Log query method and device, equipment, medium and program product

Abstract

The invention provides a log query method which can be applied to the technical field of artificial intelligence and big data. The log query method comprises the steps of obtaining a first query statement input by a user; wherein the first query statement is a natural language statement; identifying the first query statement based on a pre-training model to obtain a plurality of query words; combining the plurality of query words to generate a second query statement; and querying in the log database based on the second query statement to obtain a query result. The invention further provides a log query device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence and big data technology, and more specifically to a log query method, device, equipment, medium and program product. Background Art

[0002] Existing log management systems usually use the traditional multi-option query method, which requires users to enter standard query statements themselves. This requires high professional capabilities of users and may be difficult for non-professional users to understand and operate. There are problems such as low query efficiency and high operation complexity. Summary of the invention

[0003] In view of the above problems, the present disclosure provides a log query method, apparatus, device, medium and program product for improving the efficiency and simplicity of log query.

[0004] According to a first aspect of the present disclosure, a log query method is provided, comprising: obtaining a first query statement input by a user; wherein the first query statement is a natural language statement; recognizing the first query statement based on a pre-trained model to obtain a plurality of query words; combining the plurality of query words to generate a second query statement; and querying a log database based on the second query statement to obtain a query result.

[0005] According to an embodiment of the present disclosure, recognizing a first query statement based on a pre-trained model to obtain multiple query terms includes: preprocessing the first query statement to obtain a third query statement and statement intent; and extracting entities from the third query statement based on the statement intent to obtain multiple query terms.

[0006] According to an embodiment of the present disclosure, multiple query words are combined to generate a second query statement, including: obtaining structural information in a log database; determining a mapping relationship between the query words and the structural information in the log database; and generating the second query statement based on the association relationship and mapping relationship between the multiple query words.

[0007] According to an embodiment of the present disclosure, generating a second query statement based on associations and mappings among multiple query terms includes: determining query logic according to the associations among multiple query terms; and combining the query logic with the mappings to generate the second query statement.

[0008] According to an embodiment of the present disclosure, a log database includes multiple nodes, log data is stored in a dispersed manner on the multiple nodes, and a query is performed in the log database based on a second query statement to obtain a query result, including: determining multiple first nodes related to the second query statement from multiple nodes; broadcasting the second query statement to multiple first nodes; collecting first query results from multiple first nodes; and collating and summarizing the multiple first query results to obtain a query result.

[0009] According to an embodiment of the present disclosure, the method also includes: regularly acquiring original log data from different platforms; preprocessing the original log data to obtain first log data; storing the first log data in segments according to the attributes of the first log data, and storing the first log data in corresponding nodes in the database respectively.

[0010] The second aspect of the present disclosure provides a log query device, including: an acquisition module, used to acquire a first query statement input by a user; wherein the first query statement is a natural language statement; a recognition module, used to recognize the first query statement based on a pre-trained model to obtain multiple query words; a generation module, used to combine the multiple query words to generate a second query statement; and a query module, used to query in a log database based on the second query statement to obtain a query result.

[0011] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0012] The fourth aspect of the present disclosure further provides a computer-readable storage medium on which a computer program or instruction is stored, and the steps of the above method are implemented when the above computer program or instruction is executed by a processor.

[0013] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0015] Figure 1 The application scenario diagram of the log query method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown;

[0016] Figure 2 The flowchart of the log query method according to the embodiment of the present disclosure is schematically shown;

[0017] Figure 3 A flowchart schematically shows a method of identifying a first query sentence based on a pre-trained model to obtain multiple query words according to an embodiment of the present disclosure;

[0018] Figure 4 A flowchart schematically illustrates combining multiple query words to generate a second query statement according to an embodiment of the present disclosure;

[0019] Figure 5 A flowchart schematically shows a method of performing a query in a log database based on a second query statement to obtain a query result according to an embodiment of the present disclosure;

[0020] Figure 6 A flowchart of storing log data into a log database according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 7 A structural block diagram of a log query device according to an embodiment of the present disclosure is schematically shown; and

[0022] Figure 8 A block diagram of an electronic device suitable for implementing a log query method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0024] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0025] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0026] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0027] It should be noted that in the technical solution of the present invention, the collection, use, storage, sharing and transfer of data (for example, including but not limited to user personal information) involved are in compliance with the provisions of relevant laws and regulations, and it is necessary to inform the user and obtain the user's consent or authorization. When applicable, the user's personal information is de-identified and / or anonymized and / or encrypted.

[0028] In the embodiments of the present disclosure, the collection, updating, analysis, processing, use, transmission, provision, disclosure, storage, etc. of the data involved (for example, including but not limited to user personal information) are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. In particular, necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security, and national security.

[0029] In the embodiments of the present disclosure, before obtaining or collecting user personal information, the user has been informed and the user's consent or authorization has been obtained.

[0030] An embodiment of the present disclosure provides a log query method, comprising: obtaining a first query statement input by a user; wherein the first query statement is a natural language statement; recognizing the first query statement based on a pre-trained model to obtain a plurality of query words; combining the plurality of query words to generate a second query statement; and querying a log database based on the second query statement to obtain a query result.

[0031] Figure 1 The application scenario diagram of the log query method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0032] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0033] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0034] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0035] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0036] It should be noted that the log query method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the log query device provided in the embodiment of the present disclosure can generally be set in the server 105. The log query method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the log query device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0037] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0038] The following will be based on Figure 1 The scene described by Figure 2~Figure 6 The log query method of the disclosed embodiment is described in detail.

[0039] Figure 2 The flowchart of the log query method according to the embodiment of the present disclosure is schematically shown.

[0040] like Figure 2 As shown, the log query method of this embodiment includes operations S210 to S240.

[0041] In operation S210, a first query sentence input by a user is obtained; wherein the first query sentence is a natural language sentence.

[0042] In some embodiments, the user may input a first query statement in natural language through a specific interface (such as a web page, a mobile application, or a command line, etc.), where the query statement is a description of target information that the user wants to obtain from the log database.

[0043] When the system receives the first query statement input by the user, it performs basic preprocessing on the input, such as removing spaces, normalizing punctuation marks, etc., for subsequent processing.

[0044] In operation S220, the first query sentence is recognized based on the pre-trained model to obtain a plurality of query words.

[0045] In some embodiments, a pre-trained natural language processing model may be used to identify the first query statement to obtain multiple query words. The first query statement input by the user is sent to the pre-trained model, and the pre-trained model analyzes the semantics and structure of the first query statement, identifies key query words, and extracts these key query words from the pre-trained model, and uses these query words as the basis for subsequent queries.

[0046] In operation S230, a plurality of query words are combined to generate a second query statement.

[0047] In some embodiments, based on the semantics and contextual relationship of the query words and in combination with predefined combination rules, the query words are combined into at least one second query statement for use in querying the log database.

[0048] In operation S240 , a query is performed in the log database based on the second query statement to obtain a query result.

[0049] In some embodiments, the second query statement is executed in the log query library to obtain the query results, and the query results are processed in a certain manner (such as sorting, filtering, etc.), and the processed query results are displayed to the user.

[0050] The log query method provided by the embodiment of the present disclosure has strong natural language processing capabilities, can identify natural language sentences input by users, and accurately understand user intentions. Even if the user's expression is not accurate or ambiguous, it can be corrected or supplemented to a certain extent through the understanding ability of the model. It has high flexibility and does not require users to learn specific query grammars or rules. At the same time, by generating a second query statement by combining query words, the query conditions can be automatically optimized to improve the accuracy and efficiency of the query. And based on the recognition and processing of the pre-trained model, it can automatically learn and adapt to the user's query habits and needs, continuously optimize the query effect, have a high degree of intelligence, and can effectively improve the query efficiency.

[0051] Figure 3 The flowchart schematically shows a method of recognizing a first query sentence based on a pre-trained model to obtain multiple query terms according to an embodiment of the present disclosure.

[0052] like Figure 3 As shown, this embodiment recognizes the first query statement based on the pre-trained model to obtain multiple query words including operation S310 to operation S320.

[0053] In operation S310, the first query statement is preprocessed to obtain a third query statement and statement intent.

[0054] In some embodiments, the pre-trained model may be, for example, a deep learning model, such as a Transformer architecture model, a BERT model, etc. The pre-trained model is used to pre-process, identify intent, and extract entities on the first query statement to obtain multiple query terms.

[0055] Preprocessing may include, for example, text cleaning, word segmentation, part-of-speech tagging, etc., and the third query statement is obtained by preprocessing the first query statement. Among them, text cleaning refers to removing irrelevant characters, punctuation marks, stop words, etc. in the query statement to reduce the impact of noise on subsequent processing. Word segmentation refers to dividing the query statement into words or phrases. Part-of-speech tagging refers to marking the part of speech for each word or phrase, such as noun, verb, adjective, etc., which helps with subsequent entity recognition and keyword extraction. And, the first query statement is classified based on the pre-trained model to identify the sentence intent of the first query statement.

[0056] In operation S320, entity extraction is performed from the third query sentence based on the sentence intent to obtain a plurality of query terms.

[0057] In some embodiments, entities are extracted from the third query statement according to the identified sentence intent to obtain key information or parameters (i.e., query terms) related to the current query task. Entity extraction can, for example, match entities in the third query statement based on rule-based patterns, annotate the third query statement based on learning annotations to identify entity machine types, or directly perform entity recognition based on a deep learning model to automatically learn features in the text and accurately identify entities.

[0058] In addition, the pre-trained model adopted in the embodiments of the present disclosure may be a model with sequence prediction capabilities, which can learn and predict elements in future data sequences based on historical data, and can prepare or cache relevant data in advance by predicting users' possible query requirements or data access patterns, thereby significantly reducing data retrieval and processing time during queries.

[0059] The disclosed embodiment performs entity extraction through intent recognition to extract query terms in the first query statement, wherein the query terms refer to keywords that can represent the main content or intent of the first query statement, thereby effectively improving the recognition efficiency and accuracy of the query terms to ensure the accuracy of subsequent log queries.

[0060] Figure 4 The flowchart of combining multiple query words to generate a second query statement according to an embodiment of the present disclosure is schematically shown.

[0061] like Figure 4 As shown, in this embodiment, combining multiple query words to generate a second query statement includes operations S410 to S430.

[0062] In operation S410, structural information in a log database is acquired.

[0063] In operation S420, a mapping relationship between the query word and the structural information in the log database is determined.

[0064] In operation S430, a second query statement is generated based on the association relationship and mapping relationship among the plurality of query terms.

[0065] In some embodiments, after connecting to the log database, the structural information of the log database is queried and obtained. Common structural information includes table name, column name, data type, primary key, foreign key, etc. The corresponding column name or table name is queried in the structural information based on the query word. If the query word is directly related to a column name or table name in the structural information, a direct mapping relationship is established. If the concept of the query word is relatively broad, it is necessary to infer the corresponding database structure through business logic or rule library to establish a fuzzy mapping relationship.

[0066] Also, use natural language processing (NLP) technology to analyze the association between query terms. Common associations include parallel, progressive, causal, etc. Determine the query logic based on the association between query terms, and build the logical structure of the second query statement based on the query logic. For example, if there is a parallel relationship between query terms, you may need to use OR or IN clauses in the second query statement. If there is a progressive or causal relationship, you may need to use subqueries or JOIN operations. Combine the query relationship and the mapping relationship to generate the second query statement.

[0067] Figure 5 The flowchart schematically shows a method of querying a log database based on a second query statement to obtain a query result according to an embodiment of the present disclosure.

[0068] like Figure 5 As shown, this embodiment performs a query in the log database based on the second query statement to obtain the query result, including operations S510 to S540.

[0069] In operation S510 , a plurality of first nodes related to a second query statement are determined from a plurality of nodes.

[0070] In operation S520 , the second query statement is broadcast to multiple first nodes.

[0071] In operation S530 , first query results from a plurality of first nodes are collected.

[0072] In operation S540, the plurality of first query results are sorted and summarized to obtain a query result.

[0073] In some embodiments, the log database of the present disclosure adopts a distributed content index, which includes multiple nodes, and the log data is stored in multiple nodes in a dispersed manner. It has high scalability and availability. As the amount of data grows, the storage and query capabilities of the index can be expanded by adding nodes, and when some nodes fail, the database can still operate normally. In addition, multiple nodes in the log database can process query requests in parallel, which can significantly improve the log query speed.

[0074] The log database may include, for example, a coordination node and multiple storage nodes. The coordination node is used to distribute received query requests and integrate query results.

[0075] The second query request is connected to the coordination node, which routes the second query request to the storage node (i.e., the first node) containing the corresponding data based on the index and shard information involved in the second query request. For queries that need to be executed across multiple shards, the coordination node broadcasts the query request to the first nodes where all shards containing relevant data are located, and these nodes process the query request in parallel and return their respective first query results.

[0076] The coordination node collects the first query results from each node, summarizes them neatly, and merges them into a unified result set (i.e., query results). Furthermore, if the query request contains requirements such as sorting or paging, the coordination node will also sort and paging the results.

[0077] Figure 6 The flowchart of storing log data into a log database according to an embodiment of the present disclosure is schematically shown.

[0078] like Figure 6 As shown, storing log data into the log database in this embodiment includes operations S610 to S630.

[0079] In operation S610 , raw log data from different platforms is periodically acquired.

[0080] In operation S620, the original log data is preprocessed to obtain first log data.

[0081] In operation S630, the first log data is stored in segments according to the attributes of the first log data, and the first log data is stored in corresponding nodes in the database respectively.

[0082] In some embodiments, a scheduled task can be set to regularly obtain the original log data of each platform from the API interface, and the obtained original log data can be pre-processed using a data warehouse technology (ETL, Extract-Transform-Load) tool to obtain the first log data, wherein the pre-processing includes: data cleaning, data parsing, data conversion, etc. Data cleaning is used to remove useless information in the log (such as duplicate data, erroneous data in the format, non-key fields, etc.) to ensure the accuracy and consistency of the data. Data parsing is used to parse out key fields such as timestamp, log level, message content, etc. according to the format of the log (such as JSON, XML, text, etc.). Data conversion is used to convert the parsed data into a unified format for subsequent processing and analysis. A sharding strategy is formulated based on the attributes of the first log data (such as timestamp, business type, user ID, etc.) and the first log data is stored in the corresponding node in the database according to the sharding strategy.

[0083] The embodiment of the present disclosure adopts a database with distributed content index, which can effectively avoid single point failures, realize rapid location and query of data by building a distributed index, and effectively improve the efficiency of log query.

[0084] Based on the above log query method, the present disclosure also provides a log query device. Figure 7 The device is described in detail.

[0085] Figure 7 The structural block diagram of the log query device according to an embodiment of the present disclosure is schematically shown.

[0086] like Figure 7 As shown, the log query device 700 of this embodiment includes an acquisition module 710 , an identification module 720 , a generation module 730 and a query module 740 .

[0087] The acquisition module 710 is used to acquire a first query sentence input by a user, wherein the first query sentence is a natural language sentence. In one embodiment, the acquisition module 710 can be used to perform the operation S210 described above, which will not be described in detail here.

[0088] The recognition module 720 is used to recognize the first query sentence based on the pre-trained model to obtain multiple query words. In one embodiment, the recognition module 720 can be used to perform the operation S220 described above, which will not be described in detail here.

[0089] The generation module 730 is used to combine multiple query words to generate a second query sentence. In one embodiment, the generation module 730 can be used to perform the operation S230 described above, which will not be described in detail here.

[0090] The query module 740 is used to query the log database based on the second query statement to obtain the query result. In one embodiment, the query module 740 can be used to perform the operation S240 described above, which will not be described in detail here.

[0091] According to an embodiment of the present disclosure, any multiple modules of the acquisition module 710, the identification module 720, the generation module 730 and the query module 740 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 710, the identification module 720, the generation module 730 and the query module 740 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the acquisition module 710, the identification module 720, the generation module 730 and the query module 740 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be performed.

[0092] Figure 8 A block diagram of an electronic device suitable for implementing a log query method according to an embodiment of the present disclosure is schematically shown.

[0093] like Figure 8 As shown, the electronic device 800 according to an embodiment of the present disclosure includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage part 808 to a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include an onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0094] In RAM 803, various programs and data required for the operation of electronic device 800 are stored. Processor 801, ROM 802 and RAM 803 are connected to each other via bus 804. Processor 801 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 802 and / or RAM 803. It should be noted that the program can also be stored in one or more memories other than ROM 802 and RAM 803. Processor 801 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0095] According to an embodiment of the present disclosure, the electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to the bus 804. The electronic device 800 may further include one or more of the following components connected to the input / output (I / O) interface 805: an input portion 806 including a keyboard, a mouse, etc.; an output portion 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 808 including a hard disk, etc.; and a communication portion 809 including a network interface card such as a LAN card, a modem, etc. The communication portion 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output (I / O) interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed, so that the computer program read therefrom is installed into the storage portion 808 as needed.

[0096] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0097] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 802 and / or RAM 803 described above and / or one or more memories other than ROM 802 and RAM 803.

[0098] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the log query method provided by the embodiment of the present disclosure.

[0099] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 801. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0100] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 809, and / or installed from a removable medium 811. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0101] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the processor 801, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0102] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0103] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0104] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0105] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A log query method, characterized in that: The method comprises: Acquire a first query statement input by a user; wherein the first query statement is a natural language statement; Recognize the first query sentence based on the pre-trained model to obtain multiple query words; Combining the multiple query words to generate a second query statement; A query is performed in the log database based on the second query statement to obtain a query result.

2. According to the log query method of claim 1, the first query statement is identified based on the pre-trained model to obtain multiple query words including: Preprocessing the first query statement to obtain a third query statement and statement intent; Entities are extracted from the third query sentence based on the sentence intent to obtain a plurality of query terms.

3. The log query method according to claim 1, characterized in that: The combining the multiple query words to generate a second query statement includes: Acquire structural information in the log database; Determine a mapping relationship between the query term and the structural information in the log database; A second query statement is generated based on the association relationship between the multiple query terms and the mapping relationship.

4. The log query method according to claim 3, characterized in that: The generating a second query statement based on the association relationship between the multiple query words and the mapping relationship includes: Determining the query logic according to the association relationship between the multiple query terms; The query logic is combined with the mapping relationship to generate a second query statement.

5. The log query method according to claim 1, characterized in that: The log database includes a plurality of nodes, and the log data is dispersedly stored on the plurality of nodes. The query is performed in the log database based on the second query statement to obtain the query result, including: Determine a plurality of first nodes related to the second query statement from the plurality of nodes; broadcasting the second query statement to the plurality of first nodes; Collecting first query results from the plurality of first nodes; The multiple first query results are sorted and summarized to obtain a query result.

6. The log query method according to claim 1, characterized in that: The method further comprises: Regularly obtain raw log data from different platforms; Preprocessing the original log data to obtain first log data; The first log data is stored in pieces according to the attributes of the first log data, and the first log data is respectively stored in corresponding nodes in a database.

7. A log query device, characterized in that: The device comprises: An acquisition module, configured to acquire a first query statement input by a user; wherein the first query statement is a natural language statement; A recognition module, used to recognize the first query sentence based on the pre-trained model to obtain multiple query words; A generating module, used for combining the multiple query words to generate a second query statement; The query module is used to query the log database based on the second query statement to obtain a query result.

8. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images