Metadata-driven intelligent log analysis system and method

Abstract

The invention provides a metadata-driven intelligent log analysis system and method, and the system comprises a dialogue interaction module which is used for extracting a technical problem proposed by a user; the keyword extraction and query module is used for carrying out keyword extraction, service attribute labeling and query on the technical problem based on the service metadata pre-identifier; the query statement dynamic construction module dynamically constructs a query statement and performs log data query; the time conversion module performs context conversion on the keyword query result and the log data query result based on a time sequence, and outputs a final log query result; and the hierarchical structured RAG module performs context structured processing on the query result and the technical problem, and outputs a final solution through large model analysis. According to the method, natural language question input is supported, the use threshold is remarkably reduced, accurate retrieval of operation and maintenance data and business context enhancement are achieved through collaborative association of keywords and metadata, and the accuracy of question analysis is improved.

Description

Technical Field

[0001] This invention belongs to the field of intelligent operation and maintenance management technology, and in particular relates to a metadata-driven intelligent log analysis system and method. Background Technology

[0002] With the widespread adoption of cloud computing and microservice architectures, the operational log data generated by modern enterprise information systems is growing exponentially. Traditional operation and maintenance management systems face numerous technical challenges in handling massive log data and complex operational issues. Existing log query systems typically require operations personnel to master complex query syntax (such as Elasticsearch ES | QL), cannot directly handle operational issues described in natural language, and have a high learning curve for non-professional operations personnel. Faced with terabytes of log data and the unified log management scenario across systems / services in a microservice architecture, writing complex business retrieval logic is difficult, and data retrieval efficiency is low.

[0003] Existing patent CN120725139A discloses a method for parsing software operation and maintenance logs based on meta-context learning using a large-scale language model. The method comprises the following steps: S1: raw log preprocessing; S2: log clustering and representative dataset construction; S3: meta-context training data construction; S4: large-scale language model meta-context training; S5: parsing and inference dataset construction; S6: large-scale language model log parsing and inference. This invention provides an efficient, accurate, and rapidly adaptable solution for log parsing tasks in the software operation and maintenance field, combining offline meta-context training with online log parsing. It is suitable for log parsing tasks in industrial software systems and offers significant advantages in parsing accuracy. Summary of the Invention

[0004] Traditional operations and maintenance log analysis systems cannot effectively correlate log data with business metadata (such as exception code definitions, API documentation, field models, etc.). Operations and maintenance personnel often cannot effectively acquire relevant knowledge and cannot conduct in-depth business and system analysis. At the same time, the system mainly provides data display functions after querying, lacking intelligent problem analysis and solution recommendation capabilities. Operations and maintenance personnel need to rely on experience to diagnose problems, which is inefficient and prone to errors.

[0005] To address the aforementioned technical problems, the present invention provides the following technical solution: a metadata-driven intelligent log analysis system, comprising a dialogue interaction module for extracting technical questions raised by users; a keyword extraction and query module for extracting keywords from technical questions based on pre-identification of business metadata, labeling keywords with business attributes, and performing keyword queries; a query statement dynamic construction module for dynamically constructing efficient query statements based on the extracted keywords and business attributes, and performing log data queries; a time conversion module for contextualizing the keyword query results and log data query results based on chronological order, and outputting the final log query results; and a hierarchical structured RAG module for contextualizing the final log query results and technical questions, and outputting the final solution through large model analysis.

[0006] Specifically, the keyword extraction and query module includes a keyword extraction agent and a metadata query agent. The keyword extraction agent has a prompt word template, which predefines key information categories in the operation and maintenance field. The keyword extraction agent extracts keywords from the operation and maintenance-related business terms and system identifiers pre-identified in the prompt word template, and marks the keywords with business attributes during extraction.

[0007] Specifically, the metadata query agent identifies the source data type based on the metadata attributes of the keywords, filters out the keywords that need to be queried for metadata, selects the corresponding metadata service interface, performs the metadata query, obtains the complete business information corresponding to the keywords, and associates the query results with the original keywords to form an enhanced query context as the keyword query results and outputs them.

[0008] Specifically, the hierarchical RAG module performs four-layer structured processing on the final log query results and the technical questions raised by users, and then inputs them into the large model for analysis to obtain the final solution.

[0009] Specifically, the four-layer structured processing includes: the first layer, the problem background layer, which constructs a contextual structure for the user's original problem, including its classification, urgency, related historical issues, and the systems and business scope involved; the second layer, the log text and summary layer, which constructs a contextual structure for the retrieved log data summaries and statistical information, detailed content of key log entries, time distribution and pattern analysis of log data, and aggregated statistical results of abnormal data; the third layer, the business knowledge layer, which constructs a contextual structure and integrates knowledge about the complete definition and explanation of relevant exception codes, the business meaning of model fields, the documentation and specifications of relevant API interfaces, and the contextual information of business processes and system architecture; and the fourth layer, the solution layer, which inputs the structured context processed by the above three layers into the large model, and outputs a structured and standardized solution, as well as problem prevention measures and best practice templates, according to the preset problem analysis guidance framework and methodology.

[0010] Specifically, the query statement dynamic construction module dynamically constructs efficient ES|QL query statements based on extracted keywords and business attributes through a large model. It fills the extracted keywords into the corresponding positions of the query template according to their attribute types, intelligently combines multiple query conditions, and automatically selects the optimal indexing strategy based on the query conditions.

[0011] Specifically, the dialogue interaction module extracts key technical terms and business information from one or more rounds of dialogue with the user, compresses redundant statements from the user while ensuring the logical connection and progressive relationship between questions, and performs a self-check of the integrity of the questions before outputting the technical questions.

[0012] Specifically, the time conversion module performs intelligent conversion on the relative time expressions in natural language in the log data based on the current time context, converting the relative time into a specific timestamp range.

[0013] A metadata-driven intelligent log analysis method, applied to the aforementioned metadata-driven intelligent log analysis system, includes the following steps: S1. The dialogue interaction module interacts with the user through language to extract the technical questions raised by the user; S2. Extract keywords for technical issues based on pre-identification of business metadata, label keywords with business attributes, and perform keyword queries; S3. Based on the extracted keywords and business attributes, dynamically construct query statements to query log data; S4. Perform context transformation on the keyword query results and log data query results based on the time sequence, and output the final log query results; S5, the hierarchical RAG module analyzes and diagnoses user questions based on the final log query results, and outputs the final solution.

[0014] Specifically, the hierarchical RAG module in S5 performs four-layer structuring on the final log query results and the technical issues raised by users. After constructing a structured context of technical issues, log query results and business knowledge, it inputs them into the large model to analyze and diagnose the technical issues, and finally obtains the solutions to the technical issues.

[0015] The beneficial effects of this invention are that it supports natural language question input and achieves high-precision keyword extraction through business metadata pre-identification technology, significantly lowering the barrier to entry. Through the collaborative association of keywords and metadata, it enables accurate retrieval of operational data and enhancement of business context, improving the accuracy of problem analysis. Multi-layered structured context building technology enhances the business and system relevance of problem analysis, providing in-depth business insights and solution suggestions. It also supports intelligent processing of multi-turn dialogues, adapting to the progressive problem diagnosis needs of complex operational scenarios. Attached Figure Description

[0016] Figure 1 This is a system structure diagram of the present invention.

[0017] Figure 2 This is a flowchart of the method of the present invention. Detailed Implementation

[0018] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0019] Example 1: A metadata-driven intelligent log analysis system, such as Figure 1 As shown, the system includes a dialogue interaction module that extracts technical questions raised by users; a keyword extraction and query module that extracts keywords from technical questions based on pre-identified business metadata, labels keywords with business attributes, and performs keyword queries; a dynamic query statement construction module that dynamically constructs efficient query statements based on extracted keywords and business attributes and performs log data queries; a time conversion module that performs context conversion on keyword query results and log data query results based on chronological order and outputs the final log query results; and a hierarchical structured RAG module that performs contextual structuring processing on the final log query results and technical questions, and outputs the final solution through large model analysis.

[0020] A metadata-driven intelligent log analysis method is applied to the aforementioned metadata-driven intelligent log analysis system, such as... Figure 2 As shown, it includes the following steps: S1. The dialogue interaction module interacts with the user through language to extract the technical questions raised by the user; S2. Extract keywords for technical issues based on pre-identification of business metadata, label keywords with business attributes, and perform keyword queries; S3. Based on the extracted keywords and business attributes, dynamically construct query statements to query log data; S4. Perform context transformation on the keyword query results and log data query results based on the time sequence, and output the final log query results; S5, the hierarchical RAG module analyzes and diagnoses user questions based on the final log query results, and outputs the final solution.

[0021] This embodiment aims to address the technical limitations of traditional operation and maintenance log analysis systems by providing a metadata-driven intelligent operation and maintenance log analysis system and method based on retrieval enhancement generation technology. By combining the natural language understanding capabilities of a large language model, intelligent keyword extraction technology, and operation and maintenance metadata association enhancement technology, it achieves intelligent analysis of operation and maintenance problems and automatic solution recommendation.

[0022] This implementation employs a Retrieval Enhanced Generation (RAG) architecture, achieving intelligent transformation from natural language questions to professional operations and maintenance (O&M) analysis results through the collaborative work of various modules. The keyword extraction and query module includes a keyword extraction agent and a metadata query agent. Traditional keyword extraction methods primarily rely on general natural language processing techniques, which cannot accurately identify O&M-related professional terms and business identifiers. This embodiment pre-identifies O&M-related business terms and system identifiers in the prompt word template, enabling the large language model to accurately understand and extract key information in the O&M scenario. The prompt word template pre-defines key information categories in the O&M domain, including: Time identifiers: such as "last hour", "yesterday morning", "within this week", etc., to express time ranges; Service identifiers: such as microservice names, application names, cluster names, and other system identifiers; Exception identifiers: such as exception code format (numbers starting with ERR), exception type keywords, etc.; Link identifiers: such as trace_id, span_id, and other link tracing related identifiers; Business identifiers: such as order number, user ID, tenant ID, transaction serial number, and other business keywords; Model field identifiers: such as database field names, API parameter names, and other technical identifiers; The keyword extraction agent extracts query keywords based on business metadata pre-identification technology. During the keyword extraction process, each keyword is labeled with business attributes to guide subsequent metadata queries. Attribute categories include: Metadata association attributes: Indicate whether a metadata query is required for this keyword; Business domain attribute: Identifies the business domain to which the keyword belongs (such as payment, order, user, etc.); Data type attribute: Identifies the data type of the keyword (string, number, time, etc.); Query priority attribute: Indicates the importance level of keywords in the query; The metadata query agent performs precise metadata retrieval based on the keyword attributes marked above.

[0023] During the operation of the keyword extraction and query module, this embodiment designs a collaborative working mechanism between the keyword extraction agent and the metadata query agent. Through the business attribute identifier of the keywords, accurate retrieval and association of metadata are achieved. The collaborative workflow includes: During the keyword extraction process, the keyword extraction agent labels each keyword with business attributes; Based on the metadata association attributes of the keywords, filter out the keywords that need to be queried for metadata; Select the appropriate metadata service interface based on the business domain attributes of the keywords; Perform precise metadata queries to obtain complete business information corresponding to keywords; The query results are associated with the original keywords to form an enhanced query context; The metadata query agent also uses exact metadata matching technology during runtime: Exception code matching: Identify exception codes from keywords and query their full definitions; Model field matching: Identify technical identifiers such as models, field names, and API parameter names, and query their business meanings and constraint rules; Service interface matching: Identify the API interface name and query its complete interface documentation and parameter descriptions; Business entity matching: Identify business entity identifiers (such as order number, user ID) and query their associated business process information; For the keyword query results output by the keyword extraction and query module, a context enhancement strategy is executed, specifically including: Direct enhancement: Based on the template and reserved fields, the retrieved metadata information is directly added to the analysis context; Enhanced Relationships: Based on the relationships between metadata, supplement relevant business knowledge.

[0024] The query statement dynamic construction module dynamically constructs efficient ES|QL query statements based on extracted keywords and business attributes through a large model. It fills the extracted keywords into the corresponding positions in the query template according to their attribute types, intelligently combines multiple query conditions, and automatically selects the optimal indexing strategy based on the query conditions.

[0025] The dynamic construction of query statements is based on different scenarios, using different query suggestion templates (anomaly queries, performance queries, link queries, etc.). During the construction process, the following operations will continue: Parameter population: The extracted keywords are populated into the corresponding positions in the query template according to their attribute types; Condition combination: Intelligently combines multiple query conditions using logical operators such as AND and OR; Range optimization: Optimize time range, numerical range, etc., to improve query efficiency; Indexing strategy: Automatically select the optimal indexing strategy based on the query conditions; Result set control: Set appropriate LIMIT and SORT conditions based on the problem type.

[0026] The time conversion module intelligently converts the relative time expressions in natural language in log data based on the current time context, transforming the relative time into a specific timestamp range.

[0027] For relative time expressions in natural language, the system implements intelligent conversion based on the current time context: Relative time recognition: Recognizes relative time expressions such as "recently", "yesterday", and "this week"; Absolute time conversion: Converting relative time into a specific timestamp range; Time zone handling: Automatically handles time zone conversion based on system configuration; Time precision optimization: Automatically adjusts time precision (seconds, minutes, hours, etc.) based on the query scenario.

[0028] The conversation management module extracts key technical terms and business information from one or more rounds of conversation with the user, compresses redundant statements from the user while ensuring the logical connection and progression between questions, and performs a self-check of the integrity of the questions before outputting the technical questions.

[0029] The hierarchical RAG module performs four-layer structuring on the final log query results and the technical issues raised by users. After constructing a structured context of technical issues, log query results, and business knowledge, it inputs them into the large model to analyze and diagnose the technical issues, and finally obtains solutions to the technical issues.

[0030] The hierarchical RAG module processes context according to a four-layer structured prompt word template, ensuring complete context for feeding the large model. It also adds relevant content such as content summaries, business background knowledge, and system background knowledge, guaranteeing the depth of problem analysis and its business relevance. The first layer of problem background specifically includes: a complete description of the user's original problem, problem classification and urgency assessment, relevant historical problem context (multi-turn dialogue scenarios), and the system and business scope involved in the problem; The second layer consists of log text and summaries, specifically including: summaries and statistical information of retrieved log data, detailed content of key log entries, temporal distribution and pattern analysis of log data, and aggregated statistical results of abnormal data; The third layer of business knowledge specifically includes: the complete definition and explanation of relevant exception codes, the explanation of the business meaning of model fields, the documentation and specifications of relevant API interfaces, and the contextual information of business processes and system architecture; The fourth layer of solutions specifically includes: a guiding framework and methodology for problem analysis, standard format requirements for solution generation, templates for preventative measures and best practices, and structured format specifications for output results.

[0031] The hierarchical and structured RAG module inputs the processed structured context into the large model, and outputs structured and standardized solutions, as well as problem prevention measures and best practice templates, in accordance with the preset problem analysis guidance framework and methodology.

[0032] Compared with the prior art, this embodiment has the following significant advantages: High level of intelligence: It supports natural language question input and achieves high-precision keyword extraction through business metadata pre-identification technology, significantly reducing the threshold for use; High retrieval accuracy: Through the collaborative association of keywords and metadata, accurate retrieval of operation and maintenance data and enhancement of business context are achieved, improving the accuracy of problem analysis; Business Insights: Multi-layered structured context building technology enhances the business and system relevance of problem analysis, providing in-depth business insights and solution suggestions; Interactive experience: It supports intelligent processing of multi-turn dialogues and can adapt to the progressive problem diagnosis needs of complex operation and maintenance scenarios.

[0033] Example 2: A metadata-driven intelligent log analysis system includes a dialogue interaction module that extracts technical questions raised by users; a keyword extraction and query module that extracts keywords from technical questions based on pre-identified business metadata, labels keywords with business attributes, and performs keyword queries; a dynamic query statement construction module that dynamically constructs efficient query statements based on extracted keywords and business attributes and performs log data queries; a time conversion module that performs context conversion on keyword query results and log data query results based on chronological order and outputs the final log query results; and a hierarchical structured RAG module that performs contextual structuring processing on the final log query results and technical questions, and outputs the final solution through large model analysis.

[0034] A metadata-driven intelligent log analysis method, applied to the aforementioned metadata-driven intelligent log analysis system, includes the following steps: S1. The dialogue interaction module interacts with the user through language to extract the technical questions raised by the user; S2. Extract keywords for technical issues based on pre-identification of business metadata, label keywords with business attributes, and perform keyword queries; S3. Based on the extracted keywords and business attributes, dynamically construct query statements to query log data; S4. Perform context transformation on the keyword query results and log data query results based on the time sequence, and output the final log query results; S5, the hierarchical RAG module analyzes and diagnoses user questions based on the final log query results, and outputs the final solution.

[0035] This embodiment aims to address the technical limitations of traditional operation and maintenance log analysis systems by providing a metadata-driven intelligent operation and maintenance log analysis system and method based on retrieval enhancement generation technology. By combining the natural language understanding capabilities of a large language model, intelligent keyword extraction technology, and operation and maintenance metadata association enhancement technology, it achieves intelligent analysis of operation and maintenance problems and automatic solution recommendation.

[0036] This implementation employs a Retrieval Enhanced Generation (RAG) architecture, achieving intelligent transformation from natural language questions to professional operations and maintenance (O&M) analysis results through the collaborative work of various modules. The keyword extraction and query module includes a keyword extraction agent and a metadata query agent. Traditional keyword extraction methods primarily rely on general natural language processing techniques, which cannot accurately identify O&M-related professional terms and business identifiers. This embodiment pre-identifies O&M-related business terms and system identifiers in the prompt word template, enabling the large language model to accurately understand and extract key information in the O&M scenario. The prompt word template pre-defines key information categories in the O&M domain, including: Time identifiers: such as "last hour", "yesterday morning", "within this week", etc., to express time ranges; Service identifiers: such as microservice names, application names, cluster names, and other system identifiers; Exception identifiers: such as exception code format (numbers starting with ERR), exception type keywords, etc.; Link identifiers: such as trace_id, span_id, and other link tracing related identifiers; Business identifiers: such as order number, user ID, tenant ID, transaction serial number, and other business keywords; Model field identifiers: such as database field names, API parameter names, and other technical identifiers; The keyword extraction agent extracts query keywords based on business metadata pre-identification technology. During the keyword extraction process, each keyword is labeled with business attributes to guide subsequent metadata queries. Attribute categories include: Metadata association attributes: Indicate whether a metadata query is required for this keyword; Business domain attribute: Identifies the business domain to which the keyword belongs (such as payment, order, user, etc.); Data type attribute: Identifies the data type of the keyword (string, number, time, etc.); Query priority attribute: Indicates the importance level of keywords in the query; The metadata query agent performs precise metadata retrieval based on the keyword attributes marked above.

[0037] During the operation of the keyword extraction and query module, this embodiment designs a collaborative working mechanism between the keyword extraction agent and the metadata query agent. Through the business attribute identifier of the keywords, accurate retrieval and association of metadata are achieved. The collaborative workflow includes: During the keyword extraction process, the keyword extraction agent labels each keyword with business attributes; Based on the metadata association attributes of the keywords, filter out the keywords that need to be queried for metadata; Select the appropriate metadata service interface based on the business domain attributes of the keywords; Perform precise metadata queries to obtain complete business information corresponding to keywords; The query results are associated with the original keywords to form an enhanced query context; The metadata query agent also uses exact metadata matching technology during runtime: Exception code matching: Identify exception codes from keywords and query their full definitions; Model field matching: Identify technical identifiers such as models, field names, and API parameter names, and query their business meanings and constraint rules; Service interface matching: Identify the API interface name and query its complete interface documentation and parameter descriptions; Business entity matching: Identify business entity identifiers (such as order number, user ID) and query their associated business process information; For the keyword query results output by the keyword extraction and query module, a context enhancement strategy is executed, specifically including: Direct enhancement: Based on the template and reserved fields, the retrieved metadata information is directly added to the analysis context; Enhanced Relationships: Based on the relationships between metadata, supplement relevant business knowledge.

[0038] The query statement dynamic construction module dynamically constructs efficient ES|QL query statements based on extracted keywords and business attributes through a large model. It fills the extracted keywords into the corresponding positions in the query template according to their attribute types, intelligently combines multiple query conditions, and automatically selects the optimal indexing strategy based on the query conditions.

[0039] The dynamic construction of query statements is based on different scenarios, using different query suggestion templates (anomaly queries, performance queries, link queries, etc.). During the construction process, the following operations will continue: Parameter population: The extracted keywords are populated into the corresponding positions in the query template according to their attribute types; Condition combination: Intelligently combines multiple query conditions using logical operators such as AND and OR; Range optimization: Optimize time range, numerical range, etc., to improve query efficiency; Indexing strategy: Automatically select the optimal indexing strategy based on the query conditions; Result set control: Set appropriate LIMIT and SORT conditions based on the problem type.

[0040] The time conversion module intelligently converts the relative time expressions in natural language in log data based on the current time context, transforming the relative time into a specific timestamp range.

[0041] For relative time expressions in natural language, the system implements intelligent conversion based on the current time context: Relative time recognition: Recognizes relative time expressions such as "recently", "yesterday", and "this week"; Absolute time conversion: Converting relative time into a specific timestamp range; Time zone handling: Automatically handles time zone conversion based on system configuration; Time precision optimization: Automatically adjusts time precision (seconds, minutes, hours, etc.) based on the query scenario.

[0042] The conversation management module extracts key technical terms and business information from one or more rounds of conversation with the user, compresses redundant statements from the user while ensuring the logical connection and progression between questions, and performs a self-check of the integrity of the questions before outputting the technical questions.

[0043] To address the multi-turn interaction requirements in complex operation and maintenance scenarios, this embodiment designs a dialogue management function, including context compression for multi-turn dialogues. Specific steps include: Key information extraction: Extract key technical terms and business information from historical dialogues; Redundant content filtering: Removes small talk, repetition, and irrelevant information from conversations; Maintaining logical relationships: Preserving the logical connections and progressive relationships between questions; Context length control: Keeps the compressed dialogue within the range of parameter indicators; After context compression, a self-check of issue integrity is performed, specifically including: Information integrity check: Ensure that the compressed issue contains all necessary technical details; Semantic consistency verification: Verify the consistency between the semantics of the compressed question and the original intent; Keyword protection: Ensure that important technical terms and business identifiers are not lost during compression; Contextual coherence maintenance: Maintaining the logical coherence and understandability of the problem description.

[0044] The hierarchical RAG module performs four-layer structuring on the final log query results and the technical issues raised by users. After constructing a structured context of technical issues, log query results, and business knowledge, it inputs them into the large model to analyze and diagnose the technical issues, and finally obtains solutions to the technical issues.

[0045] The hierarchical RAG module processes context according to a four-layer structured prompt word template, ensuring complete context for feeding the large model. It also adds relevant content such as content summaries, business background knowledge, and system background knowledge, guaranteeing the depth of problem analysis and its business relevance. The first layer of problem background specifically includes: a complete description of the user's original problem, problem classification and urgency assessment, relevant historical problem context (multi-turn dialogue scenarios), and the system and business scope involved in the problem; The second layer consists of log text and summaries, specifically including: summaries and statistical information of retrieved log data, detailed content of key log entries, temporal distribution and pattern analysis of log data, and aggregated statistical results of abnormal data; The third layer of business knowledge specifically includes: the complete definition and explanation of relevant exception codes, the explanation of the business meaning of model fields, the documentation and specifications of relevant API interfaces, and the contextual information of business processes and system architecture; The fourth layer of solutions specifically includes: a guiding framework and methodology for problem analysis, standard format requirements for solution generation, templates for preventative measures and best practices, and structured format specifications for output results.

[0046] The hierarchical and structured RAG module inputs the processed structured context into the large model, and outputs structured and standardized solutions, as well as problem prevention measures and best practice templates, in accordance with the preset problem analysis guidance framework and methodology.

[0047] Compared with the prior art, this embodiment has the following significant advantages: High level of intelligence: It supports natural language question input and achieves high-precision keyword extraction through business metadata pre-identification technology, significantly reducing the threshold for use; High retrieval accuracy: Through the collaborative association of keywords and metadata, accurate retrieval of operation and maintenance data and enhancement of business context are achieved, improving the accuracy of problem analysis; Business Insights: Multi-layered structured context building technology enhances the business and system relevance of problem analysis, providing in-depth business insights and solution suggestions; Interactive experience: It supports intelligent processing of multi-turn dialogues and can adapt to the progressive problem diagnosis needs of complex operation and maintenance scenarios.

Claims

1. A metadata-driven intelligent log analysis system, characterized in that, It includes a dialogue interaction module to extract technical questions raised by users; it also includes a keyword extraction and query module to extract keywords from technical questions based on pre-identification of business metadata, label the keywords with business attributes, and perform keyword queries. The query statement dynamic construction module dynamically constructs efficient query statements based on extracted keywords and business attributes, and performs log data queries; the time conversion module performs context conversion on the keyword query results and log data query results based on the time sequence, and outputs the final log query results. The hierarchical RAG module performs contextualized processing on the final log query results and technical issues, and outputs the final solution through large model analysis.

2. The metadata-driven intelligent log analysis system according to claim 1, characterized in that, The keyword extraction and query module includes a keyword extraction agent and a metadata query agent. The keyword extraction agent has a prompt word template. The prompt word template predefines key information categories in the operation and maintenance field. The keyword extraction agent extracts keywords from the operation and maintenance-related business terms and system identifiers pre-identified in the prompt word template, and marks the keywords with business attributes during extraction.

3. The metadata-driven intelligent log analysis system according to claim 2, characterized in that, The metadata query agent identifies the source data type based on the metadata attributes of the keywords, filters out the keywords that need to be queried for metadata, selects the corresponding metadata service interface, performs the metadata query, obtains the complete business information corresponding to the keywords, and associates the query results with the original keywords to form an enhanced query context as the keyword query results and outputs them.

4. The metadata-driven intelligent log analysis system according to claim 1, characterized in that, The hierarchical RAG module performs four-layer structured processing on the final log query results and the technical questions raised by users, and then inputs them into the large model for analysis to obtain the final solution.

5. The metadata-driven intelligent log analysis system according to claim 1 or 4, characterized in that, The four-layer structured processing includes the first layer, the problem background layer, which constructs a contextual structure for the user's original problem, including its classification, urgency, related historical issues, and the systems and business scope involved. The second layer, the log text and summary layer, constructs a contextual structure for the retrieved log data summaries and statistical information, detailed content of key log entries, time distribution and pattern analysis of log data, and aggregated statistical results of abnormal data. The third layer, the business knowledge layer, constructs a contextual structure and integrates knowledge for the complete definition and explanation of relevant exception codes, explanations of the business meaning of model fields, documentation and specifications of relevant API interfaces, and contextual information of business processes and system architecture. The fourth layer, the solution layer, inputs the structured context processed by the above three layers into the large model, and outputs structured and standardized solutions, as well as problem prevention measures and best practice templates, according to the preset problem analysis guidance framework and methodology.

6. The metadata-driven intelligent log analysis system according to claim 1, characterized in that, The query statement dynamic construction module dynamically constructs efficient ES|QL query statements based on extracted keywords and business attributes through a large model. It fills the extracted keywords into the corresponding positions in the query template according to their attribute types, intelligently combines multiple query conditions, and automatically selects the optimal indexing strategy based on the query conditions.

7. The metadata-driven intelligent log analysis system according to claim 1, characterized in that, The dialogue interaction module extracts key technical terms and business information from one or more rounds of dialogue with the user, compresses redundant statements from the user while ensuring the logical connection and progressive relationship between questions, and performs a self-check of the integrity of the questions before outputting the technical questions.

8. The metadata-driven intelligent log analysis system according to claim 1, characterized in that, The time conversion module performs intelligent conversion on the relative time expressions in natural language in log data based on the current time context, converting the relative time into a specific timestamp range.

9. A metadata-driven intelligent log analysis method, applied to the metadata-driven intelligent log analysis system according to any one of claims 1-8, characterized in that, Includes the following steps: S1. The dialogue interaction module interacts with the user through language to extract the technical questions raised by the user; S2. Extract keywords for technical issues based on pre-identification of business metadata, label keywords with business attributes, and perform keyword queries; S3. Based on the extracted keywords and business attributes, dynamically construct query statements to query log data; S4. Perform context transformation on the keyword query results and log data query results based on the time sequence, and output the final log query results; S5, the hierarchical RAG module analyzes and diagnoses user questions based on the final log query results, and outputs the final solution.

10. The metadata-driven intelligent log analysis method according to claim 9, characterized in that, In S5, the hierarchical RAG module performs four-layer structuring on the final log query results and the technical issues raised by users. After constructing a structured context of technical issues, log query results, and business knowledge, it inputs them into the large model to analyze and diagnose the technical issues, and finally obtains solutions to the technical issues.

Images