Log analysis method and device

Abstract

The invention relates to the technical field of log processing, and discloses a log analysis method and device. The method comprises the steps that X logs are selected from N logs, and X annotated logs are obtained; and according to the X annotation logs and the N-X logs, adopting a large language model to obtain an analysis result of the N-X logs. If the number of the candidate to-be-labeled logs in the N-X logs is larger than or equal to a first threshold value, at least one time of circulation is executed, and execution of the ith time of circulation comprises the steps that Mi logs are selected from the candidate to-be-labeled logs in the N-X-MI logs, and Mi labeled logs are obtained; according to the X + MI + Mi annotation logs and the N-X-MI-Mi logs, adopting the large language model to obtain an analysis result of the N-X-MI-Mi logs; if the number of the candidate logs to be labeled in the N-X-MI-Mi logs is smaller than a first threshold value, it is determined that the analysis result of the N-X-MI-Mi logs meets the requirement, and circulation is ended. In this way, the representative logs are selected for multiple rounds, the number of the annotated logs is continuously updated, and the accuracy of log analysis can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of log processing, and in particular to a log parsing method and device. Background Art

[0002] With the rapid development of network technology and the widespread application of the Internet, the traces of the activities of enterprises, organizations and individuals on the Internet have generated a massive amount of log data, which records the relevant content of application operation, user behavior, system security and business processes. Analyzing massive log data can better understand the operation of systems and applications, identify potential risks and problems, and help enterprises improve operational efficiency, optimize business processes and ensure information security.

[0003] Log parsing is the first step in log analysis. It converts raw log data into structured parsing results, which can effectively reduce the complexity of logs and facilitate subsequent analysis. Log data is generated by log statements written by developers in the code, such as Figure 1 As shown in Figure 1, when the program is running, the constant part in the declaration is used to indicate the type of event being recorded and is directly input into the log (i.e., the log template part); the variable part in the declaration is assigned different dynamic values ​​to indicate the specific running status. Since the operation and maintenance personnel responsible for log parsing do not participate in code writing, they can only directly obtain the original log data (such as Figure 1 The original log data) cannot obtain the log statements in the code, making it difficult for the parsing results to meet the requirements.

[0004] At present, log parsing is usually based on large language models. The existing methods based on large language models randomly sample a part of the data for labeling, and only perform one round of labeling at the beginning of the process. However, the data that has been labeled only once has a very limited prompting effect on the large language model, which makes it impossible to fully guide the large language model to parse the logs more accurately.

[0005] Therefore, how to perform log analysis in the face of massive log data still needs further research. Summary of the invention

[0006] The embodiments of the present application provide a log parsing method and device, which expands a single-round annotated log into a multi-round annotated log, and expands a single-round log parsing into a multi-round log parsing, which can effectively improve the traditional single-round parsing that only performs one annotation, and the insufficient number of annotated logs leads to low quality problems in context learning, thereby improving the accuracy of log parsing.

[0007] In a first aspect, an embodiment of the present application provides a log parsing method, the method comprising: selecting X logs from N logs, and obtaining X annotated logs corresponding to the X logs;

[0008] According to the X annotated logs and NX logs other than the X logs in the N logs, a large language model is used to obtain parsing results of the NX logs, and if the number of candidate logs to be annotated in the NX logs is greater than or equal to a first threshold, at least one loop is executed, wherein the step of executing the i-th loop includes:

[0009] If the NXM I The number of candidate logs to be marked in the logs is greater than or equal to the first threshold, then in the NXM I Select M from the candidate logs to be labeled i logs, and obtain the M i M corresponding to the log i annotated logs; among them, M I is the sum of the number of logs selected in the first i-1 cycles, the NXM I The candidate logs to be annotated in the logs are logs whose confidence of the parsing result is less than the second threshold;

[0010] According to X+M I +M i Annotated logs and NXM I -M i logs, using the large language model to obtain the NXM I -M i The parsing results of the logs;

[0011] If the NXM I -M i The number of candidate logs to be marked in the logs is less than the first threshold, then the NXM I -M i The parsing results of the logs meet the requirements and the loop ends; N, X, M I 、M i is a positive integer, and i is an integer greater than or equal to 1.

[0012] The above method is used to expand single-round annotated logs into multiple-round annotated logs, and single-round log parsing is expanded into multiple-round log parsing. In each round, a large language model is used to parse unlabeled logs. Based on the confidence of the parsing results of the large language model, samples that are conducive to improving the parsing quality are selected for manual annotation, added to the annotated logs, and a new round of predictions is performed using the large language model. In the current context of massive log data, the analysis capability of the large language model is enhanced by continuously supplementing the annotated logs in multiple rounds, thereby improving the accuracy of log parsing.

[0013] In an optional embodiment, according to the similarities between the N logs, a first preset algorithm is used to select X logs from the N logs.

[0014] In an optional embodiment, according to the similarity between the N logs, a first preset algorithm is used to select X logs from the N logs, including: selecting the X logs by executing X-1 cycles, wherein the xth cycle includes the following steps: if x is equal to 1, constructing a first similarity matrix according to the first log among the N logs; if x is greater than 1, constructing a first similarity matrix according to the similarity between the x logs, wherein the x logs include the x-1 logs selected in the first x-1 cycles and the first log; obtaining a second similarity matrix corresponding to the Nx logs according to the similarity between any log among the remaining Nx logs of the N logs and the x logs; selecting a second log from the Nx logs, wherein the difference between the determinant of the second similarity matrix corresponding to the second log and the determinant of the first similarity matrix is ​​greater than or equal to the difference between the determinant of the second similarity matrix corresponding to the other logs and the determinant of the first similarity matrix; wherein x=1,2...X-1.

[0015] Using the above method, the X logs selected from N logs are more diverse than randomly selecting X logs from N logs, that is, the similarity between the X logs is the lowest. In this way, the selection of diverse log samples can be maximized, and logs of different templates and formats in the log set can be included in the selected samples as much as possible, thereby providing diverse parsing examples for large models to parse logs and reducing the impact of uneven format and sample distribution in the data set on the selection results.

[0016] In an optional embodiment, the NXM I The number of candidate logs to be labeled in the logs is P. In the NXM I Select M from the candidate logs to be labeled i logs, including: according to the P candidate logs to be labeled and the NXM I The similarity between the logs is calculated by using the second preset algorithm in the NXM I Select M from the candidate logs to be labeled i logs.

[0017] In an optional embodiment, according to the P candidate logs to be annotated and the NXM I The similarity between the logs is calculated by using the second preset algorithm in the NXM I Select M from the candidate logs to be labeled i logs, including:i -1 cycle, select the M i logs, wherein the mth cycle comprises the following steps: if m is equal to 1, then according to the third log in the P candidate logs, in the NXM I logs are selected from the H logs with the highest similarity to the third log to obtain the first log set; if m is greater than 1, for each of the m logs, select the H logs with the highest similarity to the third log from the NXM I logs, select H logs with the highest similarity to the log, and obtain a first log set, wherein the first log set includes the union of the H logs selected for each of the m logs, and the m logs include the m-1 logs selected in the first m-1 cycles and the third log; for each of the Pm logs other than the m logs in the P candidate logs to be labeled, select the logs from the NxM I logs, select H logs with the highest similarity to the log, and obtain a second log set corresponding to Pm logs, where the second log set includes the H logs; select a fourth log from the Pm logs, where the number of logs in the union of the second log set corresponding to the fourth log and the first log set is greater than or equal to the number of logs in the union of the second log set corresponding to other logs and the first log set; where m = 1, 2...M i -1.

[0018] In the above method, since the large language model is used for log parsing, each time a log is parsed, it is necessary to reference the K most similar annotated logs. I The log with the most citations among the unlabeled logs is the most worthy of labeling. I logs, select M from the candidate logs to be annotated i log, M i The number of unlabeled logs contained in the union of the log sets corresponding to the logs referenced is the largest, that is, the M selected using the above method i The maximum coverage of logs is NXM I unlabeled logs, select M i logs are annotated, and based on X annotated logs, M i Annotated logs and NXM I -M i logs, using a large language model can further improve the accuracy of parsing.

[0019] In an optional embodiment, the X annotated logs and NX logs other than the X logs in the N logs are input into a large language model to obtain the parsing results of the NX logs, including: for the jth log in the NX logs, calculating the similarity between the jth log and the X annotated logs, and determining the K annotated logs with the highest similarity among the X annotated logs; K is a positive integer; based on the jth log and the K annotated logs, constructing prompt words, the prompt words include: task instructions, the K annotated logs, labels corresponding to the K annotated logs, and the jth log; according to the prompt words, using the large language model, obtain the parsing results of the jth log. Wherein, the K annotated logs and the corresponding labels in the prompt words are arranged from small to large according to similarity.

[0020] Using the above method, based on X annotated logs, a large language model is used to parse NX logs other than X logs. During the parsing process, for the jth log among the NX logs, K most similar annotated logs and corresponding labels are selected from the X annotated logs, and are input into the large model in the form of prompt words. Since the order of the K most similar annotated logs in the prompt words will affect the result of the final large language model, the present application arranges the K annotated logs and the corresponding labels from small to large according to the similarity, which helps to improve the accuracy of the large language model in parsing the logs.

[0021] In an optional embodiment, when the parsing result of the log does not meet the first condition or the second condition, the confidence of the parsing result of the log is less than a second threshold; the first condition is: the keywords contained in the parsing result of the log are a subset of the log; the second condition is: every keyword in the log appears in the parsing result of the log.

[0022] By adopting the above method, the parsing result of the log is evaluated according to the first condition and the second condition, the confidence of the parsing result of the log is determined, and the logs that need to be marked in the next round can be selected according to the confidence.

[0023] In an optional embodiment, the method further includes: obtaining N original logs; removing numerical terms in the N original logs to obtain the N logs; wherein the numerical terms include at least one of the following: task number, IP address, domain name, data packet size and port number.

[0024] Using the above method, since most of the numerical words in the log are variable parts and do not exist in the template for log parsing, when selecting similar logs in the future, more attention should be paid to the similarity of the constant part. Before calculating the similarity, removing the numerical words (i.e., the variable part) in the original log will help reduce the impact of redundant information on the similarity calculation.

[0025] In an optional embodiment, the method further includes: if the number of candidate logs to be marked in the NX logs is less than the first threshold, determining that the parsing results of the NX logs meet the requirements.

[0026] In a second aspect, an embodiment of the present application provides a log parsing device, the device comprising:

[0027] A labeling module, used for selecting X logs from N logs and obtaining X labeled logs corresponding to the X logs;

[0028] a processing module, configured to obtain parsing results of the NX logs by using a large language model according to the X annotated logs and NX logs other than the X logs in the N logs, and to execute at least one loop if the number of candidate logs to be annotated in the NX logs is greater than or equal to a first threshold, wherein the step of executing the i-th loop includes: if the NXM I The number of candidate logs to be marked in the logs is greater than or equal to the first threshold, then in the NXM I Select M from the candidate logs to be labeled i logs, and obtain the M i M corresponding to the log i annotated logs; among them, M I is the sum of the number of logs selected in the first i-1 cycles, the NXM I The candidate logs to be annotated in the logs are logs whose confidence of the parsing result is less than the second threshold; according to the X+M I +M i Annotated logs and NXM I -M i logs, using the large language model to obtain the NXM I -M i The parsing result of the log; if the NXM I -M i The number of candidate logs to be marked in the logs is less than the first threshold, then the NXM I -M i The parsing results of the logs meet the requirements and the loop ends; N, X, M I 、M i is a positive integer, and i is an integer greater than or equal to 1.

[0029] In an optional embodiment, the labeling module is further configured to select X logs from the N logs by using a first preset algorithm according to similarities between the N logs.

[0030] In an optional embodiment, the labeling module is further used to select the X logs by executing X-1 cycles, wherein the xth cycle includes the following steps: if x is equal to 1, constructing a first similarity matrix according to the first log among the N logs; if x is greater than 1, constructing a first similarity matrix according to the similarity between the x logs, wherein the x logs include the x-1 logs selected in the first x-1 cycles and the first log; obtaining a second similarity matrix corresponding to the Nx logs according to the similarity between any log among the remaining Nx logs among the N logs and the x logs; selecting a second log among the Nx logs, wherein the difference between the determinant of the second similarity matrix corresponding to the second log and the determinant of the first similarity matrix is ​​greater than or equal to the difference between the determinant of the second similarity matrix corresponding to the other logs and the determinant of the first similarity matrix; wherein x=1,2...X-1.

[0031] In an optional embodiment, the processing module is further configured to: I The similarity between the logs is calculated by using the second preset algorithm in the NXM I Select M from the candidate logs to be labeled i logs.

[0032] In an optional embodiment, the processing module is further configured to: i -1 cycle, select the M i logs, wherein the mth cycle comprises the following steps: if m is equal to 1, then according to the third log in the P candidate logs, in the NXM I logs are selected from the H logs with the highest similarity to the third log to obtain the first log set; if m is greater than 1, for each of the m logs, select the H logs with the highest similarity to the third log from the NXM I logs, select H logs with the highest similarity to the log, and obtain a first log set, wherein the first log set includes the union of the H logs selected for each of the m logs, and the m logs include the m-1 logs selected in the first m-1 cycles and the third log; for each of the Pm logs other than the m logs in the P candidate logs to be labeled, select the logs from the NxM Ilogs, select H logs with the highest similarity to the log, and obtain a second log set corresponding to Pm logs, where the second log set includes the H logs; select a fourth log from the Pm logs, where the number of logs in the union of the second log set corresponding to the fourth log and the first log set is greater than or equal to the number of logs in the union of the second log set corresponding to other logs and the first log set; where m = 1, 2...M i -1.

[0033] In an optional embodiment, the processing module is specifically used to, for the jth log among the NX logs, calculate the similarity between the jth log and the X annotated logs, and determine the K annotated logs with the highest similarity among the X annotated logs; construct prompt words based on the jth log and the K annotated logs, and the prompt words include: task instructions, the K annotated logs, labels corresponding to the K annotated logs, and the jth log; according to the prompt words, use the large language model to obtain the parsing result of the jth log. The K annotated logs and the corresponding labels in the prompt words are arranged from small to large according to the similarity.

[0034] In an optional embodiment, when the parsing result of the log does not meet the first condition or the second condition, the confidence of the parsing result of the log is less than a second threshold; the first condition is: the keywords contained in the parsing result of the log are a subset of the log; the second condition is: every keyword in the log appears in the parsing result of the log.

[0035] In an optional embodiment, the device also includes an acquisition module for acquiring N original logs; removing numerical terms in the N original logs to obtain the N logs; wherein the numerical terms include at least one of the following: task number, IP address, domain name, data packet size and port number.

[0036] In an optional embodiment, the processing module is further configured to determine that the parsing results of the NX logs meet the requirement if the number of candidate logs to be marked in the NX logs is less than the first threshold.

[0037] In a third aspect, an embodiment of the present invention provides a log parsing device, comprising: a memory for storing a computer program; and a processor for executing the method described in the first aspect according to the obtained program when executing the computer program stored in the memory.

[0038] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when a computer reads and executes the computer program, the method described in the first aspect above is executed.

[0039] In a fifth aspect, an embodiment of the present invention provides a computer program product. When a computer reads and executes the computer program product, the method described in the first aspect is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0041] Figure 1 A schematic diagram of the log parsing sample provided for this application;

[0042] Figure 2 A scenario diagram of a log parsing method provided in an embodiment of the present application;

[0043] Figure 3 A flowchart corresponding to a log parsing method provided in an embodiment of the present application;

[0044] Figure 4 A flowchart of using a large language model to parse logs provided in an embodiment of the present application;

[0045] Figure 5 A schematic diagram of the prompt words in log parsing provided by this application;

[0046] Figure 6 A flowchart corresponding to a log parsing method provided in an embodiment of the present application;

[0047] Figure 7 A schematic diagram of the structure of a log parsing device provided in an embodiment of the present application;

[0048] Figure 8 A schematic diagram of the structure of a log parsing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] Based on the exemplary embodiments shown in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application. In addition, although the disclosure in this application is introduced according to one or several exemplary examples, it should be understood that each aspect of these disclosures can also constitute a complete technical solution separately.

[0051] It should be understood that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, for example, they can be implemented according to an order other than those given in the diagrams or descriptions of the embodiments of this application.

[0052] With the rapid development of network technology and the widespread application of the Internet, the traces of the activities of enterprises, organizations and individuals on the Internet have generated massive amounts of log data. Log parsing is the first step in log analysis, which converts raw log data into structured parsing results.

[0053] The current log parsing method mainly performs reverse reasoning based on the original log data, and converts the log data into a template by identifying the constant and variable parts in the log for subsequent analysis. There are usually three implementation methods, including implementation method 1, implementation method 2, and implementation method 3.

[0054] Among them, the first implementation method is the rule-based log parsing method, which relies on predefined rules such as manually designed regular expressions, extracts variables in the log based on the log length, starting word, ending word and other features, and saves the rest as constants. However, since the keywords in the log template are usually defined by the developer, it is difficult to cover the current massive log formats if the log is parsed according to the predefined rules.

[0055] Implementation method 2: Log parsing method based on machine learning. This implementation method uses natural language processing technology to first segment the log text and convert it into an identifier sequence. Then, the neural network model is trained with manually annotated data to perform automatic sequence annotation and annotate each identifier as a constant or variable. However, log parsing methods based on machine learning usually require a large number of annotated samples to achieve the expected parsing effect, which is time-consuming and labor-intensive.

[0056] Implementation method three: Based on the contextual learning ability and few-sample learning ability of the large language model, the log parsing instructions, parsing samples and logs to be parsed are input into the large language model as prompt words using the prompt word engineering to identify the constant and variable parts in the logs to be parsed. However, the method based on the large language model usually randomly samples a part of the data for labeling, and only performs one round of labeling in the initial stage. The prompt effect of one round of labeled data on the large model is quite limited, resulting in inaccurate results of the final log parsing. In addition, since the template obtained by parsing only contains the constant part and omits the variable part, similar labeled examples should focus on the similarity of the constant part, and the variable part has no practical meaning in terms of similarity. The existing methods based on the large language model usually also involve the variable part in the vector conversion, which introduces a lot of redundant information and affects the accuracy of the similarity calculation.

[0057] Based on this, an embodiment of the present application provides a log parsing method, which expands a single-round labeled log into a multi-round labeled log, and expands a single-round log parsing to a multi-round log parsing, which can effectively improve the traditional single-round parsing in which only one labeling is performed, and the insufficient number of labeled logs leads to low quality problems in context learning, thereby improving the accuracy of log parsing.

[0058] Exemplarily, an embodiment of the present application provides a log parsing method, the method comprising: selecting X logs from N logs, and obtaining X annotated logs corresponding to the X logs; using a large language model according to the X annotated logs and NX logs other than the X logs in the N logs, obtaining parsing results of the NX logs, if the number of candidate to-be-annotated logs in the NX logs is greater than or equal to a first threshold, executing at least one loop, wherein the step of executing the i-th loop comprises: if the NXM I The number of candidate logs to be marked in the logs is greater than or equal to the first threshold, then in the NXM I Select M from the candidate logs to be labeled i logs, and obtain the M i M corresponding to the log i annotated logs; among them, M I is the sum of the number of logs selected in the first i-1 cycles, the NXM I The candidate logs to be annotated in the logs are logs whose confidence of the parsing result is less than the second threshold; according to the X+M I +M i Annotated logs and NXM I -M i logs, using the large language model to obtain the NXM I -Mi The parsing result of the log; if the NXM I -M i The number of candidate logs to be marked in the logs is less than the first threshold, then the NXM I -M i The parsing results of the logs meet the requirements and the loop ends; N, X, M I 、M i is a positive integer, and i is an integer greater than or equal to 1.

[0059] Figure 2 The schematic diagram of a scenario of a log parsing method provided by an embodiment of the present application is exemplarily shown, and the application scenario includes at least one terminal device 201 and at least one server 202. Among them, the terminal device 201 can be a mobile phone, a tablet computer, a laptop computer, a desktop computer and other devices, but is not limited to this. The user can access various services through the client on the terminal device 201 and generate corresponding network log data. The client can be software (such as a browser, instant messaging software, etc.), or a web page, a small program, etc. The server 202 is used to store the log data generated by the user accessing various services. It can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms. The terminal device 201 and the server 202 can be directly or indirectly connected by wired or wireless communication, and this application is not limited here.

[0060] It should be noted that Figure 2 The figure is only an example. In fact, the number of terminal devices 201 and servers 202 is not limited and is not specifically limited in the embodiments of the present application.

[0061] The method provided in this application is described in detail below with reference to specific embodiments.

[0062] Figure 3 A flow chart corresponding to a log parsing method provided in an embodiment of the present application, the method can be executed by a log parsing device, and the log parsing device can be Figure 2 Any server in at least one server, or an independently deployed device, is not specifically limited, such as Figure 3 As shown, the method includes:

[0063] Step S10: The log analysis device selects X logs from N logs, and obtains X annotated logs corresponding to the X logs.

[0064] Exemplarily, the log parsing device selects X logs from N logs, and the operation and maintenance personnel perform a first round of manual labeling on the X logs to obtain corresponding X labeled logs, and the X labeled logs include X logs and corresponding templates. For example, one of the X logs to be labeled is KILLING attempt_1445144423722_1232_m_000002_0. It can be seen that the 1445144423722_1232_m_000002_0 after KILLING attempt_ is the task number, so the template corresponding to the log is KILLING_attempt_<*>.

[0065] Step S20: The log parsing device uses a large language model based on the X annotated logs and the NX logs to obtain parsing results of the NX logs.

[0066] Specifically, the log parsing device uses a large language model to parse NX logs based on X annotated logs, and obtains parsing results of NX logs. Figure 4 As shown, the jth log (i.e. Figure 4 Taking the log to be parsed in the example, the similarity between the jth log and the X annotated logs is calculated to obtain X similarity values. For example, the cosine similarity can be used to calculate the similarity between the jth log and the X annotated logs, which is not limited here. Then, based on the X similarity values, the K annotated logs with the highest similarity among the X annotated logs are determined.

[0067] Furthermore, based on the jth log and K annotated logs, construct prompt words. Figure 5 As shown in the figure, the prompt words include: task instructions, K annotated logs and the jth log. The top part of the prompt words is the task instruction, the middle part is the sample composed of K annotated logs, and the bottom part is the log to be parsed (i.e. the i-th log). Each sample consists of 1 log and the corresponding template. <start> <end>Two special tags are used to mark the template to enhance the learning of the large language model on the sample. According to the constructed prompt word, the large language model is used to obtain the parsing result of the jth log. In addition, since the order of the samples in the prompt word will affect the result of the language model, the K annotated logs in the prompt word can be arranged from small to large according to the similarity. Among them, the large language model can be the Llama open source large language model or other large language models, which are not limited here.

[0068] Optionally, if the number of candidate logs to be marked in the NX logs is less than a first threshold, it is determined that the parsing results of the NX logs meet the requirement.

[0069] Step S30: If the number of candidate logs to be marked in the NX logs is greater than or equal to the first threshold, the log parsing device executes at least one cycle.

[0070] For example, in the first cycle, M1 logs are selected from the candidate logs to be labeled among the NX logs, and M1 labeled logs corresponding to the M1 logs are obtained.

[0071] Exemplarily, based on the parsing results of the NX logs obtained in step S20, the log parsing device can evaluate the confidence of the parsing results of the NX logs, and then divide the NX logs into two categories according to the confidence, the first category is regarded as the result may be correct, and the second category is regarded as the result must be wrong, and the logs with confidence less than the second threshold in the NX logs are divided into the second category, and the logs with confidence greater than or equal to the second threshold in the NX logs are divided into the first category. Among them, the logs classified into the second category are the candidate logs to be annotated in the NX logs. Since the candidate logs to be annotated in the NX logs are not correctly parsed by the current large language model, the logs to be annotated selected from the candidate logs to be annotated in the NX logs are conducive to improving the accuracy of the parsing results. If the number of candidate logs to be labeled among the NX logs is greater than or equal to the first threshold, M1 logs are selected from the candidate logs to be labeled among the NX logs, and the operation and maintenance personnel perform a second round of manual labeling on the M1 logs to obtain corresponding M1 labeled logs, the M1 labeled logs including M1 logs and corresponding templates. The log parsing device uses a large language model based on the X labeled logs, M1 labeled logs and NX-M1 logs to obtain parsing results of the NX-M1 logs.

[0072] Among them, the log parsing device uses a large language model to obtain parsing results of NX-M1 logs based on X annotated logs, M1 annotated logs and NX-M1 logs. The specific implementation steps are the same as step S20 and will not be repeated here.

[0073] Optionally, if the number of candidate logs to be marked in NX-M1 logs is less than a first threshold, it is determined that the parsing results of the NX-M1 logs meet the requirement, and the loop ends.

[0074] Optionally, if the number of candidate logs to be marked in the NX-M1 logs is greater than the first threshold, a second cycle is executed until the number of NX-M1 candidate logs in the i-th cycle reaches NX-M. I -M i If the number of candidate logs to be marked in the logs is less than the first threshold, the loop ends.

[0075] The execution steps of the i-th cycle include:

[0076] The number of logs selected after the first i-1 cycles is M I , assuming that the number of logs selected in the first cycle is M1, the number of logs selected in the first cycle is M2, ... the number of logs selected in the i-1th cycle is M i-1 , then the number of logs selected after the first i-1 cycles is M I M1+M2+...+M i-1 The number of unmarked logs is NXM. I , if NXM I The number of candidate logs to be marked in the logs is greater than or equal to the first threshold, then in the NXM I Select M from the candidate logs to be labeled i logs and obtain M i M corresponding to the log i Annotated logs, among which NXM I The candidate logs to be annotated in the logs are logs whose confidence of the parsing results is less than the second threshold.

[0077] According to X+M I +M i Annotated logs and NXM I -M i logs, using the large language model to obtain the NXM I -M i The parsing result of the log; if the NXM I -M i The number of candidate logs to be marked in the logs is less than the first threshold, then the NXM I -M i The parsing results of the logs meet the requirements and the loop ends.

[0078] Optionally, since the requirement of log parsing is to convert the original log data into a structured parsing result, including date, time, level, template, variable value, etc. The parsed log will convert the variable part into special symbols and retain the non-variable part. Therefore, it is possible to determine whether the parsing result of the log is wrong by setting the first condition and the second condition. When the parsing result of the log does not meet the first condition or the second condition, it means that the confidence of the parsing result of the log is less than the second threshold, that is, the parsing result of the log is incorrect; when the parsing result of the log meets both the first condition and the second condition, it means that the confidence of the parsing result of the log is greater than or equal to the second threshold, that is, the parsing result of the log is correct.

[0079] The first condition is that the keywords contained in the parsed result of the log are a subset of the log. For example, the log to be parsed is KILLING attempt_1445144423722_0020_m_000001_0, and the parsed result is LAUNCHINGattempt_<*>; it can be seen that the keyword LAUNCHING in the parsed result is not a subset of the log to be parsed. If the parsed result contains keywords other than the log to be parsed, then the parsed result must be inaccurate.

[0080] The second condition is that each keyword in the log appears in the parsing result of the log. If the keyword in the log to be parsed is a constant, it will be retained in the parsing result; if the keyword in the log to be parsed is a variable, it will be replaced by the variable symbol <*> in the parsing result. For example, the log to be parsed is Got allocated containers 2. It can be seen that the keyword Got allocated containers in the log to be parsed is the constant part, and keyword 2 is the variable part. The correct parsing result is Got allocated containers<*>. If the parsing result is Got allocated containers, the parsing result is incomplete.

[0081] Optionally, the probability of keywords appearing in the parsing results output by the large language model is used to calculate the confidence of the parsing results, and logs with low probability of keywords in the parsing results (such as the bottom 50% of the overall parsing results) are used as candidate logs to be annotated in the next round. In this way, some rare parsing errors can be captured, such as the parsing results and the keywords of the logs are consistent, but some constant keywords are identified as variables.

[0082] Optionally, since a large language model is used for log parsing in the above steps, it is necessary to find similar annotated logs of the log to be parsed as samples to assist the large language model in parsing. Constant words in the log usually appear in the template as constant parts, while numerical words are usually variable parts and do not exist in the template. Therefore, when comparing the similarity between the log to be parsed and the annotated log, if the numerical words are not removed and the similarity between the logs is directly calculated, the variable part will affect the selection of similar samples. For example, assuming that the log to be parsed is KILLING attempt_1445144423722_0020_m_000001_0, the similar samples to be found are KILLING attempt_1445144423722_1232_m_000002_0 and the corresponding template. If the numerical words in the log are not removed and the similarity calculation is performed directly, the constant part in the log is too long, and the LAUNCHING_attempt_1445144423722_0020_m_000001_0 will be calculated as a more similar sample, causing the large language model to lack information about the KILLING word, resulting in possible parsing errors. Therefore, before the log parsing device selects M1 logs from N logs, it is necessary to first obtain N original logs and remove the numerical words in the N original logs to obtain N logs, wherein the log parsing device can obtain the original logs generated by users accessing various services from the server, which is not limited here, and the numerical words include at least one of the following: task number, IP address, domain name, data packet size and port number. There are many ways to remove the numerical words in the N original logs, including: method one and method two, wherein method one can be based on regular expression technology, write corresponding regular expressions to identify numerical information and website information; method two can be based on the word vector dictionary of the global word embedding vector (Global Vectors for Word Representation, GLoVE), and remove the words in the log that cannot be matched in the word vector dictionary as irrelevant information. By adopting the above method, the influence of the variable part in the log on the sample selection can be greatly reduced, the influence of redundant information in the similarity calculation is weakened, and it is helpful to select more effective cases.

[0083] Using the above method, such as Figure 6 As shown in the figure, a single round of annotated logs is expanded to multiple rounds of annotated logs, and a single round of log parsing is expanded to multiple rounds of log parsing. In each round, a large language model is used to parse unlabeled logs. Based on the confidence of the parsing results of the large language model, samples that are conducive to improving the parsing quality are selected for manual annotation, added to the annotated logs, and a new round of predictions is performed using the large language model. In the current context of massive log data, the analysis capability of the large language model is enhanced by continuously supplementing the annotated logs in multiple rounds, thereby improving the accuracy of log parsing.

[0084] In an optional implementation manner, in step S10, the log analysis device may select X logs from N logs by using a first preset algorithm to select X logs from N logs according to the similarities between the N logs.

[0085] In an optional embodiment, according to the similarity between the N logs, a first preset algorithm is used to select X logs from the N logs, including: selecting X logs by executing X-1 cycles, wherein the xth cycle includes the following steps: if x is equal to 1, constructing a first similarity matrix according to the first log in the N logs; if x is greater than 1, constructing a first similarity matrix according to the similarity between the x logs, the x logs include the x-1 logs selected in the first x-1 cycles and the first log; obtaining a second similarity matrix corresponding to the Nx logs according to the similarity between any log in the remaining Nx logs and the x logs; selecting a second log from the Nx logs, the difference between the determinant of the second similarity matrix corresponding to the second log and the determinant of the first similarity matrix being greater than or equal to the difference between the determinant of the second similarity matrix corresponding to the other logs and the determinant of the first similarity matrix.

[0086] The specific implementation is as follows:

[0087] Step S10-1, randomly selecting the first log from N logs;

[0088] For example, assuming N = 10,000 logs, X = 100 logs, and to select 100 logs from the 10,000 logs as labeled logs (assuming that the 100 logs constitute set A), first randomly select a log from the 10,000 logs as log a1 (i.e., the first log) and add it to set A.

[0089] Exemplarily, N logs are represented as N feature vectors, and the N logs can be converted into N feature vectors through the LLM2Vec model, and the N feature vectors are used to calculate the similarity between the logs.

[0090] Step S10 - 2 : constructing a first similarity matrix according to the feature vector corresponding to the first log.

[0091] Step S10 - 3 , obtaining a second similarity matrix corresponding to the N-1 logs according to the feature vectors corresponding to the remaining N-1 logs in the N logs and the feature vector corresponding to the log a1 .

[0092] Specifically, the first similarity matrix and the second similarity matrix can be obtained according to formula (1):

[0093] L=F·F T (1)

[0094] Among them, F is the feature matrix composed of log feature vectors. For example, the randomly selected log a1 corresponds to a 1024-dimensional vector. In this case, F is a 1*1024 matrix and a corresponding 1024*1 transposed matrix. The first similarity matrix is ​​calculated by formula (1). Since there is only one log at this time, there is only one element in the first similarity matrix, and the determinant of the first similarity matrix is ​​0. Traverse the remaining 9999 logs, and form a second similarity matrix based on the feature vectors corresponding to the remaining 9999 logs and the feature vector corresponding to log a1. In this case, F is a 2*1024 matrix and a corresponding 1024*2 transposed matrix. The second similarity matrix is ​​calculated by formula (1). The second similarity matrix contains four elements, namely L 11 , L 12 , L 21 and L 22 , due to L 11 Indicates the similarity between log a1 and log a1, L 22 Calculate the similarity between a selected log from the remaining 9999 and itself, so L 11 and L 22 Both are 1, L 12 and L 21 are equal, so the determinant of the second similarity matrix is ​​1-L 12 *L 21 .

[0095] Step S10-4: Select one log from the N-1 logs as log a2 (ie, the second log).

[0096] Specifically, according to formula (2), log a2 is found in the remaining 9999 logs, so that the similarity between log a1 and log a2 is the lowest, that is, more diverse, and log a2 is added to set A. The calculation of formula (2) is as follows:

[0097]

[0098] Among them, det(L A ) is the determinant of the similarity matrix composed of the logs of set A (such as the determinant of the first similarity matrix), det(L A∪j ) is the determinant of the similarity matrix formed by the jth log in the N logs except the logs in the A set and the logs in the A set (such as the determinant of the second similarity matrix). For example, at this time, there is only log a1 in the A set. From the remaining 9999 logs, log a2 is selected to be added to the A set. Here, the difference between the determinant of the second similarity matrix corresponding to log a2 and the determinant of the first similarity matrix is ​​greater than or equal to the difference between the determinant of the second similarity matrix corresponding to other logs and the determinant of the first similarity matrix. At this time, the A set contains two logs, namely log a1 and log a2. The next loop is executed. The latest first similarity matrix is ​​formed based on log a1 and log a2. The above steps are repeated to find a log a3 in the remaining 9998 logs and add it to the A set. The difference between the determinant of the second similarity matrix corresponding to the log and the latest determinant of the first similarity matrix is ​​greater than or equal to the difference between the determinant of the second similarity matrix corresponding to other logs and the latest determinant of the first similarity matrix. The above steps are stopped until the number of logs in the A set reaches X.

[0099] By adopting the above method, X logs selected from N logs by using the first preset algorithm have the lowest similarity compared with X logs randomly selected from N logs. That is to say, the diversity between these X logs is the highest, and diverse annotated log samples are provided for subsequent logs to be parsed as much as possible, reducing the influence of the concentrated format of annotated logs and uneven distribution of samples on the selection of similar cases.

[0100] In an optional implementation, in the i-th cycle, in the NXM I Select M from the candidate logs to be labeled i logs, we can use P candidate logs to be labeled and the NXM I The similarity between the logs is calculated by using the second preset algorithm in NXM I Select M from the candidate logs to be labeled i logs.

[0101] In an optional implementation, according to the P candidate logs to be labeled and the NXM I The similarity between the logs is calculated by using the second preset algorithm in the NXM I Select M from the candidate logs to be labeled i logs, including: i -1 cycle, select the M i logs, wherein the mth cycle comprises the following steps: if m is equal to 1, then according to the third log in the P candidate logs, in the NXM I logs are selected from the H logs with the highest similarity to the third log to obtain the first log set; if m is greater than 1, for each of the m logs, select the H logs with the highest similarity to the third log from the NXM I logs, select H logs with the highest similarity to the log, and obtain a first log set, wherein the first log set includes the union of the H logs selected for each of the m logs, and the m logs include the m-1 logs selected in the first m-1 cycles and the third log; for each of the Pm logs other than the m logs in the P candidate logs to be labeled, select the logs from the NxM I logs to select H logs with the highest similarity to the log, and obtain a second log set corresponding to the Pm logs, where the second log set includes the H logs;

[0102] Select a fourth log from the Pm logs, where the number of logs in the union of the second log set and the first log set corresponding to the fourth log is greater than or equal to the number of logs in the union of the second log set and the first log set corresponding to other logs;

[0103] The specific implementation can be as follows:

[0104] Step S30-1, in NXM I The third log is randomly selected from the P candidate logs to be labeled in the logs.

[0105] Specifically, NXM I logs is the sum of the number of logs selected in the first i-1 cycles, NXM I The P candidate logs to be labeled in the logs are based on NXM I The confidence of the parsing results of the logs is obtained, and NXM I In the analysis results of the logs, the P logs with confidence less than the second threshold are selected as candidate logs to be labeled, and a log is randomly selected from the P candidate logs to be labeled as log b1. For example, based on the above assumption, NXM I =9000 logs, M i =100 logs, NXM I The number of candidate logs to be labeled in the logs is 2000 (i.e., P = 2000). To select 100 logs as labeled logs from the 2000 candidate logs (assuming that these 100 logs constitute a set B), first randomly select a log b1 (i.e., the third log) from the 2000 candidate logs to be labeled and add it to set B.

[0106] Step S30-2, calculate log b1 and NXM I The similarity of logs is calculated based on NXM I The H logs with the highest similarity among the logs are obtained to obtain the first log set corresponding to log b1.

[0107] Specifically, the log parsing device calculates log b1 and NXM I The similarity of each log in the logs is obtained by I Similarity, for NXM I The similarities are sorted, H logs with the highest similarity to log b1 are selected, and the H logs form a first log set (that is, the first log set corresponding to log b1).

[0108] Step S30-3, calculate P-1 logs and NXM except log b1 among the P candidate logs to be annotated I The similarity of the logs is calculated to obtain the second log set corresponding to P-1 logs.

[0109] Specifically, the log parsing device calculates P-1 logs and NXM other than log b1 among the P candidate logs to be annotated. I The similarity of each log in the logs is calculated to obtain the second log set corresponding to the P-1 logs. For example, log b2 (i.e. the fourth log) is one of the P-1 logs. Calculate log b2 and NXM I The similarity of each log in the logs is obtained by I Similarity, for NXM I The similarities are sorted, H logs with the highest similarity to log b2 are selected, and the H logs constitute the second log set corresponding to log b2.

[0110] Step S30 - 4 , select log b2 from the P candidate logs to be annotated except log b1.

[0111] Specifically, according to formula (3), find log b2 from the P-1 logs other than log b1 among the P candidate logs to be annotated, so that the number of logs in the union of the first log set corresponding to log b1 and the second log set corresponding to log b2 is the largest, that is, the log that references the unannotated log the most times, and add log b2 to set B. The calculation of formula (3) is as follows:

[0112]

[0113] Among them, C B is the number of logs in the first log set corresponding to the logs in set B, C B∪l is the number of logs in the union of the second log set and the first log set corresponding to the dth log in the P-1 logs except log b1 among the P candidate logs to be annotated. For example, at this time, there is only log b1 in set B, and the first log set corresponding to log b1 is {y1, y2, y3}. Traverse each log in the 1999 candidate logs to be annotated. Assume that the second log set corresponding to log b2 in the 1999 candidate logs to be annotated is {y3, y4, y5}, and the union of the second log set corresponding to log b2 and the first log set corresponding to log b1 is {y1, y2, y3, y4, y5}. When the number of logs in the union of the second log set corresponding to the selected log b2 and the first log set corresponding to log b1 is greater than or equal to the number of logs in the union of the second log set corresponding to other logs and the first log set, log b2 is added to set B. At this point, set B contains two logs, log b1 and log b2. At this point, the union of the first log set corresponding to log b1 and the second log set corresponding to log b2 (such as {y1, y2, y3, y4, y5}) is the latest first log set. Repeat the above steps to find a new log b3 from the remaining 1998 candidate logs and add it to set B. The number of logs in the union of the second log set corresponding to log b3 and the latest first log set is greater than or equal to the number of logs in the union of the second log set corresponding to other logs and the latest first log set, until the number of logs in set B reaches M. i Stop the above steps.

[0114] By adopting the above method and the second preset algorithm, multiple rounds of log selection are performed among NX logs, and the logs are added to the subsequent large language model for log parsing. Compared with directly annotating the candidate logs to be annotated among the NX logs and adding them to the subsequent large language model for log parsing, the cost of annotating samples is reduced while ensuring the accuracy of the log parsing results.

[0115] Based on the same technical concept, the embodiment of the present application also provides a log parsing device 7000, Figure 7 A schematic diagram of the structure of the log parsing device provided by this magical embodiment, as shown in Figure 7 As shown, the device 7000 includes:

[0116] The marking module 701 is used to select X logs from N logs and obtain X marked logs corresponding to the X logs;

[0117] The processing module 702 is used to obtain parsing results of the NX logs using a large language model according to the X annotated logs and NX logs other than the X logs in the N logs, and if the number of candidate logs to be annotated in the NX logs is greater than or equal to a first threshold, execute at least one loop, wherein the step of executing the i-th loop includes: if the NXM I The number of candidate logs to be marked in the logs is greater than or equal to the first threshold, then in the NXM I Select M from the candidate logs to be labeled i logs, and obtain the M i M corresponding to the log i annotated logs; among them, M I is the sum of the number of logs selected in the first i-1 cycles, the NXM I The candidate logs to be annotated in the logs are logs whose confidence of the parsing result is less than the second threshold; according to the X+M I +M i Annotated logs and NXM I -M i logs, using the large language model to obtain the NXM I -M i The parsing result of the log; if the NXM I -M i The number of candidate logs to be marked in the logs is less than the first threshold, then the NXM I -M i The parsing results of the logs meet the requirements and the loop ends; N, X, M I 、M i is a positive integer, and i is an integer greater than or equal to 1.

[0118] In an optional embodiment, the marking module 701 is further configured to select X logs from the N logs by using a first preset algorithm according to similarities between the N logs.

[0119] In an optional embodiment, the labeling module 701 is further used to select the X logs by executing X-1 cycles, wherein the x-th cycle includes the following steps: if x is equal to 1, constructing a first similarity matrix according to the first log among the N logs; if x is greater than 1, constructing a first similarity matrix according to the similarities between the x logs, wherein the x logs include the x-1 logs selected in the first x-1 cycles and the first log; obtaining a second similarity matrix corresponding to the Nx logs according to the similarity between any log among the remaining Nx logs among the N logs and the x logs; selecting a second log among the Nx logs, wherein the difference between the determinant of the second similarity matrix corresponding to the second log and the determinant of the first similarity matrix is ​​greater than or equal to the difference between the determinant of the second similarity matrix corresponding to the other logs and the determinant of the first similarity matrix; wherein x=1,2...X-1.

[0120] In an optional embodiment, the processing module 702 is further configured to: I The similarity between the logs is calculated by using the second preset algorithm in the NXM I Select M from the candidate logs to be labeled i logs.

[0121] In an optional embodiment, the processing module 702 is further configured to: i -1 cycle, select the M i logs, wherein the mth cycle comprises the following steps: if m is equal to 1, then according to the third log in the P candidate logs, in the NXM I logs are selected from the H logs with the highest similarity to the third log to obtain the first log set; if m is greater than 1, for each of the m logs, select the H logs with the highest similarity to the third log from the NXM I logs, select H logs with the highest similarity to the log, and obtain a first log set, wherein the first log set includes the union of the H logs selected for each of the m logs, and the m logs include the m-1 logs selected in the first m-1 cycles and the third log; for each of the Pm logs other than the m logs in the P candidate logs to be labeled, select the logs from the NxM I logs, select H logs with the highest similarity to the log, and obtain a second log set corresponding to Pm logs, where the second log set includes the H logs; select a fourth log from the Pm logs, where the number of logs in the union of the second log set corresponding to the fourth log and the first log set is greater than or equal to the number of logs in the union of the second log set corresponding to other logs and the first log set; where m = 1, 2...M i -1.

[0122] In an optional embodiment, the processing module 702 is specifically used to, for the jth log among the NX logs, calculate the similarity between the jth log and the X annotated logs, and determine the K annotated logs with the highest similarity among the X annotated logs; construct prompt words based on the jth log and the K annotated logs, and the prompt words include: task instructions, the K annotated logs, labels corresponding to the K annotated logs, and the jth log; according to the prompt words, use the large language model to obtain the parsing result of the jth log. The K annotated logs and the corresponding labels in the prompt words are arranged from small to large according to the similarity.

[0123] In an optional embodiment, when the parsing result of the log does not meet the first condition or the second condition, the confidence of the parsing result of the log is less than a second threshold; the first condition is: the keywords contained in the parsing result of the log are a subset of the log; the second condition is: every keyword in the log appears in the parsing result of the log.

[0124] In an optional embodiment, the device also includes an acquisition module 704, which is used to obtain N original logs; remove the numerical terms in the N original logs to obtain the N logs; wherein the numerical terms include at least one of the following: task number, IP address, domain name, data packet size and port number.

[0125] In an optional embodiment, the processing module 702 is further configured to determine that the parsing results of the NX logs meet the requirement if the number of candidate logs to be marked in the NX logs is less than the first threshold.

[0126] Based on the same technical concept, Figure 8 A schematic diagram of the structure of a device 8000 provided in an embodiment of the present application is shown in FIG. Figure 8 As shown, the device 8000 includes at least one processor 801 and a memory 802 connected to the at least one processor 801. The specific connection medium between the processor 801 and the memory 802 is not limited in the embodiment of the present application. Figure 8 For example, the processor 801 and the memory 802 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc. In the embodiment of the present invention, the memory 802 stores instructions that can be executed by at least one processor 801, and the at least one processor 801 can implement the steps of the above log parsing method by executing the instructions stored in the memory 802.

[0127] The processor 801 is the control center of the computer device, and can use various interfaces and lines to connect various parts of the computer device, and perform resource settings by running or executing instructions stored in the memory 802 and calling data stored in the memory 802. Optionally, the processor 801 may include one or more processing units, and the processor 801 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 801. In some embodiments, the processor 801 and the memory 802 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0128] Processor 801 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0129] The memory 802 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 802 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (RAM), a static random access memory (SRAM), a programmable read-only memory (PROM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic memory, a disk, an optical disk, and the like. The memory 802 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 802 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0130] Based on the same technical concept, an embodiment of the present invention provides a computer-readable storage medium, in which a computer program is stored, and the computer program is executed by a processor to implement the above log parsing method.

[0131] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0132] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0133] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0134] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0135] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.< / end> < / start>

Claims

1. A log parsing method, characterized in that: The method comprises: Select X logs from N logs, and obtain X annotated logs corresponding to the X logs; According to the X annotated logs and NX logs other than the X logs in the N logs, a large language model is used to obtain parsing results of the NX logs, and if the number of candidate logs to be annotated in the NX logs is greater than or equal to a first threshold, at least one loop is executed, wherein the step of executing the i-th loop includes: If the NXM I The number of candidate logs to be marked in the logs is greater than or equal to the first threshold, then in the NXM I Select M from the candidate logs to be labeled i logs, and obtain the M i The log corresponding to M i annotated logs; among them, M I is the sum of the number of logs selected in the first i-1 cycles, the NXM I The candidate logs to be annotated in the logs are logs whose confidence of the parsing result is less than the second threshold; According to X+M I +M i Annotated logs and NXM I -M i logs, using the large language model to obtain the NXM I -M i The parsing results of the logs; If the NXM I -M i The number of candidate logs to be marked in the logs is less than the first threshold, then the NXM I -M i The parsing results of the logs meet the requirements and the loop ends; N, X, M I 、M i is a positive integer, and i is an integer greater than or equal to 1.

2. The method according to claim 1, characterized in that Select X logs out of N logs, including: According to the similarities between the N logs, X logs are selected from the N logs by using a first preset algorithm.

3. The method according to claim 2, characterized in that According to the similarities between the N logs, selecting X logs from the N logs using a first preset algorithm includes: The X logs are selected by executing X-1 cycles, wherein the xth cycle includes the following steps: If x is equal to 1, construct a first similarity matrix based on the first log among the N logs; if x is greater than 1, construct a first similarity matrix based on the similarities between x logs, where the x logs include the x-1 logs selected in the first x-1 cycles and the first log; According to the similarity between any log among the remaining Nx logs of the N logs and the x logs, a second similarity matrix corresponding to the Nx logs is obtained; A second log is selected from the Nx logs, wherein a difference between a determinant of a second similarity matrix corresponding to the second log and a determinant of the first similarity matrix is ​​greater than or equal to a difference between a determinant of a second similarity matrix corresponding to other logs and a determinant of the first similarity matrix; wherein x=1,2...X-1.

4. The method according to claim 1, characterized in that The NXM I The number of candidate logs to be labeled in the logs is P. In the NXM I Select M from the candidate logs to be labeled i logs, including: According to the P candidate logs to be labeled and the NXM I The similarity between the logs is calculated by using the second preset algorithm in the NXM I Select M from the candidate logs to be labeled i logs.

5. The method according to claim 1, characterized in that According to the P candidate logs to be labeled and the NXM I The similarity between the logs is calculated by using the second preset algorithm in the NXM I Select M from the candidate logs to be labeled i logs, including: By executing M i -1 cycle, select the M i logs, where the mth loop includes the following steps: If m is equal to 1, then according to the third log in the P candidate logs, in the NXM I logs are selected from the H logs with the highest similarity to the third log to obtain the first log set; if m is greater than 1, for each of the m logs, select the H logs with the highest similarity to the third log from the NXM I logs, and select H logs with the highest similarity to the log, to obtain a first log set, wherein the first log set includes a union of the H logs selected for each of the m logs, and the m logs include the m-1 logs selected in the first m-1 cycles and the third log; For each log in the Pm logs other than the m logs in the P candidate logs to be annotated, from the NXM I logs to select H logs with the highest similarity to the log, and obtain a second log set corresponding to the Pm logs, where the second log set includes the H logs; Select a fourth log from the Pm logs, the number of logs in the union of the second log set and the first log set corresponding to the fourth log is greater than or equal to the number of logs in the union of the second log set and the first log set corresponding to other logs; wherein m=1,2...M i -1.

6. The method according to claim 1, characterized in that Inputting the X annotated logs and NX logs other than the X logs in the N logs into the large language model, and obtaining parsing results of the NX logs, including: For the jth log among the NX logs, calculate the similarity between the jth log and the X annotated logs, and determine K annotated logs with the highest similarity among the X annotated logs; K is a positive integer; Based on the j-th log and the K annotated logs, construct a prompt word, the prompt word including: task instructions, the K annotated logs and the j-th log; According to the prompt word, the large language model is used to obtain the parsing result of the j-th log; The K annotated logs in the prompt word are arranged in ascending order according to similarity.

7. The method according to claim 1, characterized in that When the parsing result of the log does not meet the first condition or the second condition, the confidence of the parsing result of the log is less than a second threshold; The first condition is that the keywords included in the parsing result of the log are a subset of the log; The second condition is that each keyword in the log appears in the parsed result of the log.

8. The method according to claim 1, characterized in that The method further comprises: Get N original logs; The N logs are obtained by removing the numerical terms in the N original logs; wherein the numerical terms include at least one of the following: task number, IP address, domain name, data packet size and port number.

9. The method according to any one of claims 1 to 8, characterized in that The method further comprises: If the number of candidate logs to be marked in the NX logs is less than the first threshold, it is determined that the parsing results of the NX logs meet the requirement.

10. A log analysis device, characterized in that: The device comprises: A labeling module, used for selecting X logs from N logs and obtaining X labeled logs corresponding to the X logs; a processing module, configured to obtain parsing results of the NX logs by using a large language model according to the X annotated logs and NX logs other than the X logs in the N logs, and to execute at least one loop if the number of candidate logs to be annotated in the NX logs is greater than or equal to a first threshold, wherein the step of executing the i-th loop includes: if the NXM I The number of candidate logs to be marked in the logs is greater than or equal to the first threshold, then in the NXM I Select M from the candidate logs to be labeled i logs, and obtain the M i The log corresponding to M i annotated logs; among them, M I is the sum of the number of logs selected in the first i-1 cycles, the NXM I The candidate logs to be annotated in the logs are logs whose confidence of the parsing result is less than the second threshold; according to the X+M I +M i Annotated logs and NXM I -M i logs, using the large language model to obtain the NXM I -M i The parsing result of the log; if the NXM I -M i The number of candidate logs to be marked in the logs is less than the first threshold, then the NXM I -M i The parsing results of the logs meet the requirements and the loop ends; N, X, M I 、M i is a positive integer, and i is an integer greater than or equal to 1.

11. A log analysis device, characterized in that: The device comprises: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in any one of the methods of claims 1-9 according to the obtained program instructions.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a computer, the method according to any one of claims 1 to 9 is executed.

Images