Business index alarm method and device, equipment, storage medium and program product

Abstract

The invention provides a business index warning method and device, equipment, a storage medium and a program product, and relates to the field of big data. The method comprises the following steps: determining a monitoring index of a target service, and judging whether the monitoring index is a complex index or not; under the condition that the monitoring index is a complex index, disassembling the monitoring index to obtain a plurality of monitoring sub-indexes; respectively acquiring log data corresponding to the plurality of monitoring sub-indexes from a search engine database; according to the multiple monitoring sub-indexes, monitoring analysis processing is conducted on the corresponding log data, and a monitoring result of each monitoring sub-index is obtained; and determining an alarm result of the monitoring index based on the monitoring results of the plurality of monitoring sub-indexes, and generating an alarm notification message under the condition that the alarm result indicates that alarm is needed. According to the method, the complex indexes of the service are monitored and alarmed, and the problems that in the prior art, the application scene is narrow, the monitoring indexes are single, and monitoring of the complex indexes cannot be achieved are solved.

Description

Technical Field

[0001] The present application relates to the field of big data, and in particular to an alarm method, electronic equipment, storage medium and program product for business indicators. Background Art

[0002] ‌Application of complex indicator alarm‌ means that in operation and maintenance management, complex indicators are set and monitored to timely discover and prevent potential problems in the system or application, and the alarm mechanism is automatically triggered when a problem occurs to notify relevant personnel to handle it. By monitoring these indicators, operation and maintenance personnel can understand the operating status of the system in real time and discover potential problems in a timely manner.

[0003] The existing business indicator alarm method is to print logs through a specific SDK interface, and the log format fields are fixed. Logs are collected by Fluentd and stored in Elasticsearch, and data display and simple indicator alarms are performed through the Grafana configuration page.

[0004] From the above, it can be seen that the existing technology has the problem of narrow application scenarios. The existing alarm method is only applicable to the monitoring of some basic indicators in transaction scenarios, and cannot meet the monitoring needs of other scenarios. In addition, the monitoring indicators are single and cannot realize the monitoring of indicators such as judging duplication, year-on-year or month-on-month calculation. Summary of the invention

[0005] The present application provides an alarm method, device, equipment, storage medium and program product for business indicators, which are used to solve the problems of narrow application scenarios, single monitoring indicators and inability to monitor complex indicators in the prior art.

[0006] In a first aspect, the present application provides an alarm method for a business indicator, the method comprising:

[0007] Determine the monitoring indicator of the target business, and determine whether the monitoring indicator is a complex indicator;

[0008] In the case where the monitoring indicator is a complex indicator, the monitoring indicator is disassembled to obtain multiple monitoring sub-indicators, and the monitoring sub-indicators are simple indicators;

[0009] Obtaining log data corresponding to the plurality of monitoring sub-indicators from the search engine database respectively;

[0010] According to the plurality of monitoring sub-indicators, the corresponding log data are monitored and analyzed respectively to obtain the monitoring result of each monitoring sub-indicator;

[0011] Determine the alarm result of the monitoring indicator based on the monitoring results of the plurality of monitoring sub-indicators, and generate an alarm notification message when the alarm result indicates that an alarm is required;

[0012] Optionally, the monitoring indicator is decomposed to obtain multiple monitoring sub-indicators, including:

[0013] Analyze and process the monitoring indicator to determine a plurality of influencing factors corresponding to the monitoring indicator, wherein the influencing factors are used to indicate indicator factors that are associated with the monitoring indicator;

[0014] Based on the multiple influencing factors, the monitoring indicator is decomposed to obtain multiple monitoring sub-indicators, wherein the monitoring sub-indicators correspond to the influencing factors;

[0015] Optionally, the obtaining log data corresponding to the plurality of monitoring sub-indicators from the search engine database respectively includes:

[0016] For any one of the plurality of monitoring sub-indicators, determining a log identifier corresponding to the monitoring sub-indicator;

[0017] Acquire log data matching the log identifier from the search engine database;

[0018] Optionally, performing monitoring and analysis on each of the plurality of monitoring sub-indicators to obtain a monitoring result for each monitoring sub-indicator includes:

[0019] For any one of the plurality of monitoring sub-indicators, determining a monitoring rule corresponding to the monitoring sub-indicator;

[0020] Based on the monitoring rules, the corresponding log data is monitored and analyzed to obtain the monitoring results of the monitoring sub-indicators;

[0021] Optionally, determining the alarm result of the monitoring indicator based on the monitoring results of the plurality of monitoring sub-indicators includes:

[0022] Determine whether the monitoring result of each monitoring sub-indicator meets the corresponding preset alarm threshold;

[0023] If the monitoring result of any of the monitoring sub-indicators does not meet the corresponding preset alarm threshold, it is determined that the alarm result of the monitoring indicator requires an alarm;

[0024] Optionally, before determining the monitoring indicator of the target business, the method further includes:

[0025] Determine the collection rules corresponding to the monitoring indicators, and determine the log storage path based on the collection rules;

[0026] Acquire initial log information according to the log storage path;

[0027] Extracting log data corresponding to the monitoring indicator from the initial log information, and using the monitoring indicator to annotate the log data to obtain annotated log data;

[0028] Optionally, the method further includes:

[0029] Performing structured processing on the annotated log data to obtain structured data;

[0030] According to the data format of the search engine database, the structured data is formatted and the log data after format conversion is stored in the search engine database;

[0031] Optionally, the method further includes:

[0032] When the monitoring indicator is a simple indicator, log data corresponding to the monitoring indicator is obtained from a search engine database.

[0033] In a second aspect, the present application provides an alarm device for a business indicator, the device comprising:

[0034] A monitoring module, used to determine the monitoring indicators of the target business and determine whether the monitoring indicators are complex indicators;

[0035] The monitoring module is further used to, when the monitoring indicator is a complex indicator, decompose the monitoring indicator to obtain multiple monitoring sub-indicators, where the monitoring sub-indicators are simple indicators;

[0036] The monitoring module is further used to obtain log data corresponding to the plurality of monitoring sub-indicators from the search engine database respectively;

[0037] The monitoring module is further used to monitor and analyze the corresponding log data according to the plurality of monitoring sub-indicators, and obtain the monitoring result of each monitoring sub-indicator;

[0038] An alarm module, configured to determine an alarm result of the monitoring indicator based on the monitoring results of the plurality of monitoring sub-indicators, and generate an alarm notification message when the alarm result indicates that an alarm is required;

[0039] Optionally, the monitoring module is further used to analyze and process the monitoring indicator to determine a plurality of influencing factors corresponding to the monitoring indicator, wherein the influencing factors are used to indicate indicator factors that are associated with the monitoring indicator;

[0040] The monitoring module is further used to disassemble the monitoring indicator based on the multiple influencing factors to obtain multiple monitoring sub-indicators, wherein the monitoring sub-indicators correspond to the influencing factors;

[0041] Optionally, the monitoring module is further used to determine a log identifier corresponding to any one of the plurality of monitoring sub-indicators;

[0042] The monitoring module is further used to obtain log data matching the log identifier from the search engine database;

[0043] Optionally, the monitoring module is further used to determine a monitoring rule corresponding to any one of the plurality of monitoring sub-indicators;

[0044] The monitoring module is further used to monitor and analyze the corresponding log data based on the monitoring rules to obtain the monitoring results of the monitoring sub-indicators;

[0045] Optionally, the alarm module is further used to determine whether the monitoring result of each monitoring sub-indicator meets the corresponding preset alarm threshold;

[0046] The alarm module is further configured to determine that the alarm result of the monitoring indicator requires an alarm if the monitoring result of any of the monitoring sub-indicators does not meet the corresponding preset alarm threshold;

[0047] Optionally, the device further comprises: a data acquisition module;

[0048] The data collection module is used to determine the collection rules corresponding to the monitoring indicators, and determine the log storage path based on the collection rules;

[0049] The data collection module is further used to obtain initial log information according to the log storage path;

[0050] The data collection module is further used to extract log data corresponding to the monitoring indicator from the initial log information, and use the monitoring indicator to mark the log data to obtain the marked log data;

[0051] Optionally, the data collection module is further used to perform structured processing on the log data after the annotation processing to obtain structured data;

[0052] The data collection module is further used to convert the format of the structured data according to the data format of the search engine database;

[0053] The data collection module is further used to store the log data after format conversion into the search engine database;

[0054] Optionally, the monitoring module is further used to obtain log data corresponding to the monitoring indicator from the search engine database when the monitoring indicator is a simple indicator.

[0055] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0056] The memory stores computer-executable instructions;

[0057] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0058] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0059] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0060] The business indicator alarm method, device, equipment, storage medium and program product provided by the present application determine the monitoring indicator of the target business and judge whether the monitoring indicator is a complex indicator; when the monitoring indicator is a complex indicator, the monitoring indicator is disassembled and processed to obtain multiple monitoring sub-indicators, and the monitoring sub-indicators are simple indicators; the log data corresponding to the multiple monitoring sub-indicators are obtained from the search engine database respectively; according to the multiple monitoring sub-indicators, the corresponding log data is monitored and analyzed respectively to obtain the monitoring result of each monitoring sub-indicator; based on the monitoring results of the multiple monitoring sub-indicators, the alarm result of the monitoring indicator is determined, and when the alarm result indicates that an alarm is required, an alarm notification message is generated. By disassembling complex indicators into monitoring sub-indicators, monitoring and alarming of complex indicators in the business process is realized, which solves the problem that the existing technology has narrow application scenarios, single monitoring indicators, and cannot realize the monitoring of complex indicators. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0062] Figure 1 A diagram of an implementation scenario of an alarm method for a business indicator provided in an embodiment of the present application;

[0063] Figure 2A flow chart of a method for providing an alarm for a business indicator according to an embodiment of the present application Figure 1 ;

[0064] Figure 3 A flow chart of a method for providing an alarm for a business indicator according to an embodiment of the present application Figure 2 ;

[0065] Figure 4 A flow chart of a method for providing an alarm for a business indicator according to an embodiment of the present application Figure 3 ;

[0066] Figure 5 A schematic diagram of the structure of an alarm device for a business indicator provided in an embodiment of the present application;

[0067] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0068] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0069] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0070] This application involves conducting big data analysis on user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.), and using artificial intelligence technology to make automated decisions, and making technical solutions that have a significant impact on personal rights and interests based on the results of automated decisions. The application provides users with corresponding operation entrances for them to choose to agree or reject the results of automated decisions; if the user chooses to reject, the expert decision-making process will be entered.

[0071] It should be noted that the alarm method, device, equipment, storage medium and program product of the business indicators of the present application can be used in the field of big data, and can also be used in any field except big data. The application field of the alarm method, device, equipment, storage medium and program product of the business indicators of the present application is not limited.

[0072] The terms "first", "second", "third", "fourth", etc. (if any) in the description and claims of the present invention and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein, for example.

[0073] In the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0074] First, the terms involved in this application are explained:

[0075] Complex indicator alarm: This is achieved by setting and monitoring complex indicators. These indicators usually include various performance parameters of the system, such as CPU usage, memory usage, network bandwidth utilization, etc. By monitoring these indicators, operation and maintenance personnel can understand the operating status of the system in real time and discover potential problems in a timely manner.

[0076] Elasticsearch: is a distributed, highly scalable, and highly real-time search and data analysis engine. It can easily enable large amounts of data to be searched, analyzed, and explored. Taking full advantage of the horizontal scalability of Elasticsearch can make data more valuable in the production environment. The implementation principle of Elasticsearch is mainly divided into the following steps. First, the user submits the data to the Elasticsearch database, and then the corresponding sentence is segmented through the word segmentation controller, and its weight and word segmentation results are stored in the data. When the user searches for data, the results are ranked and scored according to the weight, and then the returned results are presented to the user.

[0077] Fluentd: is an open source data collector that collects log and event data from different sources and forwards this data to various storage, analysis or processing systems. Fluentd is a completely open source log management tool that simplifies log collection, processing, and storage, eliminating the need to maintain and write special log processing scripts.

[0078] Grafana: is an open source data visualization and analysis platform, mainly used for real-time monitoring, querying and displaying time series data collected from different data sources. Grafana's role is fast and flexible client graphics with a variety of options, panel plug-ins for many different ways to visualize indicators and logs; visually define alert rules for the most important indicators, Grafana will continuously evaluate them and send notifications; when the alarm changes state, it will issue a notification. Receive email notifications; create dynamic and reusable dashboards using template variables, which appear as drop-down menus at the top of the dashboard; mix different data sources in the same graph, and specify the data source based on each query. This even applies to custom data sources; annotate charts from different data sources. Hovering over an event displays the full event metadata and tags; filters allow dynamic creation of new key / value filters, which are automatically applied to all queries using that data source.

[0079] Year-on-year: Year-on-year is generally the comparison between the nth month of this year and the nth month of a previous year.

[0080] Ring growth: Ring growth means comparing the quantity with the previous period. There are two methods for ring growth: ring growth rate and ring development rate.

[0081] Figure 1 A real-time scenario diagram of a business indicator alarm method provided in an embodiment of the present application, such as Figure 1 As shown, the interactive subjects involved in the method include: business application 1, data collector 2, search engine database 3, monitoring engine 4 and visual alarm platform 5, wherein data collector 2 can be Fluentd, search engine database 3 can be Elasticsearch, and visual alarm platform 5 can be Grafana. When the business application 1 needs to monitor relevant indicators, it can print logs through the corresponding SDK interface, and the data collector 2 collects the logs and uses a specific custom identifier to parse the logs to obtain the identified log data; the data collector 2 performs structured processing on the identified log data and converts it into a metadata format that can be recognized and stored by the search engine database 3, so that the search engine database 3 can store the log data; the monitoring engine 4 can obtain relevant log data from the search engine database 3 based on the monitoring indicators, monitor the log data, and upload the monitoring results to the visual alarm platform 5, which performs threshold judgment on the monitoring results to obtain the corresponding alarm results, and generates an alarm prompt when an alarm is required, so that the operation and maintenance personnel can continue to monitor and adjust the alarm indicators.

[0082] Combined with the above scenarios, it can be seen that the existing business indicator alarm method is to print logs through a specific SDK interface, and the log format fields are fixed. Logs are collected by Fluentd and stored in Elasticsearch, and data display and simple indicator alarms are performed through the Grafana configuration page. The existing technology has the problem of narrow application scenarios. The existing alarm method is only applicable to the monitoring of some basic indicators in transaction scenarios, and cannot meet the monitoring needs of other scenarios. In addition, the monitoring indicators are single, and it is impossible to monitor indicators such as judging duplication, year-on-year or month-on-month calculations.

[0083] The business indicator alarm method provided in this application is intended to solve the above technical problems in the prior art.

[0084] The method provided by the present application analyzes and judges the simple indicators and complex indicators in the monitoring indicators through the monitoring engine, separates the complex indicators of the monitoring indicators, and obtains multiple influencing factors related to the complex indicators; based on the multiple influencing factors, the complex indicators are disassembled and processed to obtain multiple corresponding monitoring sub-indicators. At this time, the monitoring sub-indicators obtained after disassembly are simple indicators, which are monitored, and the monitoring results of the complex indicators can be determined by combining the monitoring results of multiple monitoring sub-indicators, and the alarm monitoring of the monitoring indicators is realized based on the monitoring results. The problem that the existing technology has narrow application scenarios, single monitoring indicators, and cannot realize the monitoring of complex indicators is solved.

[0085] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0086] Figure 2 A flow chart of a method for providing an alarm for a business indicator according to an embodiment of the present application Figure 1 .like Figure 2 As shown, a service indicator alarm method shown in this embodiment includes:

[0087] S101. Determine monitoring indicators for target business.

[0088] Among them, business indicators refer to quantitative standards or key data points in the process of business application operation. Monitoring business indicators can timely analyze the real-time changes of key data points, clearly understand the operating status or development trend of the business, and thus provide relevant data decision-making basis for business planning, business management and other aspects. For example, it can include year-on-year growth rate, month-on-month growth rate, quarterly revenue, etc. related to financial data, and can also include business system response time, resource utilization or system business throughput. The monitoring indicators here can be adjusted and determined according to the specific type of target business and operation and maintenance related requirements, and this plan does not limit this.

[0089] S102, determine whether the monitoring indicator is a complex indicator; if so, execute steps S103-S107; if not, execute steps S108-S111.

[0090] Among them, complex indicators are used to indicate changes that are obtained through multiple different data elements, sub-indicators, or require multiple steps of complex calculations. The corresponding indicators are simple indicators. Simple indicators are usually composed of a single data element or directly measurable factors.

[0091] It is understandable that complex indicators, such as the year-on-year growth rate of operating income, need to consider both the current period's operating income and the same period last year's operating income. The calculation formula is (current period's operating income - same period last year's operating income) / same period last year's operating income × 100%. This means that the year-on-year indicator is constructed based on data from two time points, and is not as simple and direct as a single sales data.

[0092] Alternatively, a simple indicator can be, for example, the number of visits to a website. The number of visits to a website is obtained by simply counting the number of times the website is visited. This type of indicator only involves one clear data point and does not require the combination or complex calculation of multiple different data. Complex indicators, on the other hand, require the integration of multiple types of data, such as structured data and unstructured data.

[0093] S103: Decompose the monitoring indicator to obtain multiple monitoring sub-indicators, where the monitoring sub-indicators are simple indicators.

[0094] Among them, according to business needs and monitoring objectives, it can be determined to decompose the original monitoring indicators into sub-indicators in multiple aspects, and there is a close correlation between the monitoring sub-indicators and the monitoring indicators.

[0095] Understandably, clear definitions and calculation methods can be developed for each sub-indicator to ensure the accuracy and consistency of the data. By disassembling complex indicators, complex monitoring indicators can be refined into multiple simple monitoring sub-indicators, which facilitates more accurate data collection, monitoring, and subsequent analysis and decision-making basis.

[0096] Specifically, for example, if the current complex indicator is the year-on-year growth rate, according to the calculation formula of the year-on-year growth rate: Year-on-year growth rate = (current period development level - same period development level) / same period development level × 100%, it can be known that the sub-indicators related to this indicator are "current period development level" and "same period development level". Based on the above sub-indicators, the complex indicator "year-on-year growth rate" can be disassembled. Among them, the current period development level represents a certain indicator value in the current time period (for example, it can be this year, this month, this week, etc.). For example, if the annual year-on-year growth rate is calculated, then the current period development level is the sales volume, number of users or other related indicators of this year; the same period level represents the same indicator value in the past time period corresponding to the current time period (for example, last year, last month, last week, etc.). In the example of the annual year-on-year growth rate, the same period level is the sales volume, number of users, etc. of the same period last year.

[0097] Based on the above decomposition, each sub-indicator is derived from a single data source or simple arithmetic operations, which is easier to monitor and interpret. At the same time, each sub-indicator targets a specific aspect of the influencing factors of the complex indicator, which helps to quickly locate the problem, and each sub-indicator can be measured by specific data to ensure the accuracy and objectivity of monitoring.

[0098] S104: Obtain log data corresponding to a plurality of monitoring sub-indicators from a search engine database.

[0099] Among them, the search engine database can be, for example, an Elasticsearch engine. First, the specific monitoring sub-indicators that need to be monitored can be determined. For example, for the complex indicator of "order processing efficiency" of the e-commerce platform, the monitoring sub-indicators include the time from order placement to payment confirmation, the time from payment confirmation to warehouse distribution, and the time from warehouse distribution completion to delivery; for the user activity of the website, the monitoring sub-indicators include the number of daily active users, the number of monthly active users, the average number of pages visited per user per day, etc.

[0100] It is understandable that the search engine database can obtain corresponding log data based on the monitoring sub-indicators. The log data may include query logs, click logs, system logs, etc., which can be judged and extracted based on the type of sub-indicator monitoring.

[0101] In one possible implementation, the search engine database is an Elasticsearch engine, and the monitoring engine determines that the monitoring indicator is a complex indicator. After decomposing and calculating the complex indicator, the related simple indicator is obtained. The simple indicator obtained after the decomposition and calculation can be uploaded to the Elasticsearch engine again for storage to provide basic data support for subsequent monitoring, analysis and data-based decision-making of the monitoring sub-indicators.

[0102] S105: According to the multiple monitoring sub-indicators, monitor and analyze the corresponding log data respectively to obtain the monitoring result of each monitoring sub-indicator.

[0103] Among them, corresponding monitoring rules can be set for multiple monitoring sub-indicators, and monitoring and analysis can be carried out on them. For example, the current monitoring indicator is "year-on-year growth rate", and its corresponding sub-indicators are "current period development level" and "same period development level". At this time, the "current period development level" and "same period development level" are monitored, and corresponding thresholds are set. Monitoring reports can be generated regularly, including statistical data, charts and trend analysis of each monitoring sub-indicator, so as to comprehensively analyze the monitoring results.

[0104] For another example, a complex indicator is website user activity, and its corresponding sub-indicators are daily active users, monthly active users, and the average number of pages visited per user per day. The number of daily active users can be extracted from the website access log to find the user's unique ID and access time field, and the number can be counted by screening out different users with access records on the same day; the number of monthly active users can also be expanded to a natural month to find different user access situations, extracting the user's unique ID and access time field; the average number of pages visited per user per day can be extracted from fields such as the page URL visited by the user each time, which is used to count the total number of pages visited by each user per day, and then calculate the average value. In this way, indicator data such as the number of daily active users and the number of monthly active users in different time periods (such as daily, weekly, and monthly) can be collected to form time series data.

[0105] In one possible implementation, the monitoring results of each monitoring sub-indicator can be recorded in a suitable format, such as stored in a database, to facilitate subsequent query, comparison and further analysis. The record can include key information such as timestamp, monitoring sub-indicator name and corresponding specific value, and use a simple moving average method to smooth the data and observe its long-term trend; or use more complex statistical analysis methods, such as linear regression analysis, to fit a trend line, which can be used to determine whether user activity is increasing, decreasing or remaining stable, and obtain monitoring results about the trend.

[0106] S106: Determine an alarm result of the monitoring indicator based on the monitoring results of the multiple monitoring sub-indicators.

[0107] S107: When the alarm result indicates that an alarm is required, generate an alarm notification message.

[0108] Among them, the alarm result can be obtained by setting a reasonable alarm threshold for each sub-indicator based on business needs and monitoring objectives. The threshold can be, for example, an absolute value, relative value or percentage, etc. This application does not impose any relevant restrictions on the setting of the threshold.

[0109] It is understandable that when the monitoring result of a sub-indicator meets the alarm condition, the alarm of the sub-indicator is triggered. And the monitoring results of multiple sub-indicators can be considered comprehensively to determine the alarm result. For example, when the network delay increases and the CPU usage increases at the same time, it may indicate that the system is under attack or overload, and a higher level alarm can be triggered.

[0110] It is understandable that different alarm levels are set according to the severity and urgency of the alarm, such as warning, severe warning, emergency alarm, etc. When the alarm condition is met, the alarm mechanism is triggered and an alarm message is generated. Specifically, the alarm message can be sent to relevant personnel by email, SMS, phone, instant messaging tools, etc., so that after receiving the alarm message, the relevant personnel can perform corresponding processing according to the alarm level and description, such as troubleshooting, optimizing the system, adjusting the configuration, etc.

[0111] In this embodiment, for example, visualization tools such as Grafana and Kibana can be used to display the monitoring results. By drawing different chart types such as bar charts, line charts, and pie charts, the changes, trends, and comparative relationships of each monitoring sub-indicator can be intuitively presented. For example, a line chart is used to show the trend of the number of daily active users over time, and a pie chart is used to show the percentage of order payment success rates of different payment methods, which helps to quickly discover anomalies, evaluate business status, and provide an intuitive basis for decision-making. Grafana makes threshold judgments to implement alarm prompts.

[0112] S108: Obtain log data corresponding to the monitoring indicator from the search engine database.

[0113] S109: Monitor and analyze the log data according to the monitoring indicators to obtain monitoring results.

[0114] S110. Determine an alarm result of the monitoring indicator based on the monitoring result.

[0115] S111. When the alarm result indicates that an alarm is required, generate an alarm notification message.

[0116] Among them, when the monitoring indicator is a simple indicator, the specific monitoring alarm process is similar to the monitoring alarm process of the monitoring sub-indicator, and steps S108 to S111 are similar to the above steps S104 to S109, which will not be repeated in this application.

[0117] The present embodiment provides an alarm method for a business indicator, which determines the monitoring indicator of the target business and determines whether the monitoring indicator is a complex indicator; if the monitoring indicator is a complex indicator, the monitoring indicator is decomposed to obtain multiple monitoring sub-indicators; the log data corresponding to the multiple monitoring sub-indicators are obtained from the search engine database; the corresponding log data is monitored and analyzed according to the multiple monitoring sub-indicators to obtain the monitoring results of each monitoring sub-indicator; based on the monitoring results of the multiple monitoring sub-indicators, the alarm result of the monitoring indicator is determined, and an alarm notification message is generated when the alarm result indicates that an alarm is required. By decomposing complex indicators into monitoring sub-indicators, monitoring and alarming of complex indicators in the business process is realized, which solves the problem that the existing technology has narrow application scenarios, single monitoring indicators, and cannot realize the monitoring of complex indicators.

[0118] Figure 3 This is a flow diagram of a method for providing an alarm for a business indicator provided by an embodiment of the present application. Figure 2 This embodiment is in Figure 2 Based on the embodiment, a process of determining the alarm result of a monitoring indicator by monitoring the alarm result of a sub-indicator in an alarm method of a business indicator is described in detail. Figure 3 As shown, a service indicator alarm method shown in this embodiment includes:

[0119] S201: Analyze and process monitoring indicators to determine multiple influencing factors corresponding to the monitoring indicators.

[0120] The raw data composition of the monitoring indicators can be analyzed. For example, the system response time can be broken down into network delay, server processing time, database query time, etc. The results of correlation analysis, serial substitution method, and multivariate statistics are combined to comprehensively evaluate the impact of various factors on the monitoring indicators to identify relevant influencing factors.

[0121] S202: Based on multiple influencing factors, the monitoring indicator is decomposed to obtain multiple monitoring sub-indicators.

[0122] Among them, the key factors affecting the monitoring indicators can be identified by analyzing business logic, historical data, etc. The influencing factors may include, for example, performance indicators (such as CPU usage, memory occupancy), business indicators (such as order volume, user activity), external factors (such as network delay, competitor dynamics), etc. Based on the above influencing factors, the monitoring indicators are disassembled to obtain the corresponding multiple monitoring sub-indicators, which can reflect all aspects of the monitoring indicators in a more detailed and comprehensive manner.

[0123] Specifically, for example, the current monitoring indicator is the month-on-month growth rate, where the month-on-month is compared with the number of the previous period, and the calculation formula is month-on-month growth rate = (this period number - previous period number) / previous period number × 100%, which can be used to reflect how much the current period has grown compared with the previous period. At this time, it can be determined that the influencing factors of the month-on-month growth rate include two basic factors, the current period number and the previous period number. Based on these two basic factors, determine the corresponding sub-indicators, namely the current period number indicator and the previous period number indicator.

[0124] S203: For any one of the multiple monitoring sub-indicators, determine a log identifier corresponding to the monitoring sub-indicator.

[0125] Among them, the monitoring sub-indicator can be determined according to specific monitoring indicators and business requirements, system architecture or technical characteristics, such as CPU usage, memory occupancy, network latency, database query time, etc. Based on the monitoring sub-indicator, the corresponding log identifier is determined.

[0126] It can be understood that the log identifier can be a key field or data that directly or indirectly reflects the content related to the monitoring sub-indicator. For example, for the user identification field and the order identification field, there are usually "user ID" and "order ID" fields. With the help of these two fields, the access record and the order record can be associated to determine whether the user introduced by a certain channel eventually generated an order.

[0127] Optionally, you can also combine fields such as timestamps, such as access time, operation time, order creation time, etc., to filter and analyze log data according to a specific time range. Specifically, if you want to calculate the traffic conversion rate of each channel every day, week, or month, you can extract the log records in the corresponding time period according to the corresponding timestamp field for statistical calculation.

[0128] Determining the log identifier corresponding to the monitoring sub-indicator can focus on the business meaning of the sub-indicator, the data source, and the log records in the related business processes, and extract key and representative fields to accurately identify the log data that can be used to analyze the sub-indicator.

[0129] S204: Obtain log data matching the log identifier from a search engine database.

[0130] The log identifier may be, for example, one or more specific field values, keywords or phrases, which can uniquely identify log messages related to specific events or data. The search engine database may be stored using technologies such as NoSQL databases (such as MongoDB, Cassandra), search engines (such as Elasticsearch), time series databases (such as InfluxDB), or columnar storage databases (such as HBase, Google Bigtable). This application does not restrict the selection and use of the search engine database, and the corresponding engine database may be selected according to business monitoring needs.

[0131] It is understandable that a corresponding query statement can be constructed according to the log identifier and the query syntax of the selected database. The query statement may include the following elements: select fields, i.e. specify the log fields to be queried, such as timestamp, log level, message content, etc.; filter conditions, i.e. set filter conditions according to the log identifier to filter out log messages related to specific events or data; sort and paging, i.e. set sorting rules (such as sorting in ascending or descending order by timestamp) and paging parameters as needed to better browse and analyze the query results.

[0132] Specifically, the constructed query statement may be submitted to the database for execution, and the query result may be obtained. The query result may include the log message matching the log identifier and the value of its related fields.

[0133] In the search engine database, establishing appropriate indexes and mappings for log data based on log identifiers can improve query efficiency and accuracy. By using the log identifier as a field of the index and making reasonable mapping configurations based on its data type and characteristics, log data matching the log identifier can be located and obtained more quickly.

[0134] S205: Determine the monitoring rules corresponding to the monitoring sub-indicators.

[0135] Each monitoring sub-indicator has a corresponding monitoring rule. The setting of the monitoring rule can, for example, determine the expected target of the sub-indicator according to the monitoring target of the monitoring indicator.

[0136] S206: Monitor and analyze the corresponding log data based on the monitoring rules to obtain monitoring results of the monitoring sub-indicators.

[0137] It can be understood that according to the monitoring rules, the corresponding monitoring engine is deployed, and the relevant monitoring policies and parameters are configured.

[0138] S207, respectively determine whether the monitoring result of each monitoring sub-indicator meets the corresponding preset alarm threshold; if not, execute step S208; if satisfied, execute step S209.

[0139] It is understandable that a reasonable threshold value can be set for each monitoring sub-indicator. The threshold value can be set based on factors such as historical data, business requirements, and system performance. Here, the threshold value setting can be set as a static threshold value or a dynamic threshold value, for example.

[0140] Specifically, the static threshold can be used to set the upper and lower thresholds of the monitoring sub-indicator based on historical data, industry standards or business experience. For example, for the sub-indicator "this period number" of the complex indicator's month-on-month growth rate, if the historical data shows that the normal fluctuation range is between 10-20, the lower threshold can be set to 10 and the upper threshold can be set to 20. When the current period number is lower than 10, it is determined that there may be a problem with the indicator corresponding to the current data.

[0141] Dynamic thresholds can be used for situations where the business has obvious periodicity or dynamic change trends. For example, for e-commerce platforms, the traffic conversion rate is usually higher than usual during holidays or promotional activities. The threshold can be adjusted dynamically based on historical data for the same period and business growth trends. For example, during an event, based on the growth trend of previous years, the traffic conversion rate is expected to be between 20% and 30%, which is used as the dynamic threshold during the event.

[0142] S208: Determine whether the alarm result of the monitoring indicator requires an alarm.

[0143] S209: Determine that the alarm result of the monitoring indicator is that no alarm is required.

[0144] Among them, if the monitoring result of any monitoring sub-indicator does not meet the corresponding preset alarm threshold, it is determined that the alarm result of the monitoring indicator requires an alarm; similarly, if the monitoring result of any monitoring sub-indicator does not meet the corresponding preset alarm threshold, it is determined that the alarm result of the monitoring indicator does not require an alarm.

[0145] It is understandable that for each monitoring sub-indicator, one or more alarm thresholds are set, such as an upper limit, a lower limit or a specific range. These thresholds are set in advance according to business requirements and system characteristics, and can be used to determine whether the sub-indicator is in a normal state. The monitoring results of each monitoring sub-indicator can be obtained in real time or periodically, and the monitoring results can be compared with the corresponding alarm thresholds.

[0146] Specifically, if the monitoring result of any monitoring sub-indicator does not meet its alarm threshold, that is, exceeds the upper limit, is lower than the lower limit, or is not within a specific range, the alarm condition is triggered. Once the alarm condition is triggered, the alarm result of the entire monitoring indicator is determined to be "need to be alarmed", which means that there are potential problems or risks in the system that need immediate attention and processing.

[0147] In one possible implementation, the monitoring platform continues to monitor the log data and feeds the monitoring results back to the Grafana visualization platform. The Grafana visualization platform can make threshold judgments on the monitoring results and determine the alarm results based on the judgment results. When an alarm is determined, a visual alarm prompt is generated to notify relevant operation and maintenance personnel to pay attention to relevant indicators and conduct problem troubleshooting.

[0148] The embodiment of the present application provides an alarm method for a business indicator, which obtains multiple influencing factors related to a complex indicator; based on the multiple influencing factors, the complex indicator is disassembled and processed to obtain multiple corresponding monitoring sub-indicators, and the monitoring sub-indicators obtained after the disassembly are simple indicators, which are monitored, and the monitoring results of the complex indicator can be determined by combining the monitoring results of multiple monitoring sub-indicators, and the alarm monitoring of the monitoring indicator is realized based on the monitoring results. By converting complex indicators into simple indicators, it is possible to realize indicator monitoring of complex indicators, improve the accuracy and extensiveness of monitoring, help ensure the stable operation of the system, and improve business efficiency.

[0149] Figure 4 This is a flow diagram of a method for providing an alarm for a business indicator provided by an embodiment of the present application. Figure 3 This embodiment is in Figure 1 and Figure 2 Based on the embodiment, the process of extracting and processing log data and storing it in a search engine database in a business indicator alarm method is described in detail. Figure 4 As shown, a service indicator alarm method shown in this embodiment includes:

[0150] S301. Determine a collection rule corresponding to a monitoring indicator, and determine a log storage path based on the collection rule.

[0151] The data collector may be Fluentd, for example, and the relevant log information is obtained through Fluentd.

[0152] It can be understood that the corresponding data type can be determined based on the monitoring indicators. For example, by monitoring the network, it can be determined that the acquired data type may include, for example, network throughput, network delay time, etc., and the storage path of the data can be determined based on the data source.

[0153] S302: Obtain initial log information according to the log storage path.

[0154] Among them, after the storage path is determined, the initial log information can be obtained through the corresponding data collection method.

[0155] It is understandable that, for example, the system log file of the server contains performance-related information such as CPU usage and memory usage. By writing scripts (such as using Python's re module to perform regular expression matching to extract key data), the logs can be parsed to obtain the corresponding monitoring indicator data.

[0156] S303: extract log data corresponding to the monitoring indicator from the initial log information.

[0157] Among them, the key fields that need to be extracted can be determined through the definition or calculation method of the monitoring indicator.

[0158] Understandably, in the initial log, there are often a large number of fields that are irrelevant to the current monitoring indicators. In order to improve data processing efficiency and accuracy, these irrelevant fields should be filtered out. For example, when analyzing the number of page views on a website, the server CPU usage field recorded in the log is an irrelevant field and does not need to be extracted into the subsequent data set used to calculate the number of page views.

[0159] Specifically, according to the needs of monitoring indicators, corresponding log parsing rules can be written. The rules can be used to accurately identify log entries related to monitoring indicators, and set filtering conditions according to the specific requirements of monitoring indicators. These conditions may include log level, source, time range, etc., and in the filtering process, remove data that is not related to the monitoring indicators to reduce the amount of data to be processed subsequently, so as to improve processing efficiency.

[0160] S304: Use monitoring indicators to annotate the log data to obtain annotated log data.

[0161] Among them, corresponding labeling rules can be formulated according to the calculation method of monitoring indicators. The rules can clarify how to extract key information from log data and what labels to add.

[0162] It is understandable that a custom annotation tool can be used to read the log data to be processed, and according to the format of the log data, the key information therein can be parsed, such as timestamp, log level, message content, etc. Then, the parsed key information is annotated according to the defined annotation rules, and the specific annotation can include, for example, adding tags, modifying metadata, classification, etc., and the annotated log data is output to a new file, database or log management platform.

[0163] Specifically, this solution supports custom identifiers such as "$", "[]", etc., and can segment log data through configuration, and mark valid data through custom identifiers. For example, for the log "[20240320][name][action][num]***", relevant valid information can be extracted through "[]", where num is a specific indicator. Based on this basic information, complex operations can be performed on indicators, and alarms can be issued.

[0164] S305: Structuring the annotated log data to obtain structured data.

[0165] Among them, by annotating the processed log data, understanding its content and structure, and identifying all possible fields and data types. Based on the analysis results, a suitable structured data model can be defined, which can contain all necessary fields and specify the data type of each field, such as string, integer, floating point number, date, etc. Through this structured data model, the converted structured data is obtained.

[0166] S306: Convert the structured data into a format according to the data format of the search engine database, and store the log data after the format conversion into the search engine database.

[0167] Taking the search engine database Elasticsearch as an example, the data stored in Elasticsearch exists in the form of documents in JSON format. Each document is similar to a record in a relational database. The document contains multiple fields. The fields have corresponding names and values, and the values ​​can be of various data types (such as strings, numbers, dates, Boolean values, arrays, objects, etc.).

[0168] It can be understood that according to the structured log data content, each log record can be organized into a complete JSON document by converting it according to the format specifications of Elasticsearch, adding necessary metadata fields, and organizing other related fields and their order according to business logic and analysis requirements, ensuring that the structure of each JSON document is clear, complete and complies with the storage and query specifications of Elasticsearch.

[0169] Specifically, you can select a suitable parsing plug-in for log parsing based on the identifier configured in the collection rule and the actual format of the log file (such as text format, JSON format, etc.). Through the parsing configuration, Fluentd can extract key information from the log according to the set rules and convert it into structured data. The format or field name of the parsed log data may not fully meet the storage requirements of Elasticsearch, and certain data conversion is required. At this time, for example, you can modify a certain field name after parsing, add some fixed metadata fields (such as adding identification information such as the source system name), etc., to ensure that the data structure after parsing and conversion meets the format requirements of the Elasticsearch document. Then, you can use Fluentd's output plug-in to send the processed data to Elasticsearch for storage.

[0170] In one possible implementation, through the complete configuration above, Fluentd can obtain log files from the specified log storage path according to the set process, parse and process them according to the identifiers configured in the collection rules, convert them into metadata that meets the requirements of Elasticsearch, and regularly upload them to Elasticsearch for storage, so as to facilitate subsequent data query, analysis, monitoring and alarm operations through Elasticsearch.

[0171] An alarm method for business indicators provided in an embodiment of the present application customizes logs based on distinguishable identifiers, parses log information through unified rules, and implements business alarms after extracting indicators, thereby improving the adaptability and compatibility of monitoring alarm technology and meeting application monitoring requirements for complex business scenarios.

[0172] Figure 5 This is a schematic diagram of the structure of a business indicator alarm device provided by this application. Figure 5 As shown, the present embodiment provides an alarm device 400 for a business indicator, including:

[0173] Monitoring module 401, used to determine the monitoring index of the target business and determine whether the monitoring index is a complex index;

[0174] The monitoring module 401 is further used to, when the monitoring indicator is a complex indicator, decompose the monitoring indicator to obtain multiple monitoring sub-indicators, where the monitoring sub-indicators are simple indicators;

[0175] The monitoring module 401 is further used to obtain log data corresponding to the plurality of monitoring sub-indicators from the search engine database;

[0176] The monitoring module 401 is further used to monitor and analyze the corresponding log data according to the plurality of monitoring sub-indicators, and obtain the monitoring result of each monitoring sub-indicator;

[0177] The alarm module 402 is used to determine the alarm result of the monitoring indicator based on the monitoring results of the plurality of monitoring sub-indicators, and generate an alarm notification message when the alarm result indicates that an alarm is required;

[0178] Optionally, the monitoring module 401 is further used to analyze and process the monitoring indicator to determine a plurality of influencing factors corresponding to the monitoring indicator, where the influencing factors are used to indicate indicator factors that are associated with the monitoring indicator;

[0179] The monitoring module 401 is further configured to decompose the monitoring indicator based on the multiple influencing factors to obtain multiple monitoring sub-indicators, wherein the monitoring sub-indicators correspond to the influencing factors;

[0180] Optionally, the monitoring module 401 is further configured to determine a log identifier corresponding to any one of the plurality of monitoring sub-indicators;

[0181] The monitoring module 401 is further used to obtain log data matching the log identifier from the search engine database;

[0182] Optionally, the monitoring module 401 is further configured to determine a monitoring rule corresponding to any one of the plurality of monitoring sub-indicators;

[0183] The monitoring module 401 is further used to monitor and analyze the corresponding log data based on the monitoring rules to obtain the monitoring results of the monitoring sub-indicators;

[0184] Optionally, the alarm module 402 is further configured to determine whether the monitoring result of each monitoring sub-indicator satisfies a corresponding preset alarm threshold;

[0185] The alarm module 402 is further configured to determine that the alarm result of the monitoring indicator requires an alarm if the monitoring result of any of the monitoring sub-indicators does not meet the corresponding preset alarm threshold;

[0186] Optionally, the device further includes: a data acquisition module 403;

[0187] The data collection module 403 is used to determine the collection rules corresponding to the monitoring indicators, and determine the log storage path based on the collection rules;

[0188] The data collection module 403 is further used to obtain initial log information according to the log storage path;

[0189] The data collection module 403 is further used to extract log data corresponding to the monitoring indicator from the initial log information, and use the monitoring indicator to mark the log data to obtain the marked log data;

[0190] Optionally, the data collection module 403 is further used to perform structured processing on the log data after the annotation processing to obtain structured data;

[0191] The data collection module 403 is further used to convert the format of the structured data according to the data format of the search engine database;

[0192] The data collection module 403 is also used to store the log data after format conversion into the search engine database;

[0193] Optionally, the monitoring module 401 is further configured to obtain log data corresponding to the monitoring indicator from a search engine database when the monitoring indicator is a simple indicator.

[0194] The alarm device for a business indicator provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0195] Figure 6 This is a schematic diagram of the structure of an electronic device provided in this application. Figure 6 As shown, the electronic device 500 provided in this embodiment includes: at least one processor 501 and a memory 502.

[0196] Optionally, the device 500 further includes a communication component 503 . The processor 501 , the memory 502 and the communication component 503 are connected via a bus 504 .

[0197] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that at least one processor 501 executes the above method.

[0198] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0199] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0200] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0201] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0202] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0203] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. Unless otherwise specified, the processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. Unless otherwise specified, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory (RRAM), a dynamic random access memory (DRAM), a static random access memory (SRAM), an enhanced dynamic random access memory (EDRAM), a high-bandwidth memory (HBM), a hybrid memory cube (HMC), etc.

[0204] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a memory, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0205] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0206] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0207] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A business indicator alarm method, characterized in that: The method comprises: Determine the monitoring indicator of the target business, and determine whether the monitoring indicator is a complex indicator; In the case where the monitoring indicator is a complex indicator, the monitoring indicator is disassembled to obtain multiple monitoring sub-indicators, and the monitoring sub-indicators are simple indicators; Obtaining log data corresponding to the plurality of monitoring sub-indicators from the search engine database respectively; According to the plurality of monitoring sub-indicators, the corresponding log data are monitored and analyzed respectively to obtain the monitoring result of each monitoring sub-indicator; Based on the monitoring results of the plurality of monitoring sub-indicators, an alarm result of the monitoring indicator is determined, and when the alarm result indicates that an alarm is required, an alarm notification message is generated.

2. The method according to claim 1, characterized in that The monitoring indicator is decomposed to obtain multiple monitoring sub-indicators, including: Analyze and process the monitoring indicator to determine a plurality of influencing factors corresponding to the monitoring indicator, wherein the influencing factors are used to indicate indicator factors that are associated with the monitoring indicator; Based on the multiple influencing factors, the monitoring indicator is decomposed to obtain multiple monitoring sub-indicators, wherein the monitoring sub-indicators correspond to the influencing factors.

3. The method according to claim 2, characterized in that The obtaining log data corresponding to the plurality of monitoring sub-indicators from the search engine database respectively includes: For any one of the plurality of monitoring sub-indicators, determining a log identifier corresponding to the monitoring sub-indicator; The log data matching the log identifier is obtained from the search engine database.

4. The method according to claim 3, characterized in that According to the plurality of monitoring sub-indicators, monitoring and analyzing are performed respectively to obtain monitoring results of each monitoring sub-indicator, including: For any one of the plurality of monitoring sub-indicators, determining a monitoring rule corresponding to the monitoring sub-indicator; Based on the monitoring rules, the corresponding log data is monitored and analyzed to obtain the monitoring results of the monitoring sub-indicators.

5. The method according to claim 4, characterized in that The determining the alarm result of the monitoring indicator based on the monitoring results of the plurality of monitoring sub-indicators includes: Determine whether the monitoring result of each monitoring sub-indicator meets the corresponding preset alarm threshold; If the monitoring result of any of the monitoring sub-indicators does not meet the corresponding preset alarm threshold, it is determined that the alarm result of the monitoring indicator requires an alarm.

6. The method according to claim 3, characterized in that Before determining the monitoring indicator of the target business, the method further includes: Determine the collection rules corresponding to the monitoring indicators, and determine the log storage path based on the collection rules; Acquire initial log information according to the log storage path; Log data corresponding to the monitoring indicator is extracted from the initial log information, and the log data is annotated using the monitoring indicator to obtain the annotated log data.

7. The method according to claim 6, characterized in that The method further comprises: Performing structured processing on the annotated log data to obtain structured data; The structured data is format-converted according to the data format of the search engine database, and the log data after format conversion is stored in the search engine database.

8. The method according to claim 1, characterized in that The method further comprises: When the monitoring indicator is a simple indicator, log data corresponding to the monitoring indicator is obtained from a search engine database.

9. A business indicator alarm device, characterized in that: include: A monitoring module, used to determine the monitoring indicators of the target business and determine whether the monitoring indicators are complex indicators; The monitoring module is further used to, when the monitoring indicator is a complex indicator, decompose the monitoring indicator to obtain multiple monitoring sub-indicators, where the monitoring sub-indicators are simple indicators; The monitoring module is further used to obtain log data corresponding to the plurality of monitoring sub-indicators from the search engine database respectively; The monitoring module is further used to monitor and analyze the corresponding log data according to the plurality of monitoring sub-indicators, and obtain the monitoring result of each monitoring sub-indicator; The alarm module is used to determine the alarm result of the monitoring indicator based on the monitoring results of the plurality of monitoring sub-indicators, and generate an alarm notification message when the alarm result indicates that an alarm is required.

10. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 8 when executed by a processor.

12. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 8 when being executed by a processor.

Images