Log analysis method and device, electronic equipment and storage medium

Abstract

The invention provides a log analysis method and device, electronic equipment and a storage medium. The method comprises the steps that at least one target analysis method for analyzing a target to-be-analyzed log is determined; aiming at each target analysis method, calling the target analysis method through an extensible interface, and loading field screening parameters required by the target analysis method according to the target log to be analyzed; filtering the target to-be-analyzed log by using the target analysis method loaded with the field screening parameters, and determining a target log segment needing to be analyzed by the target analysis method; analyzing the corresponding target log segment by using the target analysis method, and determining a field analysis result of the target log segment; and synthesizing all the field analysis results, determining a comprehensive analysis result of the target to-be-analyzed log, and outputting an analysis report of the target to-be-analyzed log in combination with a preset template. Therefore, the log analysis efficiency and the cross-platform processing capability can be effectively improved through the scheme.

Description

Technical Field

[0001] The present application relates to the field of data analysis technology, and in particular to a log analysis method, device, electronic device and storage medium. Background Art

[0002] In the current product development process of the automotive industry, log analysis is an important tool for problem investigation. Logs play a key role in both the debugging and development stage and the troubleshooting stage. However, due to the high complexity of the vehicle system and the long development cycle, the demand for log analysis has far exceeded the functional scope of traditional software. However, the existing log analysis software faces the problem of insufficient applicability in the automotive industry, as shown below:

[0003] 1. High learning threshold limits usage efficiency: Existing log analysis software is mostly designed for equipment monitoring and abnormal alarms in production environments, with little consideration for development phase requirements. In vehicle product development, the log formats and contents of different functional modules (such as ADAS, IVI, ECU, etc.) vary greatly, and developers often lack familiarity with certain functional modules. Therefore, existing log analysis tools require users to have a high level of domain knowledge and experience in order to accurately extract log information for problem analysis. This high learning threshold has led to a significant decrease in development efficiency, especially when it comes to issues involving the coordination of multiple functions.

[0004] 2. Insufficient tool adaptability in multi-party collaboration: In-vehicle product development involves collaboration with multiple upstream and downstream suppliers, and log analysis runs through the entire development chain. However, the log formats and analysis tools generated by different suppliers vary, and existing software lacks cross-platform compatibility, making it difficult to support collaboration between different teams. This further hinders efficient problem investigation and the advancement of development progress.

[0005] In summary, how to meet the log analysis needs in a complex development environment is a technical problem that needs to be solved urgently. Summary of the invention

[0006] In view of this, the purpose of the present application is to provide a log analysis method, device, electronic device and storage medium, which can effectively improve the efficiency of log analysis and improve cross-platform processing capabilities, thereby shortening vehicle development time.

[0007] The present application provides a log analysis method, which includes:

[0008] Acquire a target log to be analyzed, and determine at least one target analysis method for analyzing the target log to be analyzed;

[0009] For each target analysis method, the target analysis method is called through the extensibility interface, and the field screening parameters required by the target analysis method are loaded according to the target log to be analyzed;

[0010] The target analysis method after loading field screening parameters is used to filter the target log to be analyzed, and determine the target log segment to be analyzed by the target analysis method;

[0011] Analyze the corresponding target log segment using the target analysis method to determine the field analysis result of the target log segment;

[0012] The comprehensive analysis results of all fields are combined to determine the comprehensive analysis results of the target log to be analyzed, and the analysis report of the target log to be analyzed is output in combination with a preset template.

[0013] Optionally, the target log to be analyzed is generated by following the steps below:

[0014] Get the initial log to be analyzed;

[0015] Identify the project type to which the initial log to be analyzed belongs;

[0016] Determine the target log library corresponding to the initial log to be analyzed according to the project type;

[0017] According to the target preprocessing method corresponding to the target log library, the initial log to be analyzed is processed accordingly to generate a target log to be analyzed.

[0018] Optionally, after generating the target log to be analyzed, the log analysis method further includes:

[0019] Generate a storage path of the target log to be analyzed in the target log library;

[0020] The target log to be analyzed is saved according to the storage path, and the initial log to be analyzed is stored in a designated location in the target log library.

[0021] Optionally, the using the target analysis method to analyze the corresponding target log segment to determine the field analysis result of the target log segment includes:

[0022] Identify whether the target log segment contains encrypted information;

[0023] If so, decrypt the target log segment using the parsing algorithm configured in the target analysis method;

[0024] The target analysis method is used to analyze the decrypted target log segment to determine the field analysis result of the target log segment.

[0025] Optionally, after generating the field analysis result, the log analysis method further includes:

[0026] Determine an information presentation method for the field analysis result, and display the field analysis result according to the information presentation method; wherein the information presentation method includes at least one of the following: picture form, text description form, table form, and time point form.

[0027] Optionally, the log analysis method further includes:

[0028] Monitor the logs to be analyzed stored in the log library, and purge the logs to be analyzed that do not meet the requirements according to the preset purge strategy.

[0029] Optionally, the field screening parameters include at least one of the following: project number, start time, end time and analysis target.

[0030] The present application also provides a log analysis device, which includes:

[0031] An acquisition module, used to acquire a target log to be analyzed, and determine at least one target analysis method for analyzing the target log to be analyzed;

[0032] A calling module is used to call each target analysis method through an extensibility interface, and load the field screening parameters required by the target analysis method according to the target log to be analyzed;

[0033] A filtering module, used to filter the target log to be analyzed by using the target analysis method after loading field screening parameters, and determine the target log segment to be analyzed by the target analysis method;

[0034] An analysis module is used to analyze the corresponding target log segment using the target analysis method to determine a field analysis result of the target log segment;

[0035] The output module is used to integrate the analysis results of all fields, determine the comprehensive analysis results of the target log to be analyzed, and output the analysis report of the target log to be analyzed in combination with a preset template.

[0036] Optionally, the log analysis device further includes a generation module, and the generation module is further used to:

[0037] Get the initial log to be analyzed;

[0038] Identify the project type to which the initial log to be analyzed belongs;

[0039] Determine the target log library corresponding to the initial log to be analyzed according to the project type;

[0040] According to the target preprocessing method corresponding to the target log library, the initial log to be analyzed is processed accordingly to generate a target log to be analyzed.

[0041] Optionally, the generating module is further used for:

[0042] After generating the target log to be analyzed, generating a storage path of the target log to be analyzed in the target log library;

[0043] The target log to be analyzed is saved according to the storage path, and the initial log to be analyzed is stored in a designated location in the target log library.

[0044] Optionally, when the analysis module is used to analyze the corresponding target log segment using the target analysis method to determine the field analysis result of the target log segment, the analysis module is used to:

[0045] Identify whether the target log segment contains encrypted information;

[0046] If so, decrypt the target log segment using the parsing algorithm configured in the target analysis method;

[0047] The target analysis method is used to analyze the decrypted target log segment to determine the field analysis result of the target log segment.

[0048] Optionally, the analysis module is further used for:

[0049] After generating the field analysis results, determine the information presentation method of the field analysis results, and display the field analysis results according to the information presentation method; wherein the information presentation method includes at least one of the following: picture form, text description form, table form, and time point form.

[0050] Optionally, the log analysis device further includes a clearing module, and the clearing module is used to:

[0051] Monitor the logs to be analyzed stored in the log library, and purge the logs to be analyzed that do not meet the requirements according to the preset purge strategy.

[0052] Optionally, the field screening parameters include at least one of the following: project number, start time, end time and analysis target.

[0053] An embodiment of the present application also provides an electronic device, including: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the log analysis method as described above are performed.

[0054] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the log analysis method as described above are executed.

[0055] A log analysis method, device, electronic device and storage medium provided by an embodiment of the present application include: determining at least one target analysis method for analyzing a target log to be analyzed; for each target analysis method, calling the target analysis method through an extensibility interface, and loading field screening parameters required by the target analysis method according to the target log to be analyzed; using the target analysis method after loading the field screening parameters to filter the target log to be analyzed, and determining a target log segment required for analysis by the target analysis method; using the target analysis method to analyze the corresponding target log segment, and determining a field analysis result of the target log segment; combining all field analysis results to determine a comprehensive analysis result of the target log to be analyzed, and outputting an analysis report of the target log to be analyzed in combination with a preset template.

[0056] In this way, this application provides a flexible extensibility interface, so that users can call different target analysis methods according to their needs, making the analysis process more efficient. This interface design supports flexible integration between multiple platforms and enhances cross-platform processing capabilities; the required field screening parameters are loaded according to the log content to achieve accurate data extraction, avoid unnecessary analysis steps, and further improve the analysis efficiency; by filtering and analyzing the target log segment, it is ensured that only key data is analyzed, which improves the processing speed and reduces the waste of computing resources. In addition, through the extensibility interface, different analysis methods can be easily accessed to adapt to different types of log analysis needs, so that this solution has strong flexibility and can customize and expand the analysis function according to needs to adapt to different business scenarios. Furthermore, the results of log analysis are comprehensive, combining various field analysis results, and output reports through preset templates, so that users can quickly obtain a comprehensive and structured log analysis result, further improving the practicality, extensibility and accuracy of the application.

[0057] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 A flow chart of a log analysis method provided in an embodiment of the present application;

[0060] Figure 2 One of the structural schematic diagrams of a log analysis device provided in an embodiment of the present application;

[0061] Figure 3 A second structural diagram of a log analysis device provided in an embodiment of the present application;

[0062] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0063] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0064] In the current product development process of the automotive industry, log analysis is an important tool for problem investigation. Logs play a key role in both the debugging and development stage and the troubleshooting stage. However, due to the high complexity of the vehicle system and the long development cycle, the demand for log analysis has far exceeded the functional scope of traditional software. However, the existing log analysis software faces the problem of insufficient applicability in the automotive industry, as shown below:

[0065] 1. High learning threshold limits usage efficiency: Existing log analysis software is mostly designed for equipment monitoring and abnormal alarms in production environments, with little consideration for development phase requirements. In vehicle product development, the log formats and contents of different functional modules (such as ADAS, IVI, ECU, etc.) vary greatly, and developers often lack familiarity with certain functional modules. Therefore, existing log analysis tools require users to have a high level of domain knowledge and experience in order to accurately extract log information for problem analysis. This high learning threshold has led to a significant decrease in development efficiency, especially when it comes to issues involving the coordination of multiple functions.

[0066] 2. It is difficult to balance information security and integrity: The logs of vehicle systems often contain sensitive information, such as user privacy data or system security keys. In order to meet information security requirements, some logs encrypt sensitive information when they are generated, or even delete it directly. Although this processing method protects data security, it has the following impacts on log analysis: First, existing software lacks the ability to parse encrypted logs and cannot support further fault analysis. Second, directly deleting sensitive information will result in incomplete logs, making problem investigation more difficult and time-consuming.

[0067] 3. Insufficient tool adaptability in multi-party collaboration: In-vehicle product development involves collaboration with multiple upstream and downstream suppliers, and log analysis runs through the entire development chain. However, the log formats and analysis tools generated by different suppliers vary, and existing software lacks cross-platform compatibility, making it difficult to support collaboration between different teams. This further hinders efficient problem investigation and the advancement of development progress.

[0068] In summary, how to meet the log analysis needs in a complex development environment is a technical problem that needs to be solved urgently.

[0069] Based on this, the embodiments of the present application provide a log analysis method, device, electronic device and storage medium, which can effectively improve the efficiency of log analysis and improve cross-platform processing capabilities, thereby shortening vehicle development time.

[0070] See also Figure 1 , Figure 1 A flow chart of a log analysis method provided in an embodiment of the present application. Figure 1 As shown in , the log analysis method provided by the embodiment of the present application includes:

[0071] S101. Obtain a target log to be analyzed, and determine at least one target analysis method for analyzing the target log to be analyzed.

[0072] S102 . For each target analysis method, the target analysis method is called through an extensibility interface, and field screening parameters required by the target analysis method are loaded according to the target log to be analyzed.

[0073] S103: Filter the target log to be analyzed using the target analysis method after loading field screening parameters, and determine the target log segment to be analyzed by the target analysis method.

[0074] S104: Analyze the corresponding target log segment using the target analysis method to determine a field analysis result of the target log segment.

[0075] S105 , synthesizing the analysis results of all fields, determining the comprehensive analysis result of the target log to be analyzed, and outputting the analysis report of the target log to be analyzed in combination with a preset template.

[0076] As for step S101, illustratively, the step includes: acquiring a target log to be analyzed from a specified location, and then determining at least one target analysis method for analyzing the target log to be analyzed according to a corresponding selection strategy.

[0077] Here, the target log to be analyzed may be stored in a local file, a database, a log library, a distributed storage system (such as HDFS) or a cloud platform, etc. The process of obtaining the log can be completed through an interface or data crawling, or can be obtained in response to a user's operation or instruction, which is not limited here.

[0078] When determining the target analysis method according to the corresponding selection strategy, specifically: selecting the most suitable target analysis method according to the type, source and specific requirements of the target log to be analyzed.

[0079] The analysis method is written by corresponding developers to perform target functions, and different developers can write different analysis methods.

[0080] For example, for the target log to be analyzed, when it is necessary to analyze the state, value, abnormality, etc. of a certain function in a specific time period, the corresponding analysis method is called. Among them, the analysis method mainly determines the conditions under which the information is filtered out from the log, and the ini file can be used as a medium.

[0081] Each log to be analyzed may be analyzed using multiple target analysis methods or one analysis method.

[0082] In one implementation provided in the present application, the target log to be analyzed is generated by the following steps:

[0083] S201: Obtain an initial log to be analyzed.

[0084] S202: Identify the project type to which the initial log to be analyzed belongs.

[0085] S203: Determine a target log library corresponding to the initial log to be analyzed according to the project type.

[0086] S204: According to the target preprocessing method corresponding to the target log library, the initial log to be analyzed is processed accordingly to generate a target log to be analyzed.

[0087] With respect to step S201, the initial log to be analyzed may be obtained by sending it through a target person, or may be obtained through file reading, API interface calling, or database query, etc., which is not limited here.

[0088] The format of the initial log to be analyzed may be JSON, CSV, XML, text, etc. The specific format depends on the system and standard of log generation.

[0089] For step S202, the project type is usually defined according to the source, content and application scenario of the log. The identification method can be based on the metadata of the log (such as log file name, file path, timestamp, etc.), or by performing a preliminary analysis of the log content (such as identifying common fields, patterns, etc.) to determine the project type.

[0090] Among them, identifying the project type can be achieved through rules or machine learning models. Rules can be based on keywords or log formats; machine learning models can learn how to identify different project types based on historical log samples.

[0091] With respect to step S203 , the target log library is organized according to different project types and may include multiple databases or storage locations.

[0092] Determining the target log repository can be achieved through configuration tables, mapping rules, or dynamic selection algorithms. For example, the project type and the target log repository can be mapped by reading a configuration file, or the most suitable target log repository can be automatically selected by analyzing the metadata or content of the log.

[0093] For step S204, each log library may have a specific preprocessing method, and the initial log to be analyzed is processed as necessary according to the requirements of the target log library. These preprocessing methods generally include file merging, time calibration, clearing garbled characters, unifying formats, and other preprocessing.

[0094] Through preprocessing, it is ensured that the subsequent analysis of the logs can be carried out accurately and stably.

[0095] For step S204, in one implementation provided in the present application, after generating the target log to be analyzed, the log analysis method further includes: generating a storage path of the target log to be analyzed in the target log library; saving the target log to be analyzed according to the storage path, and storing the initial log to be analyzed at a specified location in the target log library.

[0096] Here, in order to facilitate subsequent retrieval and management, a unique storage path needs to be generated for the target log to be analyzed. For example, the planning of the storage path can be based on the following factors: the project type to which the log belongs, the time period of the log, the source of the log, the unique identifier of the log, etc.

[0097] The initial log to be analyzed and the target log to be analyzed may be stored in different subdirectories so as to distinguish the original data from the preprocessed data.

[0098] With respect to step S102, in this step, the selected target analysis method is loaded into the analysis process through a predefined extensibility interface, and the corresponding field screening parameters are loaded according to the requirements of the target analysis method.

[0099] Here, the extensibility interface can be an API interface, a plug-in mechanism, etc. Each target analysis method will have a corresponding interface implementation that accepts input log data and returns analysis results.

[0100] The field screening parameters include at least one of the following: project number, start time, end time and analysis target.

[0101] It should be noted that logs usually contain a lot of information, but different analysis methods only need to focus on a part of the fields. In this way, the process of loading field screening parameters can dynamically select the required fields based on the needs of the analysis method to avoid unnecessary data processing.

[0102] Regarding step S103, in this step, the target analysis method with loaded field screening parameters is used to filter the target log to be analyzed, and only certain specific log segments are retained, that is, the target log segment to be analyzed by the target analysis method is determined. Different target analysis methods can determine different target log segments.

[0103] Here, when filtering, you can use regular expressions, conditional judgments, etc. to ensure that only log segments that are meaningful for analysis are retained.

[0104] It should be noted that logs often contain different log records, and analysis methods usually only focus on certain specific log segments (such as logs within a specific time range, logs with specific status codes). Therefore, screening is required.

[0105] In step S104, the filtered target log segments are specifically analyzed. Different analysis methods may perform different types of processing on the logs, such as statistics, pattern recognition, trend analysis, and the like.

[0106] The analysis result of each log segment is obtained by calculation or evaluation of specific fields, such as the number of visits, the source of visits, the hot spot distribution of the request path, etc. The analysis result will be saved as field values ​​or statistical data.

[0107] In an implementation manner provided in the present application, the use of the target analysis method to analyze the corresponding target log segment to determine the field analysis result of the target log segment includes:

[0108] S1041. Identify whether there is encryption information in the target log segment.

[0109] S1042: If so, use the parsing algorithm configured in the target analysis method to decrypt the target log segment.

[0110] S1043. Use the target analysis method to analyze the decrypted target log segment to determine a field analysis result of the target log segment.

[0111] With respect to step S1041, when the target log segment includes sensitive words (such as location, vehicle frame code, telephone number, etc.), encryption processing is generally performed, so that encrypted information exists.

[0112] Among them, common forms of encrypted information include: encrypted content is usually binary data or encoded data; logs may contain special identifiers or tags indicating encrypted information.

[0113] For step S1042, for each target analysis method, a corresponding decryption algorithm is usually configured in the target analysis method. Common encryption algorithms may include symmetric encryption (such as AES, DES) and asymmetric encryption (such as RSA). The choice of the parsing algorithm depends on the encryption method and its key management method.

[0114] It should be noted that when configuring the decryption algorithm, you need to ensure that the encryption method used by the target log segment is compatible with the decryption algorithm configured in the target analysis method. For example, if the encryption method uses AES encryption, the corresponding AES decryption algorithm needs to be configured in the target analysis method, and the corresponding key or decryption parameters need to be provided.

[0115] In this way, the encrypted information in the target log segment is decrypted using a suitable decryption algorithm and key. After decryption, the original data will be restored to plain text format. In this way, by calling the decryption algorithm to restore this part of the log, it not only guarantees the need for log information desensitization, but also improves the integrity of the log information, which helps to solve problems with related functions and improve the quality of this part of the function.

[0116] It should be noted that different encryption algorithms can be used for different projects, and corresponding decryption methods can be set in the analysis method.

[0117] For step S1043, after decryption is completed, the corresponding analysis is performed according to the target analysis method to obtain the field analysis result of the target log segment, wherein the field analysis result includes information such as the state, value, and abnormality of a function in a specific time period.

[0118] For step S1043, in an implementation provided in the present application, after generating the field analysis results, the log analysis method further includes: determining the information presentation method of the field analysis results, and displaying the field analysis results according to the information presentation method; wherein the information presentation method includes at least one of the following: picture form, text description form, table form, time point form.

[0119] Here, the specific presentation method can be selected adaptively and is not limited here.

[0120] With respect to step S105, in this step, all the field results obtained by the analysis are summarized and processed, and a log analysis report is generated according to the comprehensive results and a preset template.

[0121] Among them, the report template is usually structured and may include an overview, statistical charts, trend analysis, abnormal prompts, etc., and the report is finally output in PDF, HTML, Excel and other formats for users to view and further process. For example, in the step of generating a report, the application can set the result type generated by the test and allow the result to be selected and output, configure the report cover in the software configuration item, and finally output the log analysis results in the form of a PDF file.

[0122] In addition, in another embodiment provided in the present application, the log analysis method further includes: monitoring the logs to be analyzed stored in the log library, and clearing the logs to be analyzed that do not meet the requirements according to a preset clearing strategy.

[0123] Here, the purge policy is a rule used to determine which logs need to be purged. For example, these rules can be defined based on the following criteria: log expiration time, log content check, log size or frequency, storage space limit, etc.

[0124] It should be noted that for the log library as a whole, users can set the maximum storage space occupied by the log library. When the size of the log library approaches the limit, users will be prompted to clean it up to avoid the log library space being too large and causing the computer to be unable to use normally. At the same time, users can choose to set the automatic log cleaning time. When the log reaches the corresponding retention period, it will be automatically cleaned up. Users can also choose to turn off the automatic clearing function of specified logs individually to avoid the loss of important logs.

[0125] In addition, users can record the content of the problem solved, the time when the problem occurred, the project name, and other information in each log folder, which makes it easier to manage the log library and trace the historical logs to find out what problem was being investigated.

[0126] During the log collection stage, users can drag and drop the compressed log packages or folders that need to be managed and analyzed into the log library, and the software will automatically decompress and store them when it recognizes them as compressed packages.

[0127] In this way, in the multi-group collaborative development and multi-ECU parallel development mode of the vehicle project, when encountering real vehicle multi-module related problems that need to be investigated, it is necessary to organize multi-disciplines and even multi-suppliers to conduct joint investigations. In a considerable part of the scenarios, the developers of module A only need to confirm the status of module B when the problem occurs (such as the power status), but because the developers of group A have a low understanding of the log information or functions of other disciplines, the developers of group B need to take time to confirm. When this problem occurs across suppliers, it will be more complicated. In the actual development process, such more complex problems need to match the free time of both parties to coordinate, which greatly increases the communication cost of problem investigation. However, after the developers configure and use the log analysis software, the problem investigators of group A can parse the logs generated by the program of group B by loading the log analysis method provided by group B, and extract the basic information they want to obtain from it, so as to solve the corresponding problems without the participation of group B in the problem investigation, improve the speed of problem solving and reduce the communication cost. When the log contains sensitive information, such as time information, location information, and identity information in the program log of Group B, the log can be encrypted in the software, and the decryption algorithm is kept by only Group B personnel. The log information marked as encrypted in the log can be decrypted and displayed and analyzed through the log analysis software. In this way, when the log is provided to other personnel for investigation, it not only ensures information security, but also ensures the information integrity of Group B when investigating its own problems. It speeds up the development process and ensures the quality of software products.

[0128] Based on the same inventive concept, a log analysis device corresponding to the log analysis method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned log analysis method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0129] See also Figure 2 , Figure 3 , Figure 2 This is one of the structural schematic diagrams of a log analysis device provided in an embodiment of the present application. Figure 3 This is a second structural diagram of a log analysis device provided in an embodiment of the present application. Figure 2 As shown in , the log analysis device 200 includes:

[0130] The acquisition module 210 is used to acquire a target log to be analyzed and determine at least one target analysis method for analyzing the target log to be analyzed;

[0131] The calling module 220 is used to call the target analysis method through the extensibility interface for each target analysis method, and load the field screening parameters required by the target analysis method according to the target log to be analyzed;

[0132] A filtering module 230 is used to filter the target log to be analyzed by using the target analysis method after loading field screening parameters, and determine the target log segment to be analyzed by the target analysis method;

[0133] An analysis module 240 is used to analyze the corresponding target log segment using the target analysis method to determine a field analysis result of the target log segment;

[0134] The output module 250 is used to integrate all the field analysis results, determine the comprehensive analysis result of the target log to be analyzed, and output the analysis report of the target log to be analyzed in combination with a preset template.

[0135] Optional, such as Figure 3 As shown, the log analysis device 200 further includes a generation module 260, and the generation module 260 is further used for:

[0136] Get the initial log to be analyzed;

[0137] Identify the project type to which the initial log to be analyzed belongs;

[0138] Determine the target log library corresponding to the initial log to be analyzed according to the project type;

[0139] According to the target preprocessing method corresponding to the target log library, the initial log to be analyzed is processed accordingly to generate a target log to be analyzed.

[0140] Optionally, the generating module 260 is further used for:

[0141] After generating the target log to be analyzed, generating a storage path of the target log to be analyzed in the target log library;

[0142] The target log to be analyzed is saved according to the storage path, and the initial log to be analyzed is stored in a designated location in the target log library.

[0143] Optionally, when the analysis module 240 is used to analyze the corresponding target log segment using the target analysis method to determine the field analysis result of the target log segment, the analysis module 240 is used to:

[0144] Identify whether the target log segment contains encrypted information;

[0145] If so, decrypt the target log segment using the parsing algorithm configured in the target analysis method;

[0146] The target analysis method is used to analyze the decrypted target log segment to determine the field analysis result of the target log segment.

[0147] Optionally, the analysis module 240 is further used for:

[0148] After generating the field analysis results, determine the information presentation method of the field analysis results, and display the field analysis results according to the information presentation method; wherein the information presentation method includes at least one of the following: picture form, text description form, table form, and time point form.

[0149] Optionally, the log analysis device 200 further includes a clearing module 270, and the clearing module 270 is used to:

[0150] Monitor the logs to be analyzed stored in the log library, and purge the logs to be analyzed that do not meet the requirements according to the preset purge strategy.

[0151] Optionally, the field screening parameters include at least one of the following: project number, start time, end time and analysis target.

[0152] See also Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4 As shown in , the electronic device 400 includes a processor 410 , a memory 420 and a bus 430 .

[0153] The memory 420 stores machine-readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 via the bus 430. When the machine-readable instructions are executed by the processor 410, the above-mentioned Figure 1 The specific implementation of the steps in the method embodiment shown can be found in the method embodiment, and will not be repeated here.

[0154] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 The specific implementation of the steps in the method embodiment shown can be found in the method embodiment, and will not be repeated here.

[0155] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0156] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0157] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0158] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0159] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0160] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A log analysis method, characterized in that: The log analysis method comprises: Acquire a target log to be analyzed, and determine at least one target analysis method for analyzing the target log to be analyzed; For each target analysis method, the target analysis method is called through the extensibility interface, and the field screening parameters required by the target analysis method are loaded according to the target log to be analyzed; The target analysis method after loading field screening parameters is used to filter the target log to be analyzed, and determine the target log segment to be analyzed by the target analysis method; Analyze the corresponding target log segment using the target analysis method to determine the field analysis result of the target log segment; The comprehensive analysis results of all fields are combined to determine the comprehensive analysis results of the target log to be analyzed, and the analysis report of the target log to be analyzed is output in combination with a preset template.

2. The log analysis method according to claim 1, characterized in that: Generate the target log to be analyzed by following the steps below: Get the initial log to be analyzed; Identify the project type to which the initial log to be analyzed belongs; Determine the target log library corresponding to the initial log to be analyzed according to the project type; According to the target preprocessing method corresponding to the target log library, the initial log to be analyzed is processed accordingly to generate a target log to be analyzed.

3. The log analysis method according to claim 2, characterized in that: After generating the target log to be analyzed, the log analysis method further includes: Generate a storage path of the target log to be analyzed in the target log library; The target log to be analyzed is saved according to the storage path, and the initial log to be analyzed is stored in a designated location in the target log library.

4. The log analysis method according to claim 1, characterized in that: The using the target analysis method to analyze the corresponding target log segment to determine the field analysis result of the target log segment includes: Identify whether the target log segment contains encrypted information; If so, decrypt the target log segment using the parsing algorithm configured in the target analysis method; The target analysis method is used to analyze the decrypted target log segment to determine the field analysis result of the target log segment.

5. The log analysis method according to claim 1, characterized in that: After generating the field analysis result, the log analysis method further includes: Determine an information presentation method for the field analysis result, and display the field analysis result according to the information presentation method; wherein the information presentation method includes at least one of the following: picture form, text description form, table form, and time point form.

6. The log analysis method according to claim 1, characterized in that: The log analysis method further includes: Monitor the logs to be analyzed stored in the log library, and purge the logs to be analyzed that do not meet the requirements according to the preset purge strategy.

7. The log analysis method according to claim 1, characterized in that: The field screening parameters include at least one of the following: project number, start time, end time and analysis target.

8. A log analysis device, characterized in that: The log analysis device comprises: An acquisition module, used to acquire a target log to be analyzed, and determine at least one target analysis method for analyzing the target log to be analyzed; A calling module is used to call each target analysis method through an extensibility interface, and load the field screening parameters required by the target analysis method according to the target log to be analyzed; A filtering module, used to filter the target log to be analyzed by using the target analysis method after loading field screening parameters, and determine the target log segment to be analyzed by the target analysis method; An analysis module is used to analyze the corresponding target log segment using the target analysis method to determine a field analysis result of the target log segment; The output module is used to integrate the analysis results of all fields, determine the comprehensive analysis results of the target log to be analyzed, and output the analysis report of the target log to be analyzed in combination with a preset template.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to execute the steps of the log analysis method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the log analysis method according to any one of claims 1 to 7 are executed.

Images