Data early warning method and related device

Abstract

The invention provides a data early warning method and a related device, and relates to the technical field of software, the data early warning method comprises the steps that respective monitoring lists of a plurality of data sources are generated, and monitoring objects in the monitoring lists have unique routing addresses and are bound with corresponding access modes; the early warning instruction is responded, the early warning instruction at least indicates a target monitoring object and an early warning rule, and the number of data sources to which the target monitoring object belongs is one or more; creating an executable rule tree according to the routing address of the target monitoring object, and obtaining monitoring data from a data source to which the target monitoring object belongs by driving the rule tree in an access mode of the target monitoring object; and performing logical operation on the monitoring data according to the early warning rule to obtain an early warning result. The problems that heterogeneous data sources are difficult to model uniformly and rules cannot be reused are solved, and the purpose of multi-source combined early warning is achieved.

Description

Technical Field

[0001] This application relates to the field of software technology, and in particular to a data early warning method and related apparatus. Background Technology

[0002] Enterprises need to continuously monitor multi-source data and respond to anomalies in their daily operations. Traditional early warning solutions extract data from data sources into a separate indicator library, then write conditions one by one in an external rule engine, and the scheduler polls the data in the indicator library to generate early warning notifications.

[0003] However, treating data as a set of flat metrics lacks a unified abstraction of complex levels such as reports and BI, and makes it difficult to link metrics between different data sources. As a result, each data source has to be accessed and configured separately, making it impossible to achieve multi-source combined early warning. Summary of the Invention

[0004] In view of the above problems, this application provides a data early warning method and related apparatus to achieve the purpose of multi-source combined early warning. The specific solution is as follows:

[0005] The first aspect of this application provides a data early warning method, the data early warning method comprising:

[0006] Generate monitoring lists for multiple data sources, where each monitoring object in the monitoring list has a unique routing address and is bound to a corresponding data retrieval method;

[0007] In response to an early warning instruction, the early warning instruction shall at least indicate a target monitoring object and an early warning rule, and the data source to which the target monitoring object belongs may be one or more.

[0008] An executable rule tree is created based on the routing address of the target monitoring object, and monitoring data is obtained from the data source by driving the rule tree in the manner of the target monitoring object.

[0009] The warning result is obtained by performing logical operations on the monitoring data according to the warning rules.

[0010] In one possible implementation, generating monitoring lists for multiple data sources includes:

[0011] For each of the multiple data sources, the metadata of that data source is obtained, and the attribute data of the data object in that data source is obtained by parsing the metadata. The attribute data includes the routing address and the data retrieval method.

[0012] The tree structure of the data source is obtained by concatenating the routing addresses of the data objects. Each node in the tree structure represents a data object and is bound to a corresponding data retrieval method.

[0013] The target data object is determined from the data object to serve as the leaf node of the tree structure, and the target data object is written into the corresponding monitoring list as the monitoring object of the data source.

[0014] In one possible implementation, obtaining monitoring data from the data source by driving the rule tree in the manner of retrieving data from the target monitoring object includes:

[0015] Using the target monitoring object as a leaf node, determine the routing path of the target monitoring object in the rule tree;

[0016] The nodes in the routing path are traversed in order from the root node to the leaf node. For the currently traversed node, the associated data is retrieved from the calculation cache of its parent node according to the data retrieval method of the node, and the calculation result obtained by using the associated data is stored in the calculation cache of the node. When the target monitoring object is traversed, the calculation result of the target monitoring object is used as the monitoring data.

[0017] In one possible implementation, the response warning instruction includes:

[0018] Receive structured expressions input by the user;

[0019] The structured expression is parsed, and the parsing result of the structured expression includes at least the target monitoring object and the early warning rule;

[0020] Create an early warning task for the target monitoring object and the early warning rule, and execute the early warning task.

[0021] In one possible implementation, the parsing result of the structured expression further includes at least one warning condition, and executing the warning task includes:

[0022] The warning task shall be executed if any one of the warning conditions is met;

[0023] If the early warning task is being executed for the first time, the step of creating an executable rule tree based on the routing address of the target monitored object is executed.

[0024] If the warning task is not being executed for the first time, the step of obtaining monitoring data from the data source by driving the rule tree in the manner of retrieving data from the target monitoring object is performed.

[0025] In one possible implementation, the parsing result of the structured expression also includes an alert method, and the data alert method further includes:

[0026] Based on the warning results, a warning message matching the warning method is created and output.

[0027] A second aspect of this application provides a data early warning device, the data early warning device comprising:

[0028] The monitoring list generation module is used to generate monitoring lists for multiple data sources. The monitoring objects in the monitoring list have unique routing addresses and are bound to corresponding data retrieval methods.

[0029] The early warning response module is used to respond to early warning instructions, which at least indicate a target monitoring object and an early warning rule. The target monitoring object belongs to one or more data sources. An executable rule tree is created based on the routing address of the target monitoring object, and monitoring data is obtained from the data source by driving the rule tree in the manner of data retrieval of the target monitoring object. The early warning result is obtained by performing logical operations on the monitoring data with the early warning rule.

[0030] A third aspect of this application provides a computer program product including computer-readable instructions that, when executed on an electronic device, cause the electronic device to implement the data warning method described in the first aspect or any implementation thereof.

[0031] A fourth aspect of this application provides an electronic device, including at least one processor and a memory connected to the processor, wherein:

[0032] The memory is used to store computer programs;

[0033] The processor is used to execute the computer program so that the electronic device can implement the data early warning method of the first aspect or any implementation thereof.

[0034] The fifth aspect of this application provides a computer storage medium carrying one or more computer programs, which, when executed by an electronic device, enable the electronic device to implement the data warning method described in the first aspect or any implementation thereof.

[0035] By employing the above technical solution, this application provides a data early warning method and related apparatus, comprising: generating monitoring lists for multiple data sources, wherein each monitoring object in the monitoring list has a unique routing address and is bound to a corresponding data retrieval method; responding to an early warning command, wherein the early warning command at least indicates a target monitoring object and an early warning rule, and the target monitoring object belongs to one or more data sources; creating an executable rule tree based on the routing address of the target monitoring object, and obtaining monitoring data from the data source to which the target monitoring object belongs by driving the rule tree to retrieve data using the data retrieval method of the target monitoring object; and performing logical operations on the monitoring data using the early warning rule to obtain an early warning result. This application generates monitoring lists for different data sources, enabling users to configure target monitoring objects and early warning rules to generate early warning commands. Furthermore, when responding to an early warning command, this application uses an executable rule tree to describe the routing structure of the target monitoring object in its data source, and then uses the early warning rule to drive the rule tree to perform logical operations to obtain an early warning result. This solves the problems of difficulty in uniformly modeling heterogeneous data sources and the inability to reuse rules, achieving the purpose of multi-source combined early warning. Attached Figure Description

[0036] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0037] Figure 1 This application provides a flowchart illustrating a data early warning method.

[0038] Figure 2 This is a partial flowchart illustrating a data early warning method provided in an embodiment of this application;

[0039] Figure 3 This is another schematic diagram of a data early warning method provided in an embodiment of this application;

[0040] Figure 4 This is another schematic flowchart of a data early warning method provided in an embodiment of this application;

[0041] Figure 5 This is a schematic diagram of the structure of a data early warning device provided in an embodiment of this application;

[0042] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0043] The embodiments of this application are described below with reference to the accompanying drawings. The terminology used in the implementation section of this application is for explaining specific embodiments only and is not intended to limit the scope of this application.

[0044] The embodiments of this application will now be described with reference to the accompanying drawings. Those skilled in the art will recognize that, with technological advancements and the emergence of new scenarios, the technical solutions provided in the embodiments of this application are equally applicable to similar technical problems.

[0045] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements, but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0046] To facilitate understanding of this application, the relevant concepts involved in this application will be explained below:

[0047] BI (Business Intelligence) refers to the use of modern data warehousing technology, online analytical processing technology, data mining, and data visualization technology to perform data analysis in order to realize business value.

[0048] Quartz Job / Trigger: Quartz is a widely used time-scheduling framework, and the time-scheduling mechanism in this application uses this framework. A Job represents the task logic to be executed (e.g., a warning calculation), and a Trigger defines the triggering conditions and frequency of the Job (e.g., cron expression, fixed interval, immediate trigger). A Job can be bound to multiple Triggers. When any Trigger condition is met, the scheduling center calls the corresponding Job to execute, achieving unified task lifecycle management.

[0049] Warning rules: Components used in this application to define warning logic. They are characterized by a weak association with the monitored object, support for complex logical combinations of multiple monitored objects, constants, and aggregate functions, and support for dynamic hot updates.

[0050] Dispatch Center: In this application, the dispatch center is responsible for the full lifecycle management of early warning tasks. It is responsible for task creation, suspension (i.e., pausing early warning tasks), resumption (resuming the execution of suspended early warning tasks), and deletion, and can monitor changes in task status and trigger linkage operations.

[0051] To address the limitation of traditional early warning schemes in achieving multi-source combined early warning, this application provides a data early warning method. The data early warning method of this application embodiment is described in detail below with reference to the accompanying drawings.

[0052] See Figure 1 , Figure 1 This is a flowchart illustrating a data early warning method provided in an embodiment of this application. Figure 1 As shown in the figure, the data early warning method provided in this application embodiment may include steps S101 to S104, which are described in detail below.

[0053] S101 generates monitoring lists for multiple data sources. Each monitoring object in the monitoring list has a unique routing address and is bound to a corresponding data retrieval method.

[0054] In this embodiment, for different data sources such as reports, BI components, and external APIs, corresponding adapters can be written to parse the metadata and data results of each data source. The monitorable data objects (such as specific cells in a report template, a sequence under the chart dimension in a BI dashboard, or a metric of an external API interface) are written as monitoring objects into the monitoring list. Each monitoring object has a unique routing address and is bound to a corresponding data retrieval method. The routing address is the unique path to locate the monitoring object. It can be obtained by concatenating the names of data objects at each layer of the data source using a separator, such as "Report Library / Report A / Sheet0 / Cell D5=(Alias)".

[0055] In one possible implementation, the monitoring list can be quickly generated by abstracting the data source into a tree structure to determine the monitoring objects that serve as leaf nodes. See also Figure 2 , Figure 2 This is a partial flowchart illustrating a data early warning method provided in an embodiment of this application. Figure 2 As shown in the embodiment of this application, a data early warning method is provided, wherein step S101, "generating monitoring lists for multiple data sources", may include steps S201 to S203, which are described in detail below.

[0056] S201: For each of the multiple data sources, obtain the metadata of that data source and obtain the attribute data of the data object in that data source by parsing the metadata. The attribute data includes the routing address and data retrieval method.

[0057] In this embodiment of the application, for any data source, the corresponding metadata can be pulled or received from its source system. The source data may include information such as template description, field definition, and dimension / metric list, and can be obtained by parsing report template files, reading BI session context, or calling the metadata interface of external APIs.

[0058] After obtaining the metadata of the data source, a preset parser can be used to extract the attribute data of each data object, such as type, name, parent data object, coordinates / dimensions, and data retrieval method. Based on the parent data object and coordinates / dimensions, the routing address of the data object can be determined. For example, the attribute data of a specific cell in a report template may include "type=cell", "name=Sheet0!D5", "parent data object=Sheet0", "coordinates=D5", and "data retrieval method=report template / reports / sales.cpt".

[0059] S202: The tree structure of the data source is obtained by concatenating the routing addresses of the data objects. Each node in the tree structure represents a data object and is bound to a corresponding data retrieval method.

[0060] In this embodiment, for any data source, after obtaining the attribute routing address of each data object through parsing, the parent-child relationship can be determined based on the hierarchical relationship between data objects. Thus, all data objects are concatenated as nodes to obtain a tree structure for the data source. Each node in this tree structure corresponds to a data object, and the node is bound to the data retrieval method of the corresponding data object. For example, a report template provides a hierarchical relationship of "worksheet → row → cell," a BI dashboard provides a hierarchical relationship of "dashboard → chart → dimension → metric," and an external API interface provides a hierarchical relationship of "metric group → metric item." Based on the hierarchical relationship of each data source, the data objects can be concatenated into a tree structure.

[0061] S203, determine the target data object as the leaf node of the tree structure from the data objects, and write the target data object as the monitoring object of the data source into the corresponding monitoring list.

[0062] In this embodiment of the application, for any data source, after obtaining the tree structure of the data source, the data object (i.e. the target data object) that serves as the leaf node can be determined. The target data object is written as a monitorable object to the monitoring list that can be referenced by rules. Specifically, the routing address of the monitor object can be written to the monitoring list.

[0063] S102, respond to the warning instruction, which indicates at least the target monitoring object and the warning rule, and the data source to which the target monitoring object belongs can be one or more.

[0064] In this embodiment, the user can view monitoring lists from different data sources through a UI interface and select at least one monitoring object to be alerted as the target monitoring object. Simultaneously, the user can configure corresponding alert rules for the target monitoring object. It should be noted that the target monitoring objects can belong to the same data source or different data sources; this embodiment does not limit this.

[0065] In one possible implementation, users can select target monitoring objects through the UI exposed by the rules engine and write structured expressions to configure alert rules for those objects. This rules engine supports dynamic hot updates to address the problems of rule rigidity and maintenance difficulties. See also Figure 3 , Figure 3 This is another flowchart illustrating a data early warning method provided in an embodiment of this application. Figure 3 As shown in the embodiment of this application, a data early warning method is provided, wherein the "responding to the early warning command" in step S102 may include steps S301 to S303, which are described in detail below.

[0066] S301 receives the structured expression input by the user.

[0067] In this embodiment, the user retrieves a monitoring list from different data sources in the rule configuration interface, selects the target monitoring object, and further configures the aggregation method (such as sum), threshold, logical relationship (such as LessThan, GreaterThan, Between, And, Or), etc., to obtain a structured expression. This allows the user to obtain the structured expression submitted by the front end.

[0068] For example, the target monitoring objects include "Total Sales" from Report A and "Minimum Temperature" from the API interface. The routing address for "Total Sales" is "Report A → Sheet0 → City = Shanghai → Cell D5", and the routing address for "Temperature" is "Weather API → City = Shanghai → Indicator = Minimum Temperature". The alert rule is "Total Sales < Past 7-day Average × 0.8 and Shanghai Minimum Temperature < 10℃".

[0069] S302, Parse the structured expression. The parsing result of the structured expression must contain at least the target monitoring object and the early warning rule.

[0070] In this embodiment of the application, after obtaining the structured expression submitted by the front end, the structured expression can be parsed by the rule engine, and after verifying its legality, the target monitoring object and the early warning rule in it can be serialized.

[0071] S303: Create an alert task for the target monitoring object and alert rules, and execute the alert task.

[0072] In this embodiment, after the structured expression is parsed, the rule engine can write the parsing result to the task configuration center and trigger the scheduling center to receive a rule update event so that the new rule can be used on the next call. A corresponding early warning task is created through the task configuration center, and the scheduling center schedules and executes the early warning task.

[0073] It should be noted that the scheduling center can encapsulate underlying schedulers such as Quartz, providing upper-level APIs for task lifecycle management and implementing powerful event listening and linkage mechanisms.

[0074] In one possible implementation, an alert task can be configured with multiple triggers simultaneously. Each trigger defines when the alert task is executed. These triggers can take various forms, such as Cron expressions, fixed frequency / delay, or immediate trigger commands. In this application, an embodiment of a data alert method further includes at least one alert condition in the parsed result of the structured expression. Step S303, "execute the alert task," can include the following steps:

[0075] If any one of the warning conditions is met, the warning task is executed; if the warning task is executed for the first time, the step of "creating an executable rule tree based on the routing address of the target monitoring object" in step S103 is executed; if the warning task is not executed for the first time, the step of "obtaining monitoring data from the data source of the target monitoring object by driving the rule tree in the manner of data retrieval of the target monitoring object" in step S103 is executed.

[0076] In this embodiment, an early warning task can be bound to one or more triggering conditions. The scheduling center can register triggers corresponding to each triggering condition. When a triggering condition is met, the scheduling center can call the early warning task to execute. Specifically, if the early warning task is executed for the first time, a rule tree is created first, and then the rule tree is driven to obtain the monitoring data of the target monitoring object. Conversely, if the early warning task is not executed for the first time, the rule tree is directly driven to obtain the monitoring data of the target monitoring object.

[0077] It should be noted that the dispatching center can register early warning tasks (task ID, name, creator, etc.), corresponding early warning rules, associated monitoring lists, and routing addresses of target monitoring objects to the underlying scheduler, and subscribe to task lifecycle events (such as new, pause, resume, delete) for subsequent linkage notifications / cleaning operations. Additionally, after the dispatching center detects a change in the early warning rules, it immediately reconstructs the corresponding early warning tasks and triggers without requiring downtime or manual deployment. The next time it is triggered, the scheduler will use the latest early warning rules and routing addresses to achieve immediate effectiveness after configuration.

[0078] In a possible implementation, an integrated closed-loop management mechanism from early warning trigger to disposal tracking is adopted to solve the problems of broken early warning processes and low response efficiency. In this regard, the embodiments of the present application provide a data early warning method. Among them, the parsing result of the structured expression further includes the early warning method. The data early warning method provided by the embodiments of the present application further includes the following steps:

[0079] Create an early warning message that matches the early warning method according to the early warning result and output the early warning message.

[0080] In the embodiments of the present application, the early warning methods include notification channels (such as email, IM, HTTP, etc.) and responsible persons, etc. In this regard, when the early warning result indicates that an early warning is triggered, an early warning message can be generated and output to the responsible person according to the notification channel. At the same time, a to-do record is created to record information such as early warning rules, responsible persons, and task status, and is exposed to the early warning management platform through the API for subsequent status tracking and management.

[0081] In practical applications, for the early warning results, early warning messages, and to-do records corresponding to the early warning tasks, they can be batch-written into the historical database for API / report query and subsequent analysis. At the same time, expired data is cleaned or archived to ensure historical traceability.

[0082] S103, create an executable rule tree according to the routing address of the target monitoring object, and obtain monitoring data from the affiliated data source in the data fetching manner of the target monitoring object by driving the rule tree.

[0083] In the embodiments of the present application, after obtaining the routing address of the target monitoring object, the rule engine determines the hierarchical relationship between the target monitoring object and other data objects in the affiliated data source based on this routing address. In this way, the relevant data objects and the target monitoring object are used to determine nodes at different levels, as well as their respective parent nodes and child nodes according to the hierarchical relationship, so as to form a business object with a hierarchical relationship, addressability, and computability (i.e., the rule tree), and the target monitoring object is the leaf node of the rule tree.

[0084] The rule engine drives the rule tree, which traverses nodes at different levels in the rule tree. When the target monitoring object is reached, the adapter is called to obtain the corresponding monitoring data from the data source according to its data retrieval method.

[0085] In one possible implementation, to ensure that the rule tree can intelligently reuse the calculation results of parent nodes and avoid redundant calculations under large-scale data, the embodiments of this application can drive the rule tree in a "child-first, parent-later" order. See also Figure 4 , Figure 4 This is another schematic flowchart illustrating a data early warning method provided in an embodiment of this application. Figure 4 As shown in the embodiment of this application, a data early warning method is provided, wherein step S103, "obtaining monitoring data from the data source of the target monitoring object by driving the rule tree in the manner of data retrieval of the target monitoring object", may include steps S401 to S402, which are described in detail below.

[0086] S401 uses the target monitored object as a leaf node to determine the routing path of the target monitored object in the rule tree.

[0087] In this embodiment of the application, the target monitoring object is treated as a leaf node, and the routing path of the target monitoring object is determined in the rule tree based on the routing address of the target monitoring object. The routing path contains multiple nodes at each level from the root node to the target monitoring object.

[0088] S402: Traverse the nodes in the routing path in order from the root node to the leaf node. For the currently traversed node, query the associated data from the calculation cache of its parent node according to the data retrieval method of the node, and store the calculation result obtained by using the associated data in the calculation cache of the node until the target monitoring object is traversed, and use the calculation result of the target monitoring object as the monitoring data.

[0089] In this embodiment, all nodes in the routing path are traversed in the order from the root node to the leaf node. For the currently traversed node, the associated data related to its data retrieval method can be queried from the computation cache of its parent node. If the associated data exists in the computation cache of its parent node, the associated data is directly obtained for the calculation of this node, and the calculation result of this node is stored in the computation cache of this node for the calculation of its child nodes. This process continues until the target monitoring object, which is a leaf node, is reached, and the calculation result of the target monitoring object is used as the monitoring data.

[0090] In this embodiment, when a child node needs to monitor data, it first checks whether its parent node has already calculated it. If not, the parent node can calculate and cache the data (stored in the Execution Context) before returning to the child node to continue. This ensures that the parent node's calculation is performed only once and is open to all child nodes, maximizing the reuse of existing results and avoiding computational storms in complex parent-child and sibling node calculations. In large-scale data environments, parent node calculations are usually the most costly (e.g., cross-regional aggregation, complex filtering). Structured caching can serve multiple child paths with a single expensive calculation, thereby supporting more complex and numerous node-based early warning tasks without sacrificing real-time performance, and reducing I / O and computational costs.

[0091] It should be noted that the Execution Context refers to the encapsulation of the runtime environment of the alert task within a single scheduling cycle, including relevant configurations, rule tree instances, route caches, and other information. During computation, the Execution Context is passed to each node to ensure that the node can access cached parent node results, obtain real-time parameters, record computational anomalies, and maintain consistent state and dependencies throughout the entire execution process.

[0092] S104: The warning results are obtained by performing logical operations on the monitoring data according to the warning rules.

[0093] In this embodiment of the application, after obtaining the monitoring data, the monitoring data is aggregated (such as SUM summation, Average mean, Max / Min maximum and minimum value calculation) or compared (such as threshold size comparison) by the rule engine according to the warning rules to obtain the warning result. The warning result can represent whether the warning is triggered.

[0094] To facilitate understanding of the embodiments of this application, the following example uses a retail enterprise's "total sales in Shanghai + Shanghai weather" to illustrate the early warning process of this application:

[0095] 1) Parse Report A: Identify Sheet0 → City Dimension → Cell D5 (Shanghai Total Sales), record row and column coordinates, template path / reports / reportA.cpt, and necessary parameters. Parse Weather API Metadata: Determine the field name, request URL, and necessary parameters for the "Shanghai Minimum Temperature" indicator.

[0096] Based on the report parsing results and API parsing results, the data objects are standardized into nodes. Leaf nodes are identified to generate routing addresses for monitoring objects, including "Report A → Sheet0 → City = Shanghai → Cell D5" and "Weather API → City = Shanghai → Indicator = Minimum Temperature," and their respective data retrieval methods are bound. These routing addresses for monitoring objects are then written into the configuration center to form monitoring lists for both reports and APIs, which are then referenced in the rule configuration interface.

[0097] 2) On the UI interface, the user selects the routing address of the monitored object as the target monitoring object and sets the structured expression "Total Sales < Past 7-Day Average × 0.8 and Shanghai Minimum Temperature < 10℃" as the alert rule. The rule engine parses the above structured expression and verifies the routing address, function, and parameter types, and then serializes the structured expression. Furthermore, the rule engine writes the parsed result of the above structured expression to the task configuration center and triggers a rule update event in the scheduling center, so that the new rule can be used on the next call, achieving hot updating.

[0098] 4) Users configure trigger conditions, such as "trigger daily at 08:00" and "manual instant trigger". The dispatch center registers the trigger corresponding to each trigger condition. When a trigger condition is met, the dispatch center can call the execution of the alert task. The dispatch center subscribes to task addition, pause, resumption, and deletion events to ensure that the corresponding alert tasks and triggers are rebuilt in a timely manner when rules are updated or tasks are maintained, so that the scheduler always loads the latest configuration.

[0099] 5) When triggered daily at 08:00 or manually triggered immediately, load the latest alert rules and the execution context of the rule tree. Retrieve the total sales amount for Shanghai from Report A using the routing address "Report A → Sheet0 → City = Shanghai → Cell D5", and calculate the average total sales amount for Shanghai over the past 7 days using historical data in the execution context. Additionally, retrieve the minimum temperature for Shanghai from the Weather API using the routing address "Weather API → City = Shanghai → Indicator = Minimum Temperature".

[0100] The calculated values ​​(e.g., Shanghai total sales = 450,000, average Shanghai sales over the past 7 days = 600,000, minimum Shanghai temperature = 7℃) are written into the execution context and compared item by item according to "total sales < average of the past 7 days × 0.8" and "minimum Shanghai temperature < 10℃". If all conditions are met, an alert is triggered.

[0101] 6) The warning message will be sent to the responsible person "Shanghai Regional Manager" via email / DingTalk / HTTP and other notification channels through the configured warning method. The warning message includes the task ID of the warning task, timestamp, total sales in Shanghai, average total sales in Shanghai over the past 7 days, minimum temperature in Shanghai and jump link.

[0102] Create a to-do record named "Shanghai Sales Warning," with the responsible person being "Shanghai Regional Manager," a deadline of "Today 12:00," and a description including the triggering metric and link. Set the status to "Pending." The to-do is written to the database and provided to the warning management platform via API. The responsible person can view and update the processing progress in the Todo list.

[0103] 7) Write the results of this warning, warning messages, and task records to the historical database, including the warning task ID, timestamp, rule name of the warning rule, monitoring data (total sales in Shanghai, average total sales in Shanghai over the past 7 days, lowest temperature in Shanghai), responsible person for the task, deadline, status, and remarks. Additionally, the notification log table records the sending time, status, and content of each notification channel.

[0104] Indexes are created based on fields such as task ID, time, and responsible person, supporting API queries and report statistics; expired records are archived according to a retention strategy to ensure historical traceability and stable database and table performance. The operations department can use this data to generate statistical analyses such as "Number of Warning Triggers and Processing Time in Shanghai Region over 30 Days" and "Completion Rate of Tasks for Each Responsible Person," or for auditing and review.

[0105] Based on the above description, the data early warning method provided in this application uses a rule tree model to uniformly model different data sources. Therefore, it achieves rule reuse and unlimited system expansion; a single mechanism can adapt to all scenarios such as reports, BI, and APIs. Its advantage is "unified modeling, improved scalability." Utilizing the hierarchical structure of the rule tree for result reuse avoids redundant calculations and significantly reduces system resource overhead. Furthermore, it employs weakly correlated early warning rules and supports hot updates, allowing users to configure and adjust rules at any time with immediate effect.

[0106] The above describes a data early warning method provided by an embodiment of this application. The following will describe the apparatus for performing the above data early warning method.

[0107] See Figure 5 , Figure 5 This is a schematic diagram of a data early warning device provided in an embodiment of this application. Figure 5 As shown in the figure, an embodiment of this application provides a data early warning device, comprising:

[0108] The monitoring list generation module 501 is used to generate monitoring lists for multiple data sources. The monitoring objects in the monitoring list have unique routing addresses and are bound to corresponding data retrieval methods.

[0109] The early warning response module 502 is used to respond to early warning instructions, which at least indicate a target monitoring object and an early warning rule. The target monitoring object belongs to one or more data sources. It creates an executable rule tree based on the routing address of the target monitoring object, and obtains monitoring data from the data source by driving the rule tree in the manner of data retrieval by the target monitoring object. It performs logical operations on the monitoring data with the early warning rule to obtain the early warning result.

[0110] In one possible implementation, the monitoring list generation module 501, used to generate monitoring lists for multiple data sources respectively, is specifically used for:

[0111] For each of the multiple data sources, the metadata of the data source is obtained, and the attribute data of the data objects in the data source is obtained by parsing the metadata. The attribute data includes the routing address and data retrieval method. The tree structure of the data source is obtained by concatenating the routing addresses of the data objects. Each node in the tree structure represents a data object and is bound to a corresponding data retrieval method. The target data object is determined from the data objects to serve as the leaf node of the tree structure, and the target data object is written into the corresponding monitoring list as the monitoring object of the data source.

[0112] In one possible implementation, the early warning response module 502, which obtains monitoring data from the data source of the target monitoring object by driving the rule tree, is specifically used for:

[0113] Using the target monitoring object as a leaf node, determine the routing path of the target monitoring object in the rule tree; traverse the nodes in the routing path in order from the root node to the leaf node. For the currently traversed node, query the associated data from the calculation cache of its parent node according to the data retrieval method of the node, and store the calculation result obtained by using the associated data in the calculation cache of the node until the target monitoring object is traversed, and use the calculation result of the target monitoring object as the monitoring data.

[0114] In one possible implementation, the warning response module 502, used to respond to warning commands, is specifically used for:

[0115] Receive the structured expression input by the user; parse the structured expression, the parsing result of which must contain at least the target monitoring object and the early warning rule; create an early warning task for the target monitoring object and the early warning rule, and execute the early warning task.

[0116] In one possible implementation, the parsing result of the structured expression also includes at least one warning condition, which is used by the warning response module 502 to perform the warning task, specifically for:

[0117] If any one of the warning conditions is met, execute the warning task; if the warning task is executed for the first time, execute the step of creating an executable rule tree based on the routing address of the target monitored object; if the warning task is not executed for the first time, execute the step of obtaining monitoring data from the data source of the target monitored object by driving the rule tree in the manner of data retrieval of the target monitored object.

[0118] In one possible implementation, the parsing result of the structured expression also includes an alert method. The alert response module 502 is further used for:

[0119] Create and output early warning messages that match the early warning method based on the early warning results.

[0120] It should be noted that the detailed functions of each module in this application can be found in the corresponding disclosure of the above-mentioned data early warning method embodiment, and will not be repeated here.

[0121] This application also provides an electronic device in its embodiments. See also... Figure 6 , Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device in this embodiment may include, but is not limited to, fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 6 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0122] like Figure 6 As shown, the electronic device may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. When the electronic device is powered on, the RAM 603 also stores various programs and data required for the operation of the electronic device. The processing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0123] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, memory cards, hard drives, etc.; and communication devices 609. Communication device 609 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 6Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0124] This application also provides a computer program product including computer-readable instructions, which, when executed on an electronic device, cause the electronic device to implement any of the data warning methods provided in this application.

[0125] This application also provides a computer-readable storage medium that carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any of the data early warning methods provided in this application.

[0126] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0127] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, training equipment, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0128] In the above embodiments, the implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, in the form of a computer program product.

[0129] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, training device, or data center to another website, computer, training device, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

Claims

1. A data early warning method, characterized in that, The data early warning method includes: Generate monitoring lists for multiple data sources, where each monitoring object in the monitoring list has a unique routing address and is bound to a corresponding data retrieval method; In response to an early warning instruction, the early warning instruction shall at least indicate a target monitoring object and an early warning rule, and the data source to which the target monitoring object belongs may be one or more. An executable rule tree is created based on the routing address of the target monitoring object, and monitoring data is obtained from the data source by driving the rule tree in the manner of the target monitoring object. The warning result is obtained by performing logical operations on the monitoring data according to the warning rules.

2. The data early warning method according to claim 1, characterized in that, The generation of monitoring lists for multiple data sources includes: For each of the multiple data sources, the metadata of that data source is obtained, and the attribute data of the data object in that data source is obtained by parsing the metadata. The attribute data includes the routing address and the data retrieval method. The tree structure of the data source is obtained by concatenating the routing addresses of the data objects. Each node in the tree structure represents a data object and is bound to a corresponding data retrieval method. The target data object is determined from the data object to serve as the leaf node of the tree structure, and the target data object is written into the corresponding monitoring list as the monitoring object of the data source.

3. The data early warning method according to claim 2, characterized in that, The step of obtaining monitoring data from the data source by driving the rule tree in the manner of retrieving data from the target monitoring object includes: Using the target monitoring object as a leaf node, determine the routing path of the target monitoring object in the rule tree; The nodes in the routing path are traversed in order from the root node to the leaf node. For the currently traversed node, the associated data is retrieved from the calculation cache of its parent node according to the data retrieval method of the node, and the calculation result obtained by using the associated data is stored in the calculation cache of the node. When the target monitoring object is traversed, the calculation result of the target monitoring object is used as the monitoring data.

4. The data early warning method according to claim 1, characterized in that, The response warning command includes: Receive structured expressions input by the user; The structured expression is parsed, and the parsing result of the structured expression includes at least the target monitoring object and the early warning rule; Create an early warning task for the target monitoring object and the early warning rule, and execute the early warning task.

5. The data early warning method according to claim 4, characterized in that, The parsing result of the structured expression also includes at least one warning condition, and executing the warning task includes: The warning task shall be executed if any one of the warning conditions is met; If the early warning task is being executed for the first time, the step of creating an executable rule tree based on the routing address of the target monitored object is executed. If the warning task is not being executed for the first time, the step of obtaining monitoring data from the data source by driving the rule tree in the manner of retrieving data from the target monitoring object is performed.

6. The data early warning method according to claim 4, characterized in that, The parsing result of the structured expression also includes an alert method, and the data alert method further includes: Based on the warning results, a warning message matching the warning method is created and output.

7. A data early warning device, characterized in that, The data early warning device includes: The monitoring list generation module is used to generate monitoring lists for multiple data sources. The monitoring objects in the monitoring list have unique routing addresses and are bound to corresponding data retrieval methods. The early warning response module is used to respond to early warning instructions, which at least indicate a target monitoring object and an early warning rule. The target monitoring object belongs to one or more data sources. An executable rule tree is created based on the routing address of the target monitoring object, and monitoring data is obtained from the data source by driving the rule tree in the manner of data retrieval of the target monitoring object. The early warning result is obtained by performing logical operations on the monitoring data with the early warning rule.

8. A computer program product, characterized in that, It includes computer-readable instructions that, when executed on an electronic device, cause the electronic device to implement the data warning method as described in any one of claims 1 to 6.

9. An electronic device, characterized in that, It includes at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program to enable the electronic device to implement the data early warning method as described in any one of claims 1 to 6.

10. A computer storage medium, characterized in that, The storage medium carries one or more computer programs that, when executed by an electronic device, enable the electronic device to implement the data early warning method as described in any one of claims 1 to 6.

Images