which improves the overall retrieval efficiency.

[0034] like Figure 4 In some embodiments of the present application, step S130 of generating and prefix parsing trees based on retrieval enhancement, searching for a log template similar to or identical to the target log vector in the log template library, includes the following steps: Step S210: According to the prefix parse tree, a vector-based dense search and a keyword-based sparse search are used to perform a mixed search on the target log vector and the log vectors of the logs in the log group. The top N log templates are sorted from the mixed search results according to the Reranker model, where N is a positive integer greater than 1.

[0035] Step S220: selecting similar or identical log templates from the N log templates according to the large language model.

[0036] In this embodiment, the recall (Retrival) and rerank (Rerank) of RAG technology are used, including multi-way recall: dense search based on vectors, sparse search based on keywords, so as to match the relevant top N log templates stored in the log template library. Then, the large language model is further used to select the final log template from the top N log templates; in step S210 and step S220, the prefix parsing tree is used to obtain N log templates similar to the target log vector through the multi-way recall means of RAG, and then the similar or identical log templates are selected from the N log templates based on LLM. Here, RAG and LLM technologies are used to improve the accuracy of selecting log templates.

[0037] In the above step S140, there are the following situations: In the first case, when the log template library contains a log template that is similar or identical to the target log vector, the target log is stored in a log group corresponding to the similar or identical log template to complete the parsing of the target log.

[0038] In some embodiments of the present application, in the above situation, when a log template library contains a log template similar to the target log vector, storing the target log in a log group corresponding to the similar log template includes: Step S310: if there is a log template similar to the target log vector in the log template library, parse the target log template of the target log according to the large language model; Step S320, when the target log template exists in the log template mapping table, add a mark of the target log template in the prefix resolution tree, and store the target log in the log group corresponding to the similar log template; the log template mapping table contains the mapping relationship between the log group in the log template library and the corresponding type of log template.

[0039] Step S330: if the target log template does not exist in the log template mapping table, determine whether the log group corresponding to the similar log template can be integrated with the target log according to the large language model; Step S340, when similar log templates can integrate the target log, integrate the target log template and the similar log template into a new log template, add the mapping relationship between the new log template and the corresponding log group in the log template mapping table, add the mark of the new log template in the prefix parsing tree, and store the target log in the log group corresponding to the new log template.

[0040] If there is a log template identical to the target log vector in the log template library, it is proved that the number of tokens of the log template in the prefix parse tree is exactly the same as the number of tokens of the target log vector, and each token has a unique correspondence.

[0041] like Figure 5 ,In step S310, when a log template similar to the target log vector appears in the template library, it proves that the number of tags in the prefix parse tree of the log template and the tags of the target log vector are exactly the same, and there is a certain similarity between the mutual tags.

[0042] In step S320, if there is a similar log template in the log template mapping table, it proves that the target log belongs to the log group corresponding to the similar log template, but the target log vector of the target log and the similar log template belong to different log template variants. Therefore, the mark of the target log template in the prefix parsing tree can be added, and the target log is stored in the log group corresponding to the similar log template.

[0043] In step S330, if there is no similar log template in the log template mapping table, it is determined whether the log group corresponding to the similar log template can be integrated with the target log based on the large language model, and if the similar log template can be integrated with the target log, the target log template and the similar log template are integrated into a new log template.

[0044] Taking finding two similar log groups 1 and 2 as an example, for each log group, try to align the target log with the log template of the log group, so that by adding or modifying some rules (such as wildcards <*>), the target log vector and the log target of the log group can match this common new pattern. If such a pattern is found, it means that the two log groups and the target log can be merged into a new template. If both log groups can be merged with the target log, it is necessary to further evaluate which merge solution is better, or whether they can be merged into a broader template at the same time. The following provides an example: The following examples are provided: Log Group 1 Log template corresponding to log group 1: [INFO] User<*>logged in from IP<*>. Example of target log vector: [INFO] User john.doe logged in from IP 192.168.1.10. [INFO] User jane.smith logged in from IP 192.168.1.11. Log Group 2 Log template corresponding to log group 2: [INFO] User<*>attempted logging from IP<*>, but failed. Target log vector: [INFO] User john.doe attempted logging from IP 192.168.1.10, but failed. [INFO] User jane.smith attempted logging from IP 192.168.1.11, but failed. Log template after merge: [INFO] User<*> <action>login from IP<*>, <result>. in <action>Can be "logged in" or "attempted logging". <result>Can be an empty string (for a successful login) or "but failed" (for a failed attempt). The mask symbol can be customized.

[0045] In step S340, implementing the merging includes: Update the prefix parse tree: Add the merged log template to the prefix parse tree and ensure that it can correctly match all related log templates.

[0046] Update the log template library: point the log vector in the original log group to the new log template.

[0047] Maintain mapping relationships: Ensure that the records in the log template mapping table are synchronized with the nodes in the prefix parsing tree.

[0048] The method provided in this embodiment has at least the following beneficial effects: The method constructs a log template library, in which several log groups are set, and each log group has a class of log templates with corresponding relationships. The method extracts a target log vector from the target log, and then uses retrieval enhancement generation and prefix parsing tree to find a log template similar or identical to the target log vector in the log template library. If it exists, the target log is stored in the log group corresponding to the similar or identical log template to complete the parsing of the target log. If it does not exist, the target log template of the target log is parsed using a large language model, and a new log group containing the target log is added to the log template library, and the log template of the new log group is associated.

[0049] (1) Compared with the traditional LLM large language model parsing method, this method uses a combination of RAG technology and LLM, and parses the target log based on the log template library and prefix parsing tree, ensuring the accuracy of log template extraction while improving performance; and only when the corresponding log group is not found in the log template library, the LLM technology is used to parse the target log, reducing the number of LLM calls and reducing the computational overhead.

[0050] (2) The log template library constructed by the method can be gradually improved based on each log data, realizing the process of online log parsing, and can parse log data in a streaming and timely manner.

[0051] (3) This method can realize log parsing with zero-sample training. It only needs to initialize the log templates of several log groups. For unseen logs, LLM can better generalize the unseen log templates.

[0052] In some embodiments of the present application, after adding the mark of the target log template in the prefix parsing tree, the method further includes: Step S410: construct a mapping relationship between the target log template and the new log group in the log template mapping table.

[0053] Adding the mapping relationship between the target log template and the new log group in the log template mapping table can facilitate subsequent log parsing operations.

[0054] In some embodiments of the present application, a target log template of a target log is parsed using a large language model, including: Step S510, extracting log content from the target log using only regular expressions; Step S520: parse the log content using the large language model to obtain a target log template of the target log.

[0055] In some embodiments of the present application, in the process of extracting log content from the target log according to the regular expression, spaces are used for word segmentation.

[0056] In this embodiment, basic regular expressions are used to extract log content, which can ensure that LLM has the complete context of the target log.

[0057] In this embodiment, only spaces are used for word segmentation, which can minimize the need for professional knowledge while maintaining the powerful log parsing efficiency of LLM.

[0058] like Figures 2 to 6 An embodiment of the present application provides a log parsing and retrieval enhancement generation method based on a large language model, the method comprising the following steps: Step S910: input several logs, take the currently processed log as the target log, and use the embedding model to generate a vector representation (ie, the target log vector) for the target log.

[0059] Step S920, constructing a prefix parsing tree, a log template library and a log template mapping table.

[0060] Step S930: pre-process the target log.

[0061] Use basic regular expressions to extract log content. Also, only spaces are used for word segmentation.

[0062] Step S940: Search the target log by generating a large language model based on retrieval enhancement.

[0063] Based on the feedforward parse tree, multi-way recall is adopted: vector-based dense retrieval and keyword-based sparse retrieval.

[0064] The target log is converted into a vector and then mixed with the log group in the log template library after vectorization. The cosine similarity and keywords are used to find the relevant log templates. In the re-ranking stage, the Reranker model is used to sort out the topk log templates. Then the template corresponding to the target log is selected according to the LLM.

[0065] The process of determining the similarity between log templates in this embodiment includes: Here, set three matching rules: strict matching, loose matching, and no matching; (1) Strict matching: First, the number of tokens in the log template library corresponding to at least one log group is consistent with the number of tokens in the target log vector. In addition, if the token sequence in the log vector after the target log vector is vectorized is completely aligned with the token sequence of the log template corresponding to a log group (where the wildcard <*> can match any token), it proves that the target log vector and the log template are strictly matched. Then the target log is stored in a log group corresponding to the strictly matched log template.

[0066] For example, given a template Error: prefetching failed for<*>, a strict match is only made if the target log vector also starts with "Error:", followed by "prefetching", "failed", and "for", and then followed by any text.

[0067] (2) Loose matching: Similarly, the number of tokens in the log template library corresponding to at least one log group is consistent with the number of tokens in the target log vector. And the token sequence in the target log vector after log vectorization is not completely aligned with the token sequence of the log template corresponding to any log group, but there is a certain degree of similarity with the log template corresponding to at least one of the log groups (the similarity is determined manually). In this case, it is proved that at least one log template loosely matches the target log.

[0068] For example, the template prefetching<*>failed and the target log vector prefetching<*>fail may be considered a loose match. The template prefetching<*>failed may match the target log vector prefetching<*>has failed, ignoring the word "has".

[0069] (3) Mismatch, that is, there is no log group in the log template library whose corresponding log template has the same number of tokens as the target log vector.

[0070] Step S950: If the target log has a loose match or mismatch, the target log template is extracted from the target log using LLM, and the target log template is checked to see whether it is in the log template mapping table.

[0071] If the target log template exists in the log template mapping table, it means that the target log belongs to the log group in the log template library, but has a different log template variant. At this time, the prefix parsing tree structure needs to be updated to facilitate the subsequent matching process, and the target log is added to the log group corresponding to the log template library.

[0072] Step S960: If the target log finds multiple loosely matched log groups, check whether these log groups can be merged and whether these log templates can be merged. If they can be merged, match the target log with the merged log template and add it to the corresponding log group.

[0073] If the target log template corresponding to the target log is not found in the log template mapping table, but it is a loose match, LLM is used to determine whether the loosely matched log group can integrate this target log. If the result is positive, the target log template corresponding to the target log and the log template corresponding to its log group are combined to generate a merged template. Subsequently, the syntax and log template of the log group will be updated, and the merged log template will be added to the log template mapping table.

[0074] For example, check whether the fixed parts (that is, the parts that do not contain variables) of the two log templates are consistent. Check whether the variable parts in the log templates represent the same type of values. Check the logical relationship between the log templates to see whether they describe different variations of the same event. Check whether a common template that can cover both log templates can be created by introducing new variables or conditions. Check whether the merged log template can cover all logs in the original log group.

[0075] Step S970: If the target log does not match any log group, it indicates that it is a unique log template, that is, a new log group is created, a new vector representation is generated for the target log, and the prefix parsing tree structure is updated. The new log template is mapped to the new log group, and the template mapping table is updated.

[0076] This method can parse and extract log templates in a zero-sample, online manner. First, only basic regular expressions are used to extract log content; ensure that LLM grasps the complete context of the log. Unlike other strategies that use different delimiters for log tokenization, this method always uses spaces for tokenization. Then, three data structures are constructed: prefix parse tree, template mapping table, and log template library. For an unseen target log, its log template is extracted, and the prefix parse tree is matched and searched. Through the template mapping table and RAG technology, the log group that matches the target log is found in the log template library, and the log template of the corresponding log group is updated. If it is a new log template in the log template library, LLM is directly used to extract the log template of the target log, and the corresponding parse tree and log group of the log template library are updated.

[0077] This method can parse the target log accurately and efficiently in a streaming manner; it does not require source code or any data other than the log. It can automatically extract log templates from the target log and split them into disjoint log groups. It uses both LLM and RAG technologies, has strong generalization capabilities, and can parse unseen logs well. At the same time, it calls LLM as little as possible, reduces resource consumption, and can be effectively put into practical application.

[0078] The following briefly introduces the following application scenarios: (1) Realizing the monitoring of computer systems: By using the log parsing and retrieval enhancement generation method based on a large language model in the above-mentioned embodiment, key information of the system can be obtained through log parsing and retrieval, thereby helping to better understand the system operation status, discover problems and perform corresponding processing.

[0079] (2) Computer system performance optimization and monitoring: The log parsing and retrieval enhancement generation method based on the large language model described in the above embodiment can be used to extract the system's performance indicators and key indicators, help with performance optimization and monitoring, and promptly identify performance problems and make adjustments.

[0080] like Figure 7 In one embodiment, a log parsing and retrieval enhancement generation device based on a large language model is provided, wherein the log parsing and retrieval enhancement generation device based on a large language model comprises: The data acquisition module 1100 is used to acquire the target log; The vector extraction module 1200 is used to extract a target log vector from a target log; The retrieval template module 1300 is used to search for a log template similar to or identical to a target log vector in a log template library according to the retrieval enhancement generation and prefix parsing tree; the log template library contains a number of log groups and a type of log template corresponding to each log group, and the prefix parsing tree contains a tag of any log template in the log template library; The log allocation module 1400 is used to store the target log in the log group corresponding to the similar or identical log template when the log template library contains a log template similar or identical to the target log vector; and, when the log template library does not contain a log template similar or identical to the target log vector, use the large language model to parse the target log template of the target log, add a new log group containing the target log to the log template library, use the target log template as the log template corresponding to the new log group, and add a tag of the target log template in the prefix parsing tree. It should be noted that the log parsing and retrieval enhancement generation device based on a large language model provided in this embodiment and the above-mentioned log parsing and retrieval enhancement generation method based on a large language model are based on the same inventive concept. Therefore, the relevant content of the above-mentioned log parsing and retrieval enhancement generation method based on a large language model is also applicable to the content of the log parsing and retrieval enhancement generation device based on a large language model. Therefore, it will not be repeated here.

[0081] like Figure 8 The embodiment of the present application further provides an electronic device, the electronic device comprising: at least one memory; at least one processor; at least one program; The program is stored in the memory, and the processor executes at least one program to implement the log parsing and retrieval enhancement generation method based on the large language model implemented in the present disclosure.

[0082] The electronic device may be any intelligent terminal including a mobile phone, a tablet computer, a personal digital assistant (PDA), a vehicle-mounted computer, etc.

[0083] The electronic device according to the embodiment of the present application is described in detail below.

[0084] The processor 1600 may be implemented by a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention; The memory 1700 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1700 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1700, and the processor 1600 calls and executes the log parsing and retrieval enhancement generation method based on a large language model in the embodiment of the present invention.

[0085] Input / output interface 1800, used to implement information input and output; Communication interface 1900, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.); Bus 2000 , which transmits information between various components of the device (e.g., processor 1600 , memory 1700 , input / output interface 1800 , and communication interface 1900 ); The processor 1600 , the memory 1700 , the input / output interface 1800 , and the communication interface 1900 are connected to each other in communication within the device via the bus 2000 .

[0086] An embodiment of the present invention also provides a storage medium, which is a computer-readable storage medium. The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the above-mentioned log parsing and retrieval enhancement generation method based on a large language model.

[0087] The memory is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory and can also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device.

[0088] In some embodiments, the memory may include a memory remotely located relative to the processor, and the remote memory may be connected to the processor via a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0089] The embodiments described in the present invention are intended to more clearly illustrate the technical solutions of the embodiments of the present invention and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0090] Those skilled in the art will appreciate that the technical solutions shown in the figures do not limit the embodiments of the present invention and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0091] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0092] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0093] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0094] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or plural.

[0095] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0096] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0097] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0098] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable an electronic device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store programs.

[0099] The above is a specific description of the preferred implementation of the embodiments of the present application, but the embodiments of the present application are not limited to the above-mentioned implementation methods. Technical personnel familiar with the field can also make various equivalent modifications or substitutions without violating the spirit of the embodiments of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the embodiments of the present application.< / result> < / action> < / result> < / action>

Claims

1. A log parsing and retrieval enhancement generation method based on a large language model, characterized in that: The log parsing and retrieval enhancement generation method based on a large language model includes: Get the target log; Extracting a target log vector from the target log; According to the search enhancement generation and prefix parsing tree, a log template similar to or identical to the target log vector is searched in a log template library; the log template library includes a plurality of log groups and a type of log template corresponding to each log group, and the prefix parsing tree includes a tag of any log template in the log template library; When the log template library contains a log template that is similar or identical to the target log vector, storing the target log in a log group corresponding to the similar or identical log template; When the log template library does not have a log template that is similar or identical to the target log vector, a large language model is used to parse the target log template of the target log, and a new log group containing the target log is added to the log template library, the target log template is used as the log template corresponding to the new log group, and a tag of the target log template is added to the prefix parsing tree.

2. The log parsing and retrieval enhancement generation method based on a large language model according to claim 1 is characterized in that: The step of generating and prefix parsing trees based on retrieval enhancement, searching for a log template similar to or identical to the target log vector in a log template library, includes: According to the prefix parse tree, a vector-based dense search and a keyword-based sparse search are used to perform a mixed search on the target log vector and the log vectors of the logs in the log group, and the top N log templates are sorted from the mixed search results according to the Reranker model; N is a positive integer greater than 1; Similar or identical log templates are selected from the N log templates according to the large language model.

3. The log parsing and retrieval enhancement generation method based on a large language model according to claim 2 is characterized in that: In the case that the log template library contains a log template similar to the target log vector, storing the target log in a log group corresponding to the similar log template includes: When the log template library contains a log template similar to the target log vector, parsing the target log template of the target log according to the large language model; When the target log template exists in the log template mapping table, the mark of the target log template is added in the prefix parsing tree, and the target log is stored in the log group corresponding to the similar log template; the log template mapping table contains the mapping relationship between the log group in the log template library and the corresponding class of log templates.

4. The log parsing and retrieval enhancement generation method based on a large language model according to claim 3 is characterized in that: After the target log template of the target log is parsed according to the large language model, the method further includes: If the target log template does not exist in the log template mapping table, judging whether the log group corresponding to the similar log template can be integrated with the target log according to the large language model; In the case that the similar log template is capable of integrating the target log, the target log template and the similar log template are integrated into a new log template, and the mapping relationship between the new log template and the corresponding log group is added to the log template mapping table, and the mark of the new log template is added to the prefix parsing tree, and the target log is stored in the log group corresponding to the new log template.

5. The log parsing and retrieval enhancement generation method based on a large language model according to claim 3 is characterized in that: After adding the mark of the target log template in the prefix parsing tree, the method further includes: A mapping relationship between the target log template and the new log group is constructed in the log template mapping table.

6. The log parsing and retrieval enhancement generation method based on a large language model according to claim 1 is characterized in that: The step of using the large language model to parse the target log template of the target log includes: Only regular expressions are used to extract log content from the target log; A large language model is used to parse the log content to obtain a target log template of the target log.

7. The log parsing and retrieval enhancement generation method based on a large language model according to claim 6 is characterized in that: In the process of extracting log content from the target log using regular expressions, spaces are used for word segmentation.

8. A log parsing and retrieval enhancement generation device based on a large language model, characterized in that: The log parsing and retrieval enhancement generation device based on the large language model includes: Data acquisition module, used to obtain target logs; A vector extraction module, used to extract a target log vector from the target log; A retrieval template module, used to search for a log template similar to or identical to the target log vector in a log template library according to retrieval enhancement generation and prefix parsing tree; the log template library contains a plurality of log groups and a type of log template corresponding to each of the log groups, and the prefix parsing tree contains a tag of any log template in the log template library; The log allocation module is used to store the target log in the log group corresponding to the similar or identical log template when the log template library contains a log template similar to or identical to the target log vector; and is used to parse the target log template of the target log using a large language model when the log template library does not contain a log template similar to or identical to the target log vector, add a new log group containing the target log in the log template library, use the target log template as the log template corresponding to the new log group, and add a tag of the target log template in the prefix parsing tree.

9. An electronic device, characterized in that: include: at least one control processor and a memory for communicatively coupling with the at least one control processor; The memory stores instructions that can be executed by the at least one control processor, and the instructions are executed by the at least one control processor so that the at least one control processor can execute the log parsing and retrieval enhancement generation method based on a large language model as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the log parsing and retrieval enhancement generation method based on a large language model as described in any one of claims 1 to 7.

Images