Intelligent log retrieval and analysis system based on model context protocol (MCP)

Abstract

The invention discloses an intelligent log retrieval and analysis system based on a model context protocol MCP, and relates to the technical field of log analysis. The system comprises an MCP log semantic conversion and retrieval engine, a log format irrelevant feature extraction and indexer, a dynamic log format recognition and context enhancement system, a real-time retrieval analysis and aggregation controller and a multi-level semantic retrieval and visualization engine. According to the context enhancement system, unknown formats can be identified, semantic tags can be complemented, and semantic consistency and behavior tracking capability can be improved. The retrieval analysis controller supports semantic expression analysis, strategy generation and feedback closed loop, and strategy scheduling and multi-dimensional aggregation analysis are achieved. And finally, outputting a structured semantic result by the system, and visually displaying the structured semantic result through components such as a semantic composition device and a context expander. All the modules are managed in a unified mode through a capability registration mechanism, dynamic arrangement and upstream and downstream closed-loop linkage are supported, and a log intelligent analysis framework with high semantic driving and a clear structure is formed.

Description

Technical Field

[0001] This invention belongs to the field of log analysis technology, and in particular relates to an intelligent log retrieval and analysis system based on the Model Context Protocol (MCP). Background Technology

[0002] Current mainstream log analysis tools still rely on static rules, keyword matching, or shallow statistical models, making it difficult to cope with the challenges brought by diverse log formats, semantic ambiguity, and dynamic changes in business context. Traditional solutions lack cross-module and cross-system context modeling capabilities, resulting in low accuracy in anomaly localization and problem tracing, heavy reliance on human experience, and consequently, low analysis efficiency and a high false positive rate.

[0003] MCP (Model Context Protocol) was originally used for context-aware communication in model services, providing a standardized mechanism for capability declaration, state transfer, and context organization. With the introduction of the MCP protocol, log analysis systems can transfer rich context states between multiple modules, construct a unified semantic space, and achieve inter-module capability collaboration, data sharing, and dynamic task scheduling, thereby effectively improving the accuracy of intelligent log retrieval and the system's adaptability.

[0004] This invention is based on the context organization capabilities of MCP, breaking through the limitations of existing technologies such as log format binding, fragmented processing, and limited retrieval capabilities, and constructing a new generation of intelligent log analysis architecture with adaptive, context-enhanced, and semantic aggregation capabilities. Summary of the Invention

[0005] This invention provides a log intelligent retrieval and analysis system based on the Model Context Protocol (MCP). A semantic transformation engine extracts semantic features and models the context of logs, constructing unified structured tags for multi-round semantic retrieval matching. Subsequently, a format-independent feature extractor abstracts the logs and constructs a semantic index, adapting to multi-source heterogeneous data. A context enhancement system can identify unknown formats and complete semantic tags, improving semantic consistency and behavior tracking capabilities. The retrieval and analysis controller supports semantic expression parsing, strategy generation, and feedback loops, enabling strategy scheduling and multi-dimensional aggregation analysis. Finally, the system outputs structured semantic results and visualizes them through components such as a semantic grapher and a context expander. All modules are uniformly managed through a capability registration mechanism, supporting dynamic orchestration and upstream / downstream closed-loop linkage, forming a highly semantically driven and structurally clear log intelligent analysis architecture; thus, it solves the problems in the background technology.

[0006] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution:

[0007] This invention relates to a log intelligent retrieval and analysis system based on the Model Context Protocol (MCP). The modules communicate via standardized JSON format to ensure interface consistency and interoperability. Module A outputs preliminary retrieval results in JSON format, which are then passed to module B. This JSON format includes semantic tags (ctx_protocol, ctx_action, ctx_state) and matching information, providing structured input for subsequent index construction. Module B generates semantic index data in JSON format, containing the inverted index structure and field mapping relationships. This data is then passed to module C for context enhancement processing. Module C outputs context enhancement data, including completed semantic tags and cross-format alignment relationships. This JSON format is then passed to module D for policy execution. Module D's aggregated analysis results, including policy execution results and performance feedback, are then passed to module E in JSON format for visualization.

[0008] The system also establishes a feedback-driven adaptive closed-loop mechanism: Module E collects user-annotated feedback and performance metrics, and sends them back to Module D in JSON format; Module D generates strategy adjustment suggestions based on the feedback, including parameter updates and rule optimization information, and passes them to Module B in JSON format; Module B generates index update instructions based on the adjustment suggestions, including field change and rebuild instructions, and passes them to Module A in JSON format. This closed-loop mechanism ensures that the system can continuously optimize based on actual usage effects, achieving dynamic adaptive capabilities.

[0009] During system initialization, each module completes capability registration, capability list generation, and standard interface exposure through the MCP interface to ensure interoperability and dynamic capability discovery between subsequent modules. The system initialization and capability registration process includes three steps: module capability registration, capability list generation, and interface exposure.

[0010] System initialization data flow: Each module first registers its capabilities, outputting an MCP capability description (JSON format, including mcp_id, name, and description) to the capability list generation step. The capability list generation step integrates the capability definitions of all modules, outputting a unified capability list (JSON format, containing all module capability definitions) to the interface exposure step. The interface exposure step generates standardized interface definitions and outputs standard interface exposures (JSON format, including inputSchema and outputSchema), ensuring interoperability and dynamic capability discovery between modules. This data flow establishes the system's basic communication framework, providing standardized interfaces for subsequent data transmission and control flow.

[0011] The retrieval scheduling and multi-round analysis closed-loop process is as follows: The system first receives the user's query expression (string format, such as 'ctx_action==login'), and generates module call instructions (JSON format, containing the scheduling sequence from module A to module E) through the retrieval expression parsing step. The module scheduling step executes multi-module coordinated calls and outputs aggregated context data (JSON format, containing the context state of multi-round retrieval) to the context aggregation step. The context aggregation step integrates the multi-round retrieval results and outputs the strategy execution results (JSON format, containing aggregation analysis and feedback data) to the dynamic strategy step. The dynamic strategy step performs strategy analysis and feedback processing, and outputs visualized output results (JSON format, containing graphs and multi-dimensional analysis views) to the result output step. Simultaneously, the system establishes a feedback loop; user feedback on the visualized results (JSON format, containing annotations and performance evaluations) will re-trigger retrieval expression parsing, achieving continuous optimization. This closed-loop process ensures the system's multi-round retrieval capabilities and adaptive optimization mechanism.

[0012] Module A (MCP Log Semantic Transformation and Retrieval Engine) is responsible for receiving raw log data streams and performing format-independent semantic feature extraction. Internally, the module includes a log semantic feature extractor and a context model generator to extract semantic units from the raw data and generate structured context labels. This module also supports parsing semantic retrieval expressions and matching them with the context semantic space, outputting preliminary candidate results as input for subsequent indexing and analysis.

[0013] The log semantic feature extractor (A.1) employs a multi-level semantic parsing algorithm. First, it identifies predefined patterns using a log template matcher, then utilizes natural language processing techniques for word segmentation, part-of-speech tagging, and entity recognition. For logs with unknown formats, the system recommends using an attention-based sequence labeling model for dynamic semantic extraction. The semantic unit recognition process includes: protocol type recognition (e.g., HTTP, HTTPS, DNS), operation behavior recognition (e.g., login, logout, query), and status identifier recognition (e.g., success, failure, pending). Key parameter configurations include the semantic similarity threshold (recommended value 0.75), entity confidence threshold (recommended value 0.8), and maximum sequence length (recommended value 512).

[0014] The context model generator (A.2) generates structured labels based on semantic feature extraction results through a context association rule engine. The context label generation logic includes: static label mapping based on log templates, dynamic context inference based on time series, and semantic completion based on association rules. The system preferably adopts a graph neural network-based context modeling method, using log events as nodes and relationships between events as edges to construct a dynamic context graph. The context label generation process follows the MCP protocol specification, generating standardized label fields such as ctx_protocol, ctx_action, and ctx_state. Key configuration parameters include the context window size (recommended value 10), the association threshold (recommended value 0.6), and the label update frequency (recommended value 1 second).

[0015] The semantic retrieval expression parser (A.3) is responsible for parsing the semantic retrieval expression input by the user and converting it into an executable query plan. The parsing process includes three steps: syntax analysis, semantic validation, and query optimization. The system supports both natural language queries and structured queries as input formats, and it is recommended to use a Transformer-based query understanding model for semantic parsing. The query optimizer generates the optimal retrieval path based on the structural features of the context semantic space. Key parameters include the query complexity threshold (recommended value 100), parsing timeout (recommended value 5 seconds), and cache hit rate threshold (recommended value 0.8).

[0016] The context semantic space matcher (A.4) performs matching operations between the retrieval expression and the context semantic space, outputting preliminary candidate results. The matching algorithm employs multi-dimensional similarity calculation, including semantic similarity, temporal similarity, and structural similarity. The system preferentially uses a semantic matching method based on a vector space model, combined with an attention mechanism for accurate matching. Matching results are sorted by relevance score, supporting pagination and result filtering. Key configuration parameters include the matching threshold (recommended value 0.7), the maximum number of returned results (recommended value 1000), and the matching timeout (recommended value 3 seconds).

[0017] The internal data flow of Module A is as follows: The log semantic feature extractor (A.1) receives raw log data (JSON format, containing fields such as timestamp and source_ip), extracts semantic features through a multi-level semantic parsing algorithm, and outputs a semantic feature vector (JSON format, containing labels such as ctx_protocol and ctx_action) which is then passed to the context model generator (A.2). The context model generator generates structured context labels based on the semantic features and outputs a parsed query plan (JSON format, containing a syntax tree and optimization strategies) which is then passed to the semantic retrieval expression parser (A.3). The semantic retrieval expression parser parses the user query and generates a query plan, outputting preliminary search results (JSON format, containing matching degree and candidate list) which are then passed to the context semantic space matcher (A.4). The context semantic space matcher performs the final matching operation and outputs preliminary search results in JSON format containing semantic labels and matching degrees, which serve as input to Module B. This data flow ensures a complete transformation process from raw logs to structured semantic results.

[0018] Module B (Log Format Independent Feature Extractor and Indexer) primarily receives the semantic results output from Module A, normalizes the structural features of the log content, and constructs a unified semantic index. The module structure includes a format recognizer, a structural feature generator, and an index publisher, supporting cross-format log structural abstraction and unified index publishing. The indexed results will be used by downstream modules for fast retrieval and context enhancement.

[0019] The format recognizer (B.1) employs a multi-level format recognition algorithm. First, it identifies predefined log patterns using a regular expression matcher. Then, it utilizes an attention-based sequence classification model to identify unknown formats. For structured logs, the system recommends using a template-based clustering algorithm, automatically discovering log templates through log line similarity calculation. The format recognition process includes: delimiter recognition, field boundary detection, data type inference, and format pattern extraction. Key parameter configurations include the similarity threshold (recommended value 0.8), minimum template frequency (recommended value 10), and maximum number of fields (recommended value 50).

[0020] The structural feature generator (B.2) transforms heterogeneous logs into a unified structured representation based on format recognition results through a feature vectorization engine. The normalization method employs a word embedding-based feature vector model, mapping log fields to high-dimensional semantic vectors. The system preferably uses a Transformer-based sequence encoder for feature extraction, combining positional encoding and attention mechanisms to capture inter-field dependencies. The feature vectorization process includes: field segmentation, word vector mapping, sequence encoding, and feature aggregation. Key configuration parameters include vector dimension (recommended value 768), maximum sequence length (recommended value 256), and number of attention heads (recommended value 12).

[0021] To achieve format-independent semantic feature extraction, this component employs feature abstraction and transfer learning techniques. Feature abstraction automatically captures inter-field dependencies through unified word segmentation, word vector mapping, and sequence encoding, achieving cross-format high-dimensional semantic vector normalization. For novel or unknown log formats, it is recommended to use pre-trained semantic models (such as BERT, word2vec, etc.) for feature transfer, transferring semantic knowledge from existing domains to new log scenarios and improving adaptability to heterogeneous logs. The system supports scenario-adaptive optimization of the pre-trained model through a fine-tuning mechanism, ensuring that semantic features under different log formats can be aligned within a unified space.

[0022] The index publisher (B.3) is responsible for building the inverted index structure, supporting fast semantic retrieval. The inverted index construction employs a field-mapping-based tokenization strategy, mapping log attributes to standard index fields. Index field mapping rules include: time fields mapped to timestamp indexes, IP fields mapped to geolocation indexes, protocol fields mapped to category indexes, and behavioral fields mapped to semantic indexes. The system supports dynamic index updates and incremental index construction, using an LSM tree-based storage structure to improve write performance. Key parameters include the number of index shards (recommended value 16), cache size (recommended value 1GB), and refresh interval (recommended value 1 second).

[0023] The workflow of Module B is as follows: The format recognizer (B.1) receives the preliminary search results (JSON format, including semantic tags and matching scores) from Module A, identifies log format patterns through a multi-level format recognition algorithm, and outputs a normalized feature vector (JSON format, containing a 768-dimensional semantic vector) to the structure feature generator (B.2). Based on the format recognition results, the structure feature generator converts heterogeneous logs into a unified structured representation through a feature vectorization engine, outputting semantic index data (JSON format, including inverted index and field mappings) to the index publisher (B.3). The index publisher constructs the inverted index structure and publishes the index, outputting JSON format semantic index data containing the inverted index and field mappings as input to Module C. This data flow realizes the transformation from semantic results to a unified index structure, providing a foundation for subsequent context enhancement.

[0024] Module C (Dynamic Log Format Recognition and Context Enhancement System) receives the index structure output by Module B, identifies unknown log formats, and enhances the context labels. The module structure includes a semantic pattern learner and a context aligner, enabling dynamic generation of semantic completion labels and achieving cross-source log semantic consistency completion. The enhanced results output by this module serve as the base context for subsequent multi-round retrieval and strategy execution.

[0025] The semantic pattern learner (C.1) employs an incremental learning mechanism, automatically discovering semantic patterns in logs through frequent itemset mining and sequence pattern recognition algorithms. The learning process includes four steps: sample data preprocessing, feature extraction, pattern mining, and model training. In the sample data preprocessing stage, the raw logs are cleaned, standardized, and labeled. The feature extraction stage uses a vectorization method based on Term Frequency-Inverse Document Frequency (TF-IDF). In the pattern mining stage, it is recommended to use frequent itemset mining based on the Apriori algorithm, combined with sequence pattern recognition based on PrefixSpan, to automatically discover behavioral patterns and association rules in the logs. In the model training stage, a support vector machine (SVM)-based classifier is used for pattern classification. Key training parameters include the support threshold (recommended value 0.1), confidence threshold (recommended value 0.8), and minimum pattern length (recommended value 3).

[0026] The context aligner (C.2) handles semantic consistency alignment across log formats, employing a hybrid algorithm based on semantic similarity calculation and knowledge graph alignment. The alignment algorithm consists of three stages: feature matching, semantic mapping matrix construction, and alignment result verification. The feature matching stage identifies potential correspondences by calculating the semantic similarity between log fields. The semantic mapping matrix construction stage uses an attention-based neural network model to learn the semantic mapping relationships between log formats. The system preferably uses a graph neural network-based semantic alignment method, treating log formats as nodes and semantic relationships as edges to construct a dynamic alignment graph. The alignment result verification stage ensures alignment accuracy through cross-validation and expert feedback mechanisms. Key configuration parameters include a similarity threshold (recommended value 0.7), an alignment confidence threshold (recommended value 0.85), and a maximum number of iterations (recommended value 100).

[0027] The adaptive learning data flow of Module C: The semantic pattern learner (C.1) receives semantic index data (JSON format, including inverted index and field mapping) output by Module B, automatically discovers semantic patterns in the logs through an incremental learning mechanism, and outputs context enhancement data (JSON format, including completion tags and alignment relationships) to the context aligner (C.2). The context aligner handles semantic consistency alignment across log formats and outputs context enhancement data in JSON format, including completion tags and alignment relationships, as input to Module D. Simultaneously, the context aligner establishes a learning feedback loop, feeding back newly discovered semantic patterns as pattern update instructions (JSON format, including newly discovered semantic patterns) to the semantic pattern learner, achieving continuous learning and pattern library updates. This data flow ensures dynamic recognition and semantic completion capabilities for unknown log formats.

[0028] Module D (Real-time Retrieval Analysis and Aggregation Controller), based on the context structure output by Module C, is responsible for executing retrieval scheduling, strategy aggregation, and feedback control. Its scheduling and control flow supports closed-loop execution from semantic expression parsing, module scheduling, aggregation strategy generation to feedback processing. This module provides capabilities such as retrieval round management, aggregation strategy assembly, and dynamic adjustment, serving as the control center for the system's closed-loop intelligent analysis. The system's closed-loop retrieval process begins with user expression input, sequentially scheduling modules A through D to perform semantic matching, context enhancement, and strategy analysis, ultimately outputting structured results and generating a visual view, completing the closed-loop process from input to feedback. Its multi-round analysis closed-loop process includes five steps: retrieval expression parsing, module scheduling, context aggregation, dynamic strategy execution, and result output.

[0029] The semantic expression parser (D.1) employs a syntax tree-based parsing engine architecture. It is recommended to use the ANTLR tool to generate the parser, supporting context-aware semantic expression parsing. The parsing process includes four stages: lexical analysis, syntax analysis, semantic validation, and query optimization. The lexical analysis stage decomposes the semantic expression (e.g., "ctx_action == 'login'") into lexical units; the syntax analysis stage constructs an abstract syntax tree (AST); the semantic validation stage checks field existence and type matching; and the query optimization stage generates the optimal execution plan. The system supports complex expression parsing, including logical operators (AND, OR, NOT), comparison operators (==, !=, >, <, in), and function calls (count, distinct, sum). Key configuration parameters include parsing timeout (recommended value: 5 seconds), maximum expression complexity (recommended value: 100), and cache size (recommended value: 1000).

[0030] The aggregation strategy dynamic adjuster (D.2) is responsible for dynamically adjusting the aggregation strategy parameters based on feedback results, employing a feedback-based weight update algorithm. The adjustment mechanism is based on the mathematical model: New Threshold = Original Threshold + α × (Target Precision - Current Precision) × Learning Rate, where α is the adjustment coefficient and the learning rate is an adaptive parameter. When the false positive rate exceeds the threshold, the system automatically triggers the strategy adjustment process: first, the adjustment magnitude is calculated; then, relevant parameters are updated; and finally, the adjustment effect is verified. The specific process for strategy parameter adjustment includes five steps: feedback data collection, performance indicator calculation, adjustment magnitude determination, parameter update execution, and effect verification. The system preferably uses an adaptive adjustment method based on reinforcement learning, optimizing the strategy parameters through a reward function. Key configuration parameters include the adjustment trigger threshold (recommended value 0.1), the learning rate (recommended value 0.01), and the maximum adjustment magnitude (recommended value 0.5).

[0031] The retrieval scheduling controller (D.3) is responsible for coordinating the execution order and data flow of modules A through D, supporting multi-round retrieval and context state maintenance. The scheduling strategy employs priority-based task queue management, supporting dynamic adjustment of task priorities and resource allocation optimization. The controller maintains the global context state to ensure semantic continuity between multiple rounds of retrieval. The scheduling process includes four stages: task parsing, resource allocation, execution monitoring, and result aggregation. The system preferably adopts an event-driven asynchronous scheduling architecture, supporting concurrent execution and load balancing. Key configuration parameters include maximum concurrency (recommended value 10), task timeout (recommended value 30 seconds), and context retention time (recommended value 300 seconds).

[0032] The feedback processing engine (D.4) is responsible for collecting, analyzing, and processing user feedback to generate strategy optimization suggestions. The feedback processing flow includes four steps: feedback collection, quality assessment, pattern recognition, and suggestion generation. The engine supports various feedback types: user-annotated feedback, system performance feedback, and rule effect feedback. Feedback analysis employs a statistical learning-based pattern recognition method to automatically discover patterns and trends in the feedback. Suggestion generation is based on feedback patterns and historical data to recommend the optimal strategy adjustment scheme. The system preferentially uses a machine learning-based feedback analysis model, improving suggestion accuracy through supervised learning. This engine is a core technical component for solving the static response problem of rule systems, achieving dynamic optimization of the rule system through continuous learning and adaptive adjustment. Key configuration parameters include the feedback collection period (recommended value 60 seconds), analysis window size (recommended value 1000), and suggestion confidence threshold (recommended value 0.8).

[0033] The scheduling control data flow of module D is as follows: The semantic expression parser (D.1) receives the context enhancement data (JSON format, including completion tags and alignment relationships) output by module C, parses the user query expression, generates a query plan, and outputs the adjusted strategy parameters (JSON format, including threshold and weight updates) to the aggregation strategy dynamic adjuster (D.2). The aggregation strategy dynamic adjuster dynamically adjusts the aggregation strategy parameters based on the feedback results and outputs the scheduling execution results (JSON format, including module call status) to the retrieval scheduling controller (D.3). The retrieval scheduling controller coordinates the execution order and data flow from modules A to D, and outputs strategy adjustment suggestions (JSON format, including parameter updates and rule optimizations) to the feedback processing engine (D.4). The feedback processing engine collects user feedback data (JSON format, including annotations and performance metrics), generates strategy optimization suggestions, and feeds them back to the semantic expression parser, forming a closed-loop control. This data flow implements a complete control process from context enhancement to strategy execution, ensuring the system's dynamic adaptive capability.

[0034] Module E (Multi-level Semantic Retrieval and Visualization Engine) is used to provide multi-dimensional display and visualization output of the retrieval and aggregation results from Module D. Its functional structure includes a semantic grapher, a context expander, and a visualization renderer, supporting the display of complex log behavior paths in various ways such as graphs, timelines, or dimensional matrices, improving the comprehensibility and response speed of analysis results. This engine is a core technical component for solving the problem of poor interpretability of retrieval results. Through graph-based semantic construction and multi-dimensional visualization mechanisms, it transforms complex log analysis results into intuitive and understandable visual expressions.

[0035] The visualization engine data flow in Module E: The Semantic Grapher (E.1) receives the aggregated analysis results (JSON format, including strategy execution results and feedback) output from Module D, constructs a semantic graph structure, and outputs an expanded context view (JSON format, including multidimensional analysis data) to the Context Expander (E.2). The Context Expander expands the multidimensional analysis view based on user interaction operations (JSON format, including clicks, zooming, filtering, etc.), outputting visualization results (JSON format, including graphs, timelines, and dimension matrices) to the Visualization Renderer (E.3). The Visualization Renderer transforms the structured data into intuitive visualizations, ultimately outputting JSON format results containing various visualization forms such as graphs, timelines, and dimension matrices. This data flow achieves a complete transformation from structured analysis results to intuitive visualizations, improving the comprehensibility and responsiveness of the analysis results.

[0036] The present invention has the following advantages over the prior art:

[0037] (1) A semantic retrieval module based on the MCP protocol was designed for the first time, which supports multi-round queries and context enhancement mechanisms to realize structured semantic expression and retrieval closed loop.

[0038] (2) A log format-independent feature extraction structure is proposed to support dynamic parsing of heterogeneous formats and construction of unified semantic indexes.

[0039] (3) Construct a dynamic context enhancement system to support cross-format context alignment and semantic completion, and improve the ability to handle unknown logs.

[0040] (4) Design a composable semantic aggregation strategy structure to support real-time aggregation analysis based on multiple dimensions such as users and behaviors.

[0041] (5) Establish a feedback-driven adaptive rule and strategy adjustment mechanism to achieve dynamic optimization closed loop based on analysis results.

[0042] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0043] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a diagram of the overall system architecture of the present invention;

[0045] Figure 2 This is a diagram of the internal structure of module A in this invention;

[0046] Figure 3 This is a flowchart of the workflow of module B in this invention;

[0047] Figure 4 This is a schematic diagram of the adaptive learning mechanism of module C in this invention;

[0048] Figure 5 This is a structural diagram of the interactive analysis interface of module D in this invention;

[0049] Figure 6 This is a flowchart of the system initialization and capability registration process of the present invention;

[0050] Figure 7 This is a flowchart of the retrieval scheduling and multi-round analysis closed loop of the present invention;

[0051] Figure 8 This is a structural diagram of the visualization engine for module E of the present invention. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] The technical problems to be solved by this invention are: (1) the lack of unified semantic expression and retrieval capabilities in heterogeneous log format environments, which is solved by a format-independent semantic feature extraction and context indexing mechanism based on the MCP protocol. (2) the lack of context in heterogeneous log environments, which is solved by a unified modeling mechanism through dynamic context generation and semantic completion. (3) the static response of the rule system, which is solved by a feedback-driven adaptive mechanism based on supervised learning to achieve dynamic rule updates and strategy optimization, including a closed-loop optimization process of feedback collection, pattern recognition, parameter adjustment and effect verification. (4) the difficulty of retrieval tasks to be tracked across rounds, which is solved by a closed-loop execution mechanism through multi-round semantic expression and context state maintenance.

[0054] like Figure 1-8 As shown, this invention is a log intelligent retrieval and analysis system based on Model Context Protocol (MCP), which is used to solve the problem of poor interpretability of retrieval results. Through the semantic grapher, context expander and visualization renderer of module E, it realizes graph-based semantic construction and multi-dimensional analysis result display, supports multiple visualization methods such as graphs, timelines, and dimension matrices, and improves the understanding and response speed of analysis results.

[0055] like Figure 1-8 As shown, the log intelligent retrieval and analysis system based on the Model Context Protocol (MCP) of this invention includes the entire process of data input, context modeling, strategy execution, and feedback mechanisms, further verifying the technical integrity and implementation capability of this invention.

[0056] An example of the solution provided by this invention is as follows: In an enterprise-level distributed system, after deploying the intelligent log retrieval and analysis system of this invention, complex system failures caused by abnormal interactions between microservices can be automatically detected. The system first identifies abnormal log fragments through an MCP-driven anomaly detection engine. Subsequently, the root cause analysis engine automatically traces back to specific service dependency links and configuration changes. Finally, the detection and analysis capabilities are continuously optimized through a knowledge base and expert feedback mechanism. Users can intuitively view the causes of anomalies and repair suggestions through an interactive interface, significantly improving fault response speed and system stability.

[0057] The MCP capabilities in Module A can declare semantic retrieval capabilities externally through the following capability registration structure:

[0058]

[0059]

[0060] This capability structure conforms to the MCP capability registration protocol specification, with all field definitions described through a unified schema, supporting dynamic discovery and orchestration on the platform. The `context` field in the input can be used as an optional completion tag in multi-round retrieval processes, where the `protocol` field establishes a direct mapping relationship with the protocol field in the log data, achieving semantic consistency across formats. The output structure `results` is uniformly generated by module A and passed to module B for indexing processing.

[0061] In module A, log data input comes from network probes or log collectors and is uniformly converted into structured JSON, such as:

[0062]

[0063] The data is analyzed by a semantic feature extractor to identify semantic fragments (such as "user login request"), and contextual fields are annotated using a context model, such as:

[0064]

[0065] When building the index in module B, context tags are mapped to inverted index fields to support fast retrieval. The index structure is as follows:

[0066]

[0067] When module C implements semantic enhancement, it performs format estimation and context expansion on logs with unknown formats, and generates cross-format unified labels through a context synchronization component. The pattern inference method is based on frequent itemset mining and sequence pattern recognition. Example pseudocode is as follows:

[0068]

[0069]

[0070] Module D supports semantic policy control, with policies distributed in JSON configuration format:

[0071]

[0072] During execution, all events are aggregated by source_ip, and behavioral pattern characteristics are output. Configuration by user and custom dimensions is supported.

[0073] Semantic filtering rules are supported during the aggregation process. An example of the rule format is shown below:

[0074]

[0075] A feedback record is generated after a match is found:

[0076]

[0077] Module D generates dynamic suggestions based on feedback, such as rule update suggestions and strategy parameter adjustment suggestions. The suggestion structure is as follows:

[0078]

[0079] The adaptive mechanism process of feedback-evaluation-recommendation-issuance is as follows:

[0080] 1. Collect hit feedback from module E;

[0081] 2. Module D aggregates evaluations and generates recommendations;

[0082] 3. It is recommended to pass it to module B or module A;

[0083] 4. Update rules or feature processing procedures after receiving the data;

[0084] 5. Implement the corrective strategy in the next task to complete the closed loop.

[0085] Example of a specific process for adjusting strategy parameters: When the system detects that the false positive rate of the "suspicious_login" rule reaches 15% (exceeding the threshold of 10%), module D.2 automatically triggers the adjustment process. First, the current precision is calculated: precision = (hit_count - false_positive) / hit_count = (34 - 2) / 34 = 94.1%. Then, the adjustment magnitude is calculated according to the mathematical model: adjustment = α × (target precision - current precision) × learning rate = 0.5 × (95% - 94.1%) × 0.01 = 0.0045. Finally, the threshold parameter is updated: new threshold = original threshold + adjustment = 50 + 0.0045 ≈ 50.005. After the system verifies the adjustment effect, the new parameters are applied to the next retrieval task, realizing adaptive optimization based on feedback.

[0086] The protocol types used in this system cover TCP / UDP, HTTP, DNS, SMTP, etc. The parsing logic is executed by the log collector, and the results are uniformly semantically extracted by module A. Protocol fields are part of the context and occupy the position of "basic semantic dimension" in MCP.

[0087] In the output phase of module E, all results will be presented as structured semantic reports and graph outputs, allowing users to intuitively identify behavioral paths and abnormal chains.

[0088] This example demonstrates the system's end-to-end mechanism, from data input, semantic extraction, context enhancement, policy control to adaptive feedback loop. The data flow sequence is as follows: First, module A receives raw log data, identifies semantic fragments and generates context labels using a semantic feature extractor, and outputs preliminary retrieval results in JSON format containing semantic labels and matching degrees, which are then passed to module B. After receiving the preliminary retrieval results, module B performs structural feature normalization using a format recognizer, constructs an inverted index structure, and outputs semantic index data in JSON format containing the inverted index and field mappings, which is then passed to module C. After receiving the semantic index data, module C identifies unknown formats and completes semantic labels using a semantic pattern learner, and outputs context enhancement data in JSON format containing the completed labels and alignment relationships, which is then passed to module D. After receiving the context enhancement data, module D parses the user query using a semantic expression parser, executes aggregation strategies, generates analysis results, and outputs aggregation analysis results in JSON format containing the strategy execution results and feedback, which are then passed to module E. After receiving the aggregation analysis results, module E constructs a visualization graph using a semantic graph builder, expands a multi-dimensional analysis view using a context expander, and finally outputs intuitive visualization results for the user to view.

[0089] Regarding control flow and interaction timing, the system establishes a complete feedback loop: Module E collects user annotations and feedback on visualization results and system performance metrics, and feeds them back to the feedback processing engine of Module D in JSON format; Module D generates strategy adjustment suggestions based on the feedback data, including parameter update and rule optimization information, and passes them to Module B in JSON format; Module B updates the index structure based on the adjustment suggestions, generates index update instructions, including field change and reconstruction instructions, and passes them to Module A in JSON format; Module A adjusts the semantic feature extraction strategy based on the update instructions, completing the closed-loop optimization. This closed-loop mechanism ensures that the system can continuously optimize based on actual usage effects, achieving dynamic adaptive capabilities.

[0090] All modules are designed around the MCP context protocol, with core innovations including context-driven semantic indexing, semantic rule control, adaptive policy closure, and graph-based output. This mechanism boasts excellent scalability, adapting to more log formats, business scenarios, and analytical tasks, such as application performance analysis, operation auditing, and security event detection.

[0091] Competitive technology analysis

[0092] This section selects representative publicly available technologies or products as comparison objects with this patent in terms of semantic retrieval, context enhancement, and log analysis paths, and analyzes their technical features, applicable limitations, and advantages and differences with this patent.

[0093] US10803238B1 Context-aware log query system

[0094] Technical features: This patent provides a context filtering query system based on structured log fields, which supports predefined semantic rules and field-level comparison.

[0095] Limitations: It relies on the fixed structure of log fields, lacks dynamic semantic parsing and format adaptation capabilities, and does not support automatic modeling of unstructured logs.

[0096] Advantages of this invention: It supports log format-independent semantic feature extraction and dynamic context construction, covering more formats and scenarios.

[0097] Splunk Enterprise products

[0098] Technical features: Provides log retrieval, filtering, alerting and graphical display capabilities based on search language, and supports plug-in expansion.

[0099] Limitations: It mainly relies on rules and field expressions, has limited semantic understanding capabilities, and is difficult to perform dynamic closed-loop analysis and multi-round semantic-driven retrieval.

[0100] Advantages of this invention: It introduces multi-round semantic expression and contextual closed-loop mechanism, and combines adaptive strategy and semantic index to achieve deep intelligent retrieval.

[0101] Elastic Stack (ELK)

[0102] Technical features: Construct a three-layer architecture for log collection, storage and retrieval, relying on field modeling and predefined aggregation.

[0103] Limitations: It has poor adaptability to changes in log format, its aggregation strategy is fixed, and its semantic capabilities rely on manually constructing mapping relationships.

[0104] Advantages of this invention: It supports semantic aggregation strategy configuration and format-aware enhancement mechanism, and has higher dynamism and semantic adaptability.

[0105] CN112440862A A Log-Based Multidimensional Interactive Retrieval and Analysis Method

[0106] Technical features: Provides a visual log retrieval method, combining multi-dimensional indicator filtering and visual interactive operation to enable business-level log viewing.

[0107] Limitations: The retrieval mechanism is still based on keywords and rules, lacking semantic reasoning and context-driven capabilities.

[0108] Advantages of this invention: It provides a context-driven semantic retrieval model and a semantic feedback closed-loop mechanism, enabling more intelligent behavior inference and event aggregation.

[0109] The aforementioned technologies each have their advantages in static modeling, field matching, and rule retrieval, but all lack the ability for dynamic context organization, format-independent semantic indexing, and policy closure. This invention constructs an MCP-driven multi-round semantic retrieval architecture, integrating structure awareness, semantic modeling, and feedback learning mechanisms to form a log intelligent analysis system with stronger semantic understanding, broader adaptability, and a more complete system closure.

[0110] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A log intelligent retrieval and analysis system based on Model Context Protocol (MCP), characterized in that, include: Module A: MCP Log Semantic Transformation and Retrieval Engine; It is responsible for receiving raw log data streams and performing format-independent semantic feature extraction; The MCP log semantic transformation and retrieval engine includes a log semantic feature extractor, a context model generator, a semantic retrieval expression parser, and a context semantic space matcher. The MCP log semantic transformation and retrieval engine is used to extract semantic units from the raw data and generate structured context labels. This module also supports parsing semantic retrieval expressions and matching them with the context semantic space to output preliminary candidate results as input for subsequent indexing and analysis; Module B, Log Format Independent Feature Extractor and Indexer; receives the semantic results output by Module A, normalizes the structural features of the log content, and constructs a unified semantic index; the Log Format Independent Feature Extractor and Indexer module structure includes a format recognizer, a structural feature generator, and an index publisher, supporting cross-format log structural abstraction and unified index publishing; the index results will be used by downstream modules for fast retrieval and context enhancement; Module C, Dynamic Log Format Recognition and Context Enhancement System; receives the index structure output by Module B, recognizes unknown log formats and enhances context labels; the module structure includes a semantic pattern learner and a context aligner, and has the ability to dynamically generate semantic completion labels to achieve cross-source log semantic consistency completion; the enhancement results output by this module serve as the basic context for subsequent multi-round retrieval and strategy execution. Module D, Real-time Retrieval Analysis and Aggregation Controller; Based on the context structure output by Module C, it is responsible for executing retrieval scheduling, strategy aggregation, and feedback control; It supports closed-loop execution from semantic expression parsing, module scheduling, aggregation strategy generation to feedback processing; This module provides the ability to manage retrieval rounds, assemble aggregation strategies, and dynamically adjust them, and is the control center for the system's closed-loop intelligent analysis; Module E, a multi-level semantic retrieval and visualization engine, is used to provide multi-dimensional display and visualization output of the retrieval and aggregation results from Module D. Its functional structure includes a semantic grapher, a context expander, and a visualization renderer, which supports displaying complex log behavior paths in the form of graphs, timelines, or dimension matrices, improving the understanding of analysis results and response speed.

2. The intelligent log retrieval and analysis system based on Model Context Protocol (MCP) according to claim 1, characterized in that, The log semantic feature extractor in module A employs a multi-level semantic parsing algorithm. First, it identifies predefined patterns through a log template matcher, and then uses natural language processing technology for word segmentation, part-of-speech tagging, and entity recognition. For logs with unknown formats, the system uses a sequence labeling model based on an attention mechanism for dynamic semantic extraction. The semantic unit identification process includes: identification of protocol types including HTTP, HTTPS, and DNS; identification of operation behaviors such as login, logout, and query; and identification of status indicators including success, failed, and pending. Key parameter configurations include semantic similarity threshold, entity confidence threshold, and maximum sequence length. The context model generator in module A generates structured labels based on semantic feature extraction results through a context association rule engine. The context label generation logic includes: static label mapping based on log templates, dynamic context inference based on time series, and semantic completion based on association rules. The system adopts a context modeling method based on graph neural networks, using log events as nodes and relationships between events as edges to construct a dynamic context graph. The context label generation process follows the MCP protocol specification, generating standardized label fields ctx_protocol, ctx_action, and ctx_state. Key configuration parameters include context window size, association threshold, and label update frequency. The semantic retrieval expression parser in module A is responsible for parsing the semantic retrieval expression input by the user and converting it into an executable query plan. The parsing process includes three steps: syntax analysis, semantic verification, and query optimization. The system supports two input formats: natural language queries and structured queries, and uses a Transformer-based query understanding model for semantic parsing. The query optimizer generates the optimal retrieval path based on the structural features of the context semantic space. Key parameters include query complexity threshold, parsing timeout, and cache hit rate threshold. The context semantic space matcher in module A is used to perform matching operations between the retrieval expression and the context semantic space, and output preliminary candidate results. The matching algorithm uses multi-dimensional similarity calculation, including semantic similarity, temporal similarity and structural similarity. The system uses a semantic matching method based on the vector space model, combined with an attention mechanism for accurate matching. The matching results are sorted by relevance score, and pagination and result filtering are supported. Key configuration parameters include matching threshold, maximum number of returned results and matching timeout.

3. The intelligent log retrieval and analysis system based on Model Context Protocol (MCP) according to claim 1, characterized in that, The internal data flow of module A is as follows: The log semantic feature extractor receives raw log data (JSON format, including timestamp and source_ip fields), extracts semantic features through a multi-level semantic parsing algorithm, outputs a semantic feature vector, and passes it to the context model generator. The semantic feature vector is in JSON format and includes ctx_protocol and ctx_action tags. The context model generator generates structured context labels based on semantic features and outputs the parsed query plan to the semantic retrieval expression parser. The query plan is in JSON format and includes a syntax tree and optimization strategies. The semantic retrieval expression parser parses the user query and generates a query plan, then outputs preliminary search results to the context semantic space matcher. The preliminary search results are in JSON format and include the matching degree and candidate list; The context semantic space matcher performs the final matching operation and outputs preliminary retrieval results in JSON format containing semantic tags and matching degrees, which serve as input to module B; this data flow ensures a complete transformation process from raw logs to structured semantic results.

4. The intelligent log retrieval and analysis system based on Model Context Protocol (MCP) according to claim 1, characterized in that, The format recognizer in module B employs a multi-level format recognition algorithm. First, it identifies predefined log patterns using a regular expression matcher, and then uses an attention-based sequence classification model to identify unknown formats. For structured logs, the system uses a template-based clustering algorithm to automatically discover log templates by calculating log line similarity. The format recognition process includes: delimiter recognition, field boundary detection, data type inference, and format pattern extraction; key parameter configurations include similarity threshold, minimum template frequency, and maximum number of fields. The structural feature generator in module B, based on format recognition results, converts heterogeneous logs into a unified structured representation through a feature vectorization engine. The normalization method employs a word embedding-based feature vector model to map log fields into high-dimensional semantic vectors. The system uses a Transformer-based sequence encoder for feature extraction, combining positional encoding and attention mechanisms to capture inter-field dependencies. The feature vectorization process includes: field segmentation, word vector mapping, sequence encoding, and feature aggregation. Key configuration parameters include vector dimension, maximum sequence length, and the number of attention heads. The index publisher in module B is responsible for building the inverted index structure, supporting fast semantic retrieval. The inverted index construction adopts a word segmentation strategy based on field mapping, mapping log attributes to standard index fields. The index field mapping rules include: time fields are mapped to timestamp indexes, IP fields are mapped to geolocation indexes, protocol fields are mapped to category indexes, and behavior fields are mapped to semantic indexes. The system supports dynamic index updates and incremental index construction, and adopts an LSM tree-based storage structure to improve write performance. Key parameters include the number of index shards, cache size, and refresh interval.

5. The intelligent log retrieval and analysis system based on Model Context Protocol (MCP) according to claim 1, characterized in that, The working data flow of module B is as follows: The format recognizer receives the preliminary search results output by module A. The preliminary search results are in JSON format and contain semantic tags and matching degree. It identifies the log format pattern through a multi-level format recognition algorithm, outputs a normalized feature vector, and passes it to the structure feature generator. The feature vector is in JSON format and contains a 768-dimensional semantic vector; Based on the format recognition results, the structural feature generator converts heterogeneous logs into a unified structured representation through a feature vectorization engine, and outputs semantic index data to the index publisher. The semantic index data is in JSON format and contains inverted indexes and field mappings. The index publisher builds an inverted index structure and publishes the index, outputting JSON-formatted semantic index data containing inverted indexes and field mappings as input to module C.

6. The intelligent log retrieval and analysis system based on Model Context Protocol (MCP) according to claim 1, characterized in that, The semantic pattern learner in module C employs an incremental learning mechanism, automatically discovering semantic patterns in logs through frequent itemset mining and sequence pattern recognition algorithms. The learning process includes four steps: sample data preprocessing, feature extraction, pattern mining, and model training. In the sample data preprocessing stage, the original logs are cleaned, standardized, and labeled. In the feature extraction stage, a vectorization method based on term frequency-inverse document frequency (TF-IDF) is used. In the pattern mining stage, frequent itemset mining based on the Apriori algorithm is combined with sequence pattern recognition based on PrefixSpan to automatically discover behavioral patterns and association rules in the logs. In the model training stage, a classifier based on support vector machine (SVM) is used for pattern classification. Key training parameters include support threshold, confidence threshold, and minimum pattern length. The context aligner in module C is responsible for handling semantic consistency alignment across log formats, and uses a hybrid algorithm based on semantic similarity calculation and knowledge graph alignment. The alignment algorithm consists of three stages: feature matching, semantic mapping matrix construction, and alignment result verification. The feature matching stage identifies potential correspondences by calculating the semantic similarity between log fields; The semantic mapping matrix construction stage employs an attention-based neural network model to learn the semantic mapping relationships between logs of different formats. The system uses a graph neural network-based semantic alignment method, with log formats as nodes and semantic relationships as edges, to construct a dynamic alignment graph. The alignment accuracy is ensured during the alignment result verification phase through cross-validation and expert feedback mechanisms. Key configuration parameters include similarity threshold, alignment confidence threshold, and maximum number of iterations.

7. The intelligent log retrieval and analysis system based on Model Context Protocol (MCP) according to claim 1, characterized in that, The adaptive learning data stream of module C is as follows: The semantic pattern learner receives semantic index data output by module B. The semantic index data is in JSON format and includes inverted index and field mapping. It automatically discovers semantic patterns in the log through an incremental learning mechanism and outputs context enhancement data to the context aligner. The context enhancement data is in JSON format and includes completion tags and alignment relationships. The context aligner handles semantic consistency alignment across log formats, outputting JSON-formatted contextual enhancement data containing completion tags and alignment relationships as input to module D. Simultaneously, the context aligner establishes a learning feedback loop, feeding newly discovered semantic patterns back to the semantic pattern learner as pattern update instructions, enabling continuous learning and pattern library updates. This data flow ensures dynamic recognition and semantic completion capabilities for unknown log formats.

8. The intelligent log retrieval and analysis system based on Model Context Protocol (MCP) according to claim 1, characterized in that, The retrieval closed-loop process of the intelligent log retrieval and analysis system starts from the user expression input, and sequentially schedules modules A to D to perform semantic matching, context enhancement and strategy analysis, and finally outputs structured results and generates a visualization view, completing the closed-loop process from input to feedback; Its multi-round analysis closed-loop process includes five steps: retrieval expression parsing, module scheduling, context aggregation, dynamic strategy execution, and result output. The semantic expression parser adopts a syntax tree-based parsing engine architecture, uses the ANTLR tool to generate the parser, and supports context-aware semantic expression parsing. The parsing process includes four stages: lexical analysis, syntax analysis, semantic verification, and query optimization. The lexical analysis phase decomposes semantic expressions into lexical units, the syntax analysis phase constructs an abstract syntax tree (AST), the semantic verification phase checks field existence and type matching, and the query optimization phase generates the optimal execution plan. The system supports complex expression parsing, including logical operators, comparison operators, and function calls. Key configuration parameters include parsing timeout, maximum expression complexity, and cache size; The aggregation strategy dynamic adjuster is responsible for dynamically adjusting the aggregation strategy parameters based on feedback results, and adopts a feedback-based weight update algorithm. The adjustment mechanism is based on a mathematical model: new threshold = original threshold + α × (target precision - current precision) × learning rate, where α is the adjustment coefficient and the learning rate is an adaptive parameter. When the false positive rate exceeds the threshold, the system automatically triggers the policy adjustment process: first, the adjustment magnitude is calculated, then the relevant parameters are updated, and finally the adjustment effect is verified. The specific process of policy parameter adjustment includes five steps: feedback data collection, performance index calculation, adjustment magnitude determination, parameter update execution, and effect verification. The system adopts an adaptive adjustment method based on reinforcement learning, which optimizes policy parameters through a reward function. Key configuration parameters include the adjustment trigger threshold, learning rate, and maximum adjustment magnitude. The retrieval scheduling controller is responsible for coordinating the execution order and data flow from module A to module D, supporting multi-round retrieval and context state maintenance. The scheduling strategy adopts priority-based task queue management, supporting dynamic adjustment of task priorities and optimization of resource allocation. The controller maintains the global context state to ensure semantic continuity between multi-round retrievals. The scheduling process includes four stages: task parsing, resource allocation, execution monitoring, and result aggregation. The system adopts an event-driven asynchronous scheduling architecture, supporting concurrent execution and load balancing. Key configuration parameters include maximum concurrency, task timeout, and context retention time. The feedback processing engine is responsible for collecting, analyzing, and processing user feedback to generate strategy optimization suggestions. The feedback processing flow includes four steps: feedback collection, quality assessment, pattern recognition, and suggestion generation. The engine supports multiple feedback types: user-annotated feedback, system performance feedback, and rule effect feedback. Feedback analysis uses a statistical learning-based pattern recognition method to automatically discover patterns and trends in the feedback.

9. The intelligent log retrieval and analysis system based on Model Context Protocol (MCP) according to claim 1, characterized in that, The scheduling control data flow of module D is as follows: The semantic expression parser receives context enhancement data output by module C. The context enhancement data is in JSON format and includes completion tags and alignment relationships. It parses the user query expression and generates a query plan. It outputs the adjusted strategy parameters to the aggregation strategy dynamic adjuster. The strategy parameters are in JSON format and include threshold and weight updates. The aggregation strategy dynamic adjuster dynamically adjusts the aggregation strategy parameters based on the feedback results and outputs the scheduling execution results to the retrieval scheduling controller. The scheduling execution results are in JSON format and include the module call status. The execution order and data flow of the coordination module from module A to module D are retrieved by the scheduling controller, and the output strategy adjustment suggestions are passed to the feedback processing engine. The strategy adjustment suggestions are in JSON format and include parameter updates and rule optimizations. The feedback processing engine collects user feedback data, generates strategy optimization suggestions, and feeds them back to the semantic expression parser, forming a closed-loop control. The user feedback data is in JSON format and includes annotations and performance metrics. This data flow realizes a complete control process from context enhancement to strategy execution, ensuring the system's dynamic adaptive capability.

10. The intelligent log retrieval and analysis system based on Model Context Protocol (MCP) according to claim 1, characterized in that, The data flow of the visualization engine in module E is as follows: The semantic grapher receives the aggregated analysis results output by module D, constructs a semantic graph structure, and outputs an expanded context view to the context expander. The context expander expands a multi-dimensional analysis view based on user interaction operations, outputs a visualization result to the visualization renderer, and the user interaction operations are in JSON format and include click, zoom, and filter. The visualization output is in JSON format and includes graphs, timelines, and dimension matrices. The visualization renderer converts structured data into intuitive visualizations, ultimately outputting JSON-formatted results that include graphs, timelines, and dimension matrices. This data stream achieves a complete transformation from structured analysis results to intuitive visualizations, improving the comprehensibility and responsiveness of the analysis results.

Images