Equipment connection platform intelligent observation method and electronic device

Abstract

The invention discloses an equipment connection platform intelligent observation method and an electronic device, and relates to the technical field of computers, and the method comprises the steps: determining a source channel according to an obtained full-link burying point log, recognizing a target field based on the source channel, and carrying out the dimension extension in combination with an equipment identifier, obtaining a dimension expansion issuing log data stream and a dimension expansion response log data stream; determining an evaluation index according to the dimension expansion issuing log data flow and the dimension expansion response log data flow; based on the evaluation metrics, the metrics insight agent is asynchronously invoked to identify abnormal metrics that deviate from normal periodic or trending fluctuations according to the evaluation metrics. According to the method and the device, the defect that time and labor are wasted in troubleshooting due to different formats of burying point logs of all channels is overcome, the abnormal indexes are rapidly and accurately positioned, a large number of invalid alarms generated due to service fluctuation are avoided, an operation and maintenance team is liberated from an alarm storm and focuses on the problems really needing to be processed, and the working efficiency is improved.

Description

Intelligent observation method and electronic device for equipment connection platform Technical Field

[0001] This application relates to the field of computer technology, and in particular to an intelligent observation method and electronic device for a device connection platform. Background Technology

[0002] With the rapid development of IoT and Industrial Internet technologies, device-connected business systems have become core infrastructure in fields such as smart manufacturing, smart cities, and smart energy. These systems, through the widespread access of massive numbers of device terminals, achieve real-time data collection, remote control, and business collaboration. Their stability and reliability directly affect production efficiency and operational safety. To ensure the healthy operation of these systems, the industry has generally established corresponding monitoring systems to perceive the system's operating status in real time and issue anomaly alerts, thereby ensuring business continuity.

[0003] Currently, monitoring the operation of device-connected business systems mainly relies on backend analysis based on metrics. Specifically, a monitoring system is deployed on the cloud platform or gateway side to collect raw operational data such as device heartbeat, online / offline status, request response latency, and error rate. This data is then calculated into a series of quantifiable evaluation metrics according to preset rules or formulas. Subsequently, by setting static thresholds (such as "error rate exceeding 5%" or "response latency greater than 500ms") or simple year-on-year / month-on-month rules, it is determined whether the system is abnormal. When the conditions are met, an alarm notification is triggered, thereby guiding maintenance personnel to intervene.

[0004] However, due to the complex nature of equipment control systems with multiple channels and protocols, the aforementioned monitoring solutions often struggle to collect and analyze equipment behavior under heterogeneous protocols in a unified and consistent manner. This easily leads to blind spots in monitoring data, failing to form a complete view of the entire operational status, making compatibility issues themselves a monitoring blind spot. Furthermore, the analysis of equipment control operation indicators depends on analytical capabilities, and alarm accuracy depends on the calculation and selection of indicators. This results in two core problems: First, static thresholds cannot adapt to the cyclical fluctuations of business operations, such as peak and off-peak periods, easily generating a large number of false alarms and missed alarms, leading to alarm fatigue. Second, analytical capabilities are passive and rigid, unable to proactively discover unknown, potentially correlated anomalies from massive operational data, let alone deeply locate the root causes of anomalies. Essentially, it remains a reactive and inefficient response mode, failing to meet the high availability and intelligent operation and maintenance requirements of modern complex business systems. Summary of the Invention

[0005] This application provides an intelligent observation method and electronic device for a device connection platform to solve the shortcomings of existing technologies where different log formats for each channel make troubleshooting time-consuming and laborious. It enables rapid and accurate location of abnormal indicators, avoids a large number of invalid alarms caused by business fluctuations, frees the operation and maintenance team from alarm storms, allows them to focus on the real problems that need to be addressed, and improves work efficiency.

[0006] This application provides an intelligent observation method for a device connection platform, comprising: determining the source channel based on the acquired end-to-end embedded logs; identifying target fields based on the source channel and performing dimensional expansion in conjunction with device identifiers to obtain expanded-dimensional distribution log data streams and expanded-dimensional response log data streams; determining evaluation metrics based on the expanded-dimensional distribution log data streams and expanded-dimensional response log data streams; and asynchronously invoking a metric insight agent based on the evaluation metrics to identify abnormal metrics that deviate from normal periodic or trend fluctuations.

[0007] According to the intelligent observation method for a device connection platform provided in this application, based on the source channel, target fields are identified, and dimension expansion is performed in combination with device identifiers to obtain expanded dimension distribution log data streams and expanded dimension response log data streams. The method includes: based on the source channel, identifying target fields to split the end-to-end embedded logs into distribution log data streams and response log data streams; using the device identifier as the query key, asynchronously and in parallel querying a preset database, and backfilling the queried device attributes into the logs of the corresponding log data streams to form corresponding expanded dimension distribution log data streams and expanded dimension response log data streams; wherein, the preset database is constructed in advance based on the device identifier and corresponding device attributes.

[0008] According to the intelligent observation method for a device connection platform provided in this application, based on the source channel, target fields are identified to split the end-to-end event logs into a delivery log data stream and a response log data stream. The method includes: identifying business fields as target fields based on the user-side channel as the source channel to determine the business intent; when the business intent is determined to be a request, the corresponding event log is determined to be a delivery log data stream; when the business intent is determined to be a response, the corresponding event log is determined to be a response log data stream; and associating and matching the delivery log data stream and the response log data stream.

[0009] According to the intelligent observation method for a device connection platform provided in this application, based on the source channel, target fields are identified to split the end-to-end embedded logs into a delivery log data stream and a response log data stream. The method further includes: identifying step fields as target fields based on the Unified Device Service Engine (UDSE) as the source channel, and determining step nodes; when a step node is determined to be a process initiation or task distribution node, determining the corresponding embedded log as a delivery log data stream; when a step node is determined to be a process termination node, determining the corresponding embedded log as a response log data stream; and associating and matching the delivery log data stream and the response log data stream.

[0010] According to the intelligent observation method for a device connection platform provided in this application, based on the source channel, target fields are identified to split the end-to-end embedded logs into a delivery log data stream and a response log data stream. The method further includes: based on the single-batch or batch control channel of the source channel as a domain model, identifying the business fields of the corresponding embedded logs to obtain the business domain; wherein, the domain model is constructed prior to device control business, control entities, and interaction rules; when the business domain is determined to be device control, the control type field of the corresponding embedded log is identified, and the corresponding embedded log is divided into single-batch and batch control logs according to the identified control type field. The system controls both single-control and batch-control data streams. For both single-control and batch-control data streams, it identifies the corresponding step fields and determines the corresponding event logs as the delivery log data stream based on the identified step nodes as process initiation or task distribution nodes. Based on the identified step nodes as process termination nodes, it determines the corresponding event logs as the response log data stream. For single-control data streams, it associates and matches the corresponding delivery log data streams and the corresponding response log data streams. For batch-control data streams, it associates and matches each delivery log in the corresponding delivery log data stream with multiple response logs in the corresponding response log data stream.

[0011] According to the intelligent observation method for a device connection platform provided in this application, evaluation indicators are determined based on the extended dimension distribution log data stream and the extended dimension response log data stream. These indicators include: determining the interface call volume indicator based on the extended dimension distribution log data stream; determining the control success rate indicator and the error code quantity indicator based on the extended dimension distribution log data stream, the extended dimension response log data stream, and the corresponding associated and matched distribution log data stream and response log data stream, combined with the response code field in the logs; determining the interface time consumption indicator based on the extended dimension distribution log data stream, the associated and matched distribution log data stream and response log data stream, combined with the distribution phase time and the response phase time; and obtaining the evaluation indicators based on the interface call volume indicator, the control success rate indicator, the error code quantity indicator, and the interface time consumption indicator.

[0012] According to the intelligent observation method for a device connection platform provided in this application, an indicator insight agent is asynchronously invoked based on evaluation indicators to identify abnormal indicators that deviate from normal periodic or trend fluctuations. This includes: asynchronously invoking the indicator insight agent based on evaluation indicators to identify abnormal indicators that deviate from normal periodic or trend fluctuations using a target detection algorithm; wherein the target detection algorithm is obtained by matching historical evaluation indicators based on the stability, periodicity, and volatility of historical full-link tracking logs according to a preset algorithm matching strategy; the stability, periodicity, and volatility of historical evaluation indicators are identified by the candidate detection algorithm in parallel based on the meta-learning module built into the invoked indicator insight agent.

[0013] According to the intelligent observation method for a device connection platform provided in this application, the candidate detection algorithm includes at least one of the three Sigma rule, long short-term memory network, and isolated forest; the preset algorithm matching strategy is used to: select the three Sigma rule when the indicator is stable and non-periodic; select the long short-term memory network when the indicator is periodic; and select the isolated forest when the indicator fluctuates violently and has no fluctuation pattern.

[0014] According to the intelligent observation method for a device connection platform provided in this application, after determining the evaluation indicators based on the expanded dimension distribution log data stream and the expanded dimension response log data stream, the method further includes: using a query statement predefined by the visualization platform to search for the corresponding evaluation indicators from the time series database; wherein, the visualization platform first uses the time series database as the target data source and defines corresponding query statements for different types of visualization; the evaluation indicator data in the time series database is stored in the time series database after the corresponding evaluation indicators are determined based on the expanded dimension distribution log data stream and the expanded dimension response log data stream; based on the found evaluation indicators, multi-dimensional data is analyzed, and combined with business objectives or detected abnormal indicators, a visualization dashboard template is generated or recommended; based on the found evaluation indicators and the visualization dashboard template, a visualization dashboard is constructed.

[0015] This application also provides an intelligent observation device for a device connection platform, comprising: a splitting and expansion module, which determines the source channel based on the acquired full-link embedded logs, identifies the target field based on the source channel, and expands the dimension in combination with the device identifier to obtain an expanded dimension distribution log data stream and an expanded dimension response log data stream; an indicator determination module, which determines the evaluation indicators based on the expanded dimension distribution log data stream and the expanded dimension response log data stream; and an anomaly observation module, which asynchronously calls the indicator insight agent based on the evaluation indicators to identify abnormal indicators that deviate from normal periodic or trend fluctuations based on the evaluation indicators.

[0016] This application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the intelligent observation method for the device connection platform as described above through the computer program.

[0017] This application also provides a computer-readable storage medium comprising a stored program, wherein the program, when executed, implements the intelligent observation method for the device connection platform as described above.

[0018] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the intelligent observation method for the device connection platform as described above.

[0019] The intelligent observation method and electronic device for the device connection platform provided in this application determine the source channel based on the acquired end-to-end embedded logs, identify target fields based on the source channel, and split the end-to-end logs from different sources according to the source channel to achieve data isolation. Furthermore, it expands the dimensions by combining device identifiers to provide rich device attribute context for each log entry. This allows subsequent indicator calculation and indicator insight analysis to drill down from macro-statistics to specific individuals and scenarios. Based on the expanded-dimensional distribution log data stream and expanded-dimensional response log data stream, evaluation indicators are determined to cross-validate from different dimensions, providing a comprehensive and in-depth understanding of the device status and offering objective evidence for subsequent automated monitoring. Then, by asynchronously calling the indicator insight intelligent agent, abnormal indicators are identified, quickly and accurately located, avoiding a large number of invalid alarms caused by business fluctuations. This frees the operations and maintenance team from alarm storms, allowing them to focus on the real problems that need to be addressed and improving work efficiency. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 is a schematic diagram of the hardware environment of an intelligent observation method for a device connection platform according to an embodiment of this application; Figure 2 is a schematic flowchart of one of the intelligent observation methods for a device connection platform provided by this application; Figure 3 is a schematic flowchart of another of the intelligent observation methods for a device connection platform provided by this application; Figure 4 is a schematic diagram of the structure of an intelligent observation device for a device connection platform provided by this application; Figure 5 is a schematic diagram of the structure of an electronic device provided by this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] According to one aspect of the embodiments of this application, a device connection platform intelligent observation method is provided. This device connection platform intelligent observation method is widely used in whole-house intelligent digital control application scenarios such as smart homes, smart home ecosystems, smart home device ecosystems, and smart house ecosystems. Optionally, in this embodiment, the above-mentioned device connection platform intelligent observation method can be applied to a hardware environment consisting of a terminal device 102 and a server 104, as shown in FIG1. ​​As shown in FIG1, the server 104 is connected to the terminal device 102 via a network and can be used to provide services (such as application services) to the terminal or clients installed on the terminal. A database can be set up on the server or independently of the server to provide data storage services for the server 104. Cloud computing and / or edge computing services can be configured on the server or independently of the server to provide data processing services for the server 104.

[0026] The aforementioned network may include, but is not limited to, at least one of the following: wired network, wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: wide area network, metropolitan area network, local area network. The aforementioned wireless network may include, but is not limited to, at least one of the following: Wi-Fi (Wireless Fidelity), Bluetooth. The terminal device 102 may not be limited to PC, mobile phone, tablet computer, smart air conditioner, smart range hood, smart refrigerator, smart oven, smart stove, smart washing machine, smart water heater, smart washing equipment, smart dishwasher, smart projector, smart TV, smart clothes rack, smart curtains, smart audio-visual equipment, smart socket, smart speaker, smart speaker box, smart fresh air equipment, smart kitchen and bathroom equipment, smart bathroom equipment, smart robot vacuum cleaner, smart window cleaning robot, smart mopping robot, smart air purifier, smart steam oven, smart microwave oven, smart water heater, smart air purifier, smart water dispenser, smart door lock, etc.

[0027] Figure 2 is a flowchart of one of the intelligent observation methods for device connection platforms provided by the present invention. As shown in Figure 2, the method includes the following steps: S21, determining the source channel based on the acquired full-link embedded logs, identifying the target field based on the source channel, and performing dimensional expansion in conjunction with the device identifier to obtain the expanded dimension distribution log data stream and the expanded dimension response log data stream; S22, determining the evaluation index based on the expanded dimension distribution log data stream and the expanded dimension response log data stream; S23, asynchronously calling the index insight agent based on the evaluation index to identify abnormal indicators that deviate from normal periodic or trend fluctuations.

[0028] It should be noted that the step number "S2N" in this specification does not represent the order of the intelligent observation method for the device connection platform. The intelligent observation method for the device connection platform of the present invention will be described in detail below with reference to Figure 3.

[0029] Step S21: Based on the acquired end-to-end embedded logs, determine the source channel, identify the target field based on the source channel, and perform dimensional expansion in combination with the device identifier to obtain the expanded dimension distribution log data stream and the expanded dimension response log data stream.

[0030] In this embodiment, determining the source channel based on the acquired end-to-end tracking logs includes: parsing the acquired end-to-end tracking logs to obtain system identifier fields and business fields; and identifying and classifying the source channels based on the system identifier fields and business fields.

[0031] Furthermore, based on the system identification field and the business field, the source channels are identified and classified, including: when the source channel is identified as a user-side software development kit (USDK) based on the system identification field, it is determined to be a device USDK channel; when the source channel is identified as a unified device service engine (USDK) based on the business field, it is determined to be a UDSE channel.

[0032] In addition, based on the source channel, target fields are identified and combined with device identifiers for dimensional expansion to obtain expanded-dimensional distribution log data streams and expanded-dimensional response log data streams. This includes: identifying target fields based on the source channel to split the end-to-end event logs into distribution log data streams and response log data streams; using the device identifier as the query key, asynchronously and in parallel querying the preset database, and backfilling the queried device attributes into the logs of the corresponding log data streams to form the corresponding expanded-dimensional distribution log data streams and expanded-dimensional response log data streams; wherein, the preset database is constructed in advance based on the device identifier and the corresponding device attributes.

[0033] It should be added that the preset database can be selected according to actual design requirements, such as the distributed open-source database HBase, etc., without further limitations here. Additionally, device attributes include application identifier (appId), device category, and device model.

[0034] Specifically, based on the source channel, target fields are identified to split the end-to-end event logs into delivery log data streams and response log data streams. This includes: identifying business fields as target fields based on the user-side source channel to determine the business intent; when the business intent is determined to be a request, the corresponding event log is determined to be a delivery log data stream; when the business intent is determined to be a response, the corresponding event log is determined to be a response log data stream; and the delivery log data stream and response log data stream are associated and matched.

[0035] It should be noted that when the source channel is the user-side channel, by identifying the business intent of the business fields, the distribution log data stream and the response log data stream are separated to achieve data isolation, simplify downstream logic, and match and associate the distribution log data stream and the response log data stream to build a complete end-to-end call chain.

[0036] In addition, based on the source channel, the target field is identified to split the end-to-end event logs into a delivery log data stream and a response log data stream. This also includes: based on the Unified Device Service Engine (UDSE) as the source channel, the step field is identified as the target field to determine the step node; when the step node is determined to be a process initiation or task distribution node, the corresponding event log is determined to be a delivery log data stream; when the step node is determined to be a process termination node, the corresponding event log is determined to be a response log data stream; and the delivery log data stream and the response log data stream are associated and matched.

[0037] Furthermore, based on the source channel, target fields are identified to split the end-to-end event logs into delivery log data streams and response log data streams. This also includes: identifying business fields in the corresponding event logs based on the single-batch or batch control channel of the domain model as the source channel, thus obtaining the business domain; where the domain model is constructed prior to device control business, control entities, and interaction rules; when the business domain is determined to be device control, the control type field of the corresponding event log is identified, and the corresponding event logs are divided into single-control data streams and batch control data streams according to the identified control type field; for both single-control and batch control data streams, corresponding step fields are identified, and based on the identified step nodes being process initiation or task distribution nodes, the corresponding event logs are determined to be delivery log data streams; based on the identified step nodes being process termination nodes, the corresponding event logs are determined to be response log data streams; for single-control data streams, the corresponding delivery log data streams and corresponding response log data streams are associated and matched; and for batch control data streams, each delivery log in the corresponding delivery log data stream is associated and matched with multiple response logs in the corresponding response log data stream.

[0038] In practical applications, the domain model can be dynamically loaded and updated through the configuration center. This allows for the support of new data flow divisions without modifying the code, simply by extending the domain model configuration, when business models evolve, such as by adding a new group control mode. This demonstrates strong business adaptability and scalability.

[0039] Step S22: Determine the evaluation metrics based on the extended dimension distribution log data stream and the extended dimension response log data stream.

[0040] In this embodiment, evaluation metrics are determined based on the expanded dimension distribution log data stream and the expanded dimension response log data stream, including: determining the interface call volume metric based on the expanded dimension distribution log data stream; determining the control success rate metric and the error code quantity metric based on the expanded dimension distribution log data stream, the expanded dimension response log data stream, and the corresponding associated and matched distribution log data stream and response log data stream, combined with the response code field in the logs; determining the interface latency metric based on the expanded dimension distribution log data stream, the associated and matched distribution log data stream and response log data stream, combined with the distribution phase time and response phase time; and obtaining the evaluation metrics based on the interface call volume metric, the control success rate metric, the error code quantity metric, and the interface latency metric.

[0041] It should be added that the response code is a field in the corresponding event log in the response log data stream. It is used to indicate whether the corresponding operation was successful and the specific reason for failure. For example, a response code of 200 or success means success, while a response code of 400 means a client error. The specific response code can be configured according to the actual design requirements. No further restrictions are made here.

[0042] Furthermore, before determining the evaluation metrics based on the extended dimension distribution log data stream and the extended dimension response log data stream, the following steps are taken: grouping the extended dimension distribution log data stream and the extended dimension response log data stream by key according to the source channel and device attributes, so as to aggregate the event logs of the same device in the extended dimension distribution log data stream and the extended dimension response log data stream, so as to make it easier to calculate the evaluation metrics using the target length time window.

[0043] In one optional embodiment, after determining the evaluation metrics based on the extended dimension distribution log data stream and the extended dimension response log data stream, the process includes: storing the evaluation metrics in a time-series database. It should be noted that the evaluation metrics can be stored in the time-series database based on the remote-write protocol of the time-series database (prometheus).

[0044] In an optional embodiment, after determining the evaluation metrics based on the expanded dimension distribution log data stream and the expanded dimension response log data stream, the method further includes: using a query statement predefined by the visualization platform to search for the corresponding evaluation metrics from the time series database; wherein, the visualization platform first uses the time series database as the target data source and defines corresponding query statements for different types of visualization; the evaluation metric data in the time series database is stored in the time series database after the corresponding evaluation metrics are determined based on the expanded dimension distribution log data stream and the expanded dimension response log data stream; based on the found evaluation metrics, multi-dimensional data is analyzed, and combined with business objectives or detected abnormal metrics, a visualization dashboard template is generated or recommended; based on the found evaluation metrics and combined with the visualization dashboard template, a visualization dashboard is constructed.

[0045] It should be added that the visualization platform can be determined according to actual usage needs, such as Grafana, etc. There are no further restrictions here. The visualization platform Grafana is used to connect to the time series database Prometheus to build visualization dashboards. The visualization dashboards include indicator cards, trend charts, etc. The specifics can be determined according to actual display design requirements, and there are no further restrictions here.

[0046] In addition, before using the pre-defined query statements of the visualization platform to find the corresponding evaluation metrics from the time series database, the following steps are taken: adding a target data source in Grafana; wherein the target data source is used to provide the Prometheus service address (URL) and access credentials; and defining the query statements according to the visualization type.

[0047] Specifically, Grafana offers a variety of visualization options, including charts, heatmaps, and tables. Depending on the type of query results and the desired effect, select the appropriate visualization type. Correspondingly, define the query statement based on the visualization type, including: for indicator cards, write queries that return a single value; for trend charts, write queries that return a series of data changing over time. It's worth noting that queries can be written using the Prometheus Query Language (PromQL) built into the time-series database Prometheus.

[0048] In addition, the visualization platform uses pre-defined query statements to search for corresponding device evaluation metrics from the time series database, including: connecting to the corresponding Prometheus based on the target data source, and using query statements to search for corresponding device evaluation metrics from the time series database.

[0049] Furthermore, business objectives are determined based on business calendars, system change records (such as version releases), or user-specified monitoring topics (such as 'focus on network quality in XX region'), thereby grounding business objectives in specific and actionable data sources, such as calendars, continuous integration / continuous delivery (CI / CD) records, and user input, making the implementation path of the entire solution clearer.

[0050] In addition, based on the identified equipment evaluation metrics, multi-dimensional data is analyzed, and combined with business objectives or detected abnormal indicators, a visual dashboard template is generated or recommended. This includes: based on the identified equipment evaluation metrics, multi-dimensional data is analyzed, and combined with business objectives or detected abnormal indicators, a corresponding visual dashboard template is generated or a business scenario is determined, so as to match the corresponding dashboard template according to the business scenario and recommend the corresponding visual dashboard template; or, the equipment evaluation metrics and abnormal indicators are input into a pre-trained graph neural network model to obtain an optimized dashboard layout configuration.

[0051] In addition, after building the visual dashboard, the process includes: recording users' adoption, modification, or abandonment of recommended dashboard templates, and using these behaviors as feedback signals to optimize template scene matching rules or update the graph neural network model, so as to achieve the self-evolution of the dashboard template recommendation capability.

[0052] It should be noted that by introducing a feedback loop and a self-learning mechanism, the system is no longer static, but can be continuously optimized based on the user's actual usage, thereby improving the visual dashboard.

[0053] Furthermore, the method also includes: monitoring the execution performance of query statements; and optimizing query statements, for example by increasing aggregation granularity or shortening the query time range, when the query time exceeds the corresponding threshold, to ensure the response speed of the dashboard.

[0054] Step S23: Based on the evaluation metrics, asynchronously invoke the metrics insight agent to identify abnormal metrics that deviate from normal periodic or trend fluctuations.

[0055] In this embodiment, based on evaluation metrics, an indicator insight agent is asynchronously invoked to identify abnormal indicators that deviate from normal periodic or trend fluctuations. This includes: based on evaluation metrics, the indicator insight agent is asynchronously invoked to utilize a target detection algorithm to identify abnormal indicators that deviate from normal periodic or trend fluctuations; wherein, the target detection algorithm is obtained by matching historical evaluation metrics based on the stability, periodicity, and volatility of historical full-link tracking logs according to a preset algorithm matching strategy, and the stability, periodicity, and volatility of historical evaluation metrics are identified by the candidate detection algorithm in parallel based on the meta-learning module built into the invoked indicator insight agent.

[0056] Furthermore, the candidate detection algorithms include at least one of the following: Three Sigma, Long Short-Term Memory (LSTM) network, and Isolation Forest; the preset algorithm matching strategy is used to: select Three Sigma when the indicator is stable and non-periodic; select LSTM network when the indicator is periodic; and select Isolation Forest when the indicator fluctuates drastically and has no fluctuation pattern.

[0057] It should be added that, through the built-in meta-learning module, candidate detection algorithms can be launched in parallel, continuously evaluating the performance of different candidate detection algorithms on historical evaluation metrics, continuously evaluating the performance of different detection algorithms on various metrics, and dynamically selecting the optimal candidate detection algorithm based on the current characteristics and historical performance of the metrics, so as to achieve adaptive evolution of the detection strategy.

[0058] In addition, through the built-in meta-learning module of the agent, the performance of different algorithms on various indicators, such as accuracy and false alarm rate, is continuously evaluated. For new indicators, the meta-learning module will automatically try multiple algorithms and select the optimal model based on the initial performance. For indicators that have already been running, if the business model changes, such as changes in traffic baseline, the agent can detect the decline in model performance and automatically trigger model retraining or switch to a more robust algorithm to achieve adaptive evolution of the detection strategy.

[0059] In addition, based on evaluation metrics, the asynchronous invocation of the metric insight agent also includes: based on device evaluation metrics, the asynchronous invocation of the metric insight agent to structure and store historically confirmed anomalies and their solutions in an anomaly knowledge base. When a new anomaly is identified, by matching its metric patterns, log characteristics and related events, it retrieves and recommends historically verified effective solutions from the anomaly knowledge base, or automatically triggers preset emergency plans, thereby realizing a closed loop from intelligent alarm to intelligent self-healing.

[0060] It should be noted that the intelligent agent stores each confirmed anomaly and its final solution in an anomaly knowledge base in a structured manner. When similar anomalies occur in the future, the intelligent agent can not only quickly identify them, but also directly recommend historically verified effective solutions from the anomaly knowledge base. It can even automatically trigger preset emergency plans, such as automatic capacity expansion, traffic switching, and service degradation, so as to achieve the leap from intelligent alarm to intelligent self-healing.

[0061] In one optional embodiment, after asynchronously invoking the indicator insight agent based on device evaluation indicators to identify abnormal indicators that deviate from normal periodic or trend fluctuations according to the device evaluation indicators, the process includes: notifying the operations and maintenance developers to pay attention to and investigate indicator problems based on the abnormal indicators.

[0062] In addition, after asynchronously invoking the indicator insight agent based on device evaluation metrics to identify abnormal indicators that deviate from normal periodic or trend fluctuations, the process also includes: triggering correlation analysis of multi-dimensional attributes based on the detected abnormal indicators to determine the correlation between each dimension attribute and the abnormal indicators, and locating the key dimensions causing the abnormality; using the knowledge graph previously built based on devices, gateways, and business services to perform path reasoning based on the detected abnormal indicators, and determining the downstream services affected by the abnormal indicators; and generating an insight report containing potential root causes and the scope of impact based on the key dimensions causing the abnormality and the downstream services affected by the abnormal indicators.

[0063] It should be noted that by identifying the key dimensions causing the anomalies when abnormal indicators are detected, complex connections that are difficult for human intuition to perceive can be discovered, avoiding pitfalls in troubleshooting, achieving automatic root cause localization, improving operational efficiency, and using knowledge graphs for path reasoning to achieve accurate assessment of the scope of impact. Based on the key dimensions and scope of impact, a structured and easy-to-understand insight report is automatically integrated, allowing for precise remedial actions to be executed directly based on the root causes and scope of impact in the report, achieving precise fault handling and avoiding distortion during information transmission. At the same time, it can be archived as a historical case, forming organizational knowledge accumulation for future review and training.

[0064] In summary, this invention, through the acquisition of end-to-end event logs, determines the source channel, identifies target fields based on the source channel, and splits end-to-end logs from different sources according to their source channel to achieve data isolation. Furthermore, it expands the dimensions by combining device identifiers to provide rich device attribute context for each log entry. This allows subsequent indicator calculations and indicator insight analysis to drill down from macro-statistics to specific individuals and scenarios. Based on the expanded-dimensional distribution log data stream and expanded-dimensional response log data stream, evaluation indicators are determined to cross-validate from different dimensions, providing a comprehensive and in-depth understanding of device status and offering objective evidence for subsequent automated monitoring. Moreover, by asynchronously calling the indicator insight intelligent agent, abnormal indicators are identified, quickly and accurately located, avoiding a large number of invalid alarms caused by business fluctuations. This frees the operations and maintenance team from alarm storms, allowing them to focus on truly critical issues and improve work efficiency.

[0065] The intelligent observation device for the equipment connection platform provided in this application is described below. The intelligent observation device for the equipment connection platform described below can be referred to in correspondence with the intelligent observation method for the equipment connection platform described above.

[0066] Figure 4 shows a schematic diagram of an intelligent observation device for a device connection platform. The device includes: a splitting and expansion module 41, which determines the source channel based on the acquired full-link embedded logs, identifies the target field based on the source channel, and expands the dimension by combining the device identifier to obtain the expanded dimension distribution log data stream and the expanded dimension response log data stream; an indicator determination module 42, which determines the evaluation indicators based on the expanded dimension distribution log data stream and the expanded dimension response log data stream; and an anomaly observation module 43, which asynchronously calls the indicator insight agent based on the evaluation indicators to identify abnormal indicators that deviate from normal periodic or trend fluctuations.

[0067] In this embodiment, the split and expansion module 41 includes: a log parsing unit, which parses the acquired end-to-end tracking logs to obtain system identification fields and business fields; and a channel classification unit, which identifies and classifies the source channels based on the system identification fields and business fields.

[0068] Furthermore, the channel classification unit is used to: determine the source channel as the device USDK channel when the system identification field identifies it as a user-side software development kit (USDK); and determine the source channel as the UDSE when the business field identifies it as a unified device service engine (USDK).

[0069] In addition, the splitting and expansion module 41 also includes: a splitting unit, which identifies target fields based on the source channel to split the end-to-end tracking logs into a delivery log data stream and a response log data stream; and an expansion unit, which uses the device identifier as the query key to asynchronously and in parallel query the preset database and fills the queried device attributes back into the logs of the corresponding log data streams to form corresponding expanded-dimensional delivery log data streams and expanded-dimensional response log data streams; wherein, the preset database is constructed in advance based on the device identifier and the corresponding device attributes.

[0070] Specifically, the splitting unit includes: an intent recognition subunit, which identifies business fields as target fields based on the source channel being the user-side channel, to determine the business intent; a splitting subunit, which determines the corresponding event log as the delivery log data stream when the business intent is determined to be a request, and determines the corresponding event log as the response log data stream when the business intent is determined to be a response; and a matching subunit, which associates and matches the delivery log data stream and the response log data stream.

[0071] In addition, the splitting unit also includes: a step identification subunit, which identifies the step field as the target field based on the source channel being the Unified Device Service Engine (UDSE) to determine the step node; a splitting subunit, which determines the corresponding event log as the delivery log data stream when the step node is determined to be a process initiation or task distribution node, and determines the corresponding event log as the response log data stream when the step node is determined to be a process termination node; and a matching subunit, which associates and matches the delivery log data stream and the response log data stream.

[0072] In addition, the splitting unit includes: a domain identification subunit, which identifies the business fields of the corresponding event logs based on the single-batch or batch control channel of the source channel as the domain model, to obtain the business domain; wherein, the domain model is constructed based on device control business, control entities, and interaction rules; a control splitting subunit, which, when the business domain is determined to be device control, identifies the control type fields of the corresponding event logs, and divides the corresponding event logs into single-control data streams and batch control data streams according to the identified control type fields; a splitting subunit, which identifies the corresponding step fields for single-control data streams and batch control data streams respectively, and determines the corresponding event logs as distribution log data streams based on the identified step nodes as process initiation or task distribution nodes, and determines the corresponding event logs as response log data streams based on the identified step nodes as process termination nodes; and a matching subunit, which performs association matching between the corresponding distribution log data stream and the corresponding response log data stream for single-control data streams, and associates and matches each distribution log in the corresponding distribution log data stream with multiple response logs in the corresponding response log data stream for batch control data streams.

[0073] In this embodiment, the indicator determination module 42 is used to: determine the interface call volume indicator based on the expanded dimension distribution log data stream; determine the control success rate indicator and the error code quantity indicator based on the expanded dimension distribution log data stream and the expanded dimension response log data stream, as well as the corresponding associated and matched distribution log data stream and response log data stream, combined with the response code field in the log; determine the interface time consumption indicator based on the expanded dimension distribution log data stream and the associated and matched distribution log data stream and response log data stream, combined with the distribution phase time and response phase time; and obtain the evaluation indicator based on the interface call volume indicator, the control success rate indicator, the error code quantity indicator, and the interface time consumption indicator.

[0074] Furthermore, the indicator determination module 42 also includes an aggregation unit, which, before determining the evaluation indicators based on the extended dimension distribution log data stream and the extended dimension response log data stream, groups the extended dimension distribution log data stream and the extended dimension response log data stream by key according to the source channel and device attributes, so as to aggregate the event logs of the same device in the extended dimension distribution log data stream and the extended dimension response log data stream, so as to facilitate the subsequent calculation of evaluation indicators using the target length time window.

[0075] In an optional embodiment, the device further includes a storage module, which, after determining the evaluation metrics based on the extended dimension distribution log data stream and the extended dimension response log data stream, stores the evaluation metrics in a time-series database. It should be added that the evaluation metrics can be stored in the time-series database based on the remote-write protocol of the time-series database (prometheus).

[0076] In an optional embodiment, the device further includes: a lookup module, which, after determining the evaluation indicators based on the expanded dimension distribution log data stream and the expanded dimension response log data stream, uses a query statement predefined by the visualization platform to look up the corresponding evaluation indicators from the time series database; wherein, the visualization platform first uses the time series database as the target data source and defines corresponding query statements for different types of visualization, and the evaluation indicator data in the time series database is stored in the time series database after the corresponding evaluation indicators are determined based on the expanded dimension distribution log data stream and the expanded dimension response log data stream; a template generation module, which analyzes multi-dimensional data based on the found evaluation indicators and combines it with business objectives or detected abnormal indicators to generate or recommend visualization dashboard templates; and a dashboard generation module, which constructs a visualization dashboard based on the found evaluation indicators and the visualization dashboard templates.

[0077] In addition, the device also includes a configuration module for adding a target data source in Grafana before using a query statement predefined by the visualization platform to retrieve the corresponding evaluation metric from the time series database; wherein the target data source is used to provide the Prometheus service address (URL) and access credentials; and the query statement is defined according to the visualization type.

[0078] Specifically, Grafana offers a variety of visualization options, including charts, heatmaps, and tables. The configuration module is also used for: writing queries that return a single value for indicator cards; and writing queries that return a series of data that changes over time for trend charts. It's worth noting that queries can be written using the Prometheus Query Language (PromQL), built into the time-series database Prometheus.

[0079] Furthermore, the template generation module is used to: analyze multi-dimensional data based on the found equipment evaluation indicators, and combine them with business objectives or detected abnormal indicators to generate corresponding visual dashboard templates or determine business scenarios, so as to match the corresponding dashboard templates according to the business scenarios and recommend corresponding visual dashboard templates; or, input the equipment evaluation indicators and abnormal indicators into the pre-trained graph neural network model to obtain optimized dashboard layout configurations.

[0080] In addition, the device also includes an update module, which is used to: after building the visual dashboard, record the user's adoption, modification or abandonment of the recommended dashboard template, and use these behaviors as feedback signals to optimize the template scene matching rules or update the graph neural network model, so as to realize the self-evolution of the dashboard template recommendation capability.

[0081] Furthermore, the device also includes: a monitoring module for monitoring the execution performance of query statements; and an optimization module for optimizing query statements, for example by increasing aggregation granularity or shortening the query time range, when the query time exceeds a corresponding threshold, to ensure the response speed of the dashboard.

[0082] In this embodiment, the anomaly observation module 43 is used to: asynchronously call the indicator insight agent based on the evaluation indicators, so as to use the target detection algorithm to identify abnormal indicators that deviate from normal periodic or trend fluctuations; wherein, the target detection algorithm is obtained by matching according to a preset algorithm matching strategy based on the stability, periodicity and volatility of historical evaluation indicators corresponding to historical full-link tracking logs, and the stability, periodicity and volatility of historical evaluation indicators are identified by the candidate detection algorithm in parallel based on the meta-learning module built into the called indicator insight agent.

[0083] Furthermore, the candidate detection algorithms include at least one of the following: Three Sigma, Long Short-Term Memory (LSTM) network, and Isolation Forest; the preset algorithm matching strategy is used to: select Three Sigma when the indicator is stable and non-periodic; select LSTM network when the indicator is periodic; and select Isolation Forest when the indicator fluctuates drastically and has no fluctuation pattern.

[0084] In addition, the anomaly observation module 43 is also used to: asynchronously call the indicator insight agent based on the equipment evaluation indicators to store historically confirmed anomalies and their solutions in an anomaly knowledge base in a structured manner. When a new anomaly is identified, it retrieves and recommends historically verified effective solutions from the anomaly knowledge base by matching its indicator patterns, log characteristics and related events, or automatically triggers a preset emergency plan, thereby realizing a closed loop from intelligent alarm to intelligent self-healing.

[0085] In an optional embodiment, the device further includes: a notification module that, after asynchronously invoking an indicator insight agent based on device evaluation indicators to identify abnormal indicators that deviate from normal periodic or trend fluctuations according to the device evaluation indicators, notifies the operation and maintenance developers to pay attention to and investigate indicator problems based on the abnormal indicators.

[0086] In addition, the device also includes: a root cause localization module, which asynchronously calls an indicator insight agent based on device evaluation indicators to identify abnormal indicators that deviate from normal periodic or trend fluctuations based on the device evaluation indicators, and triggers correlation analysis of multi-dimensional attributes based on the detected abnormal indicators to determine the correlation between each dimension attribute and the abnormal indicators, and locate the key dimensions causing the abnormality; a scope determination module, which uses a knowledge graph previously built based on devices, gateways, and business services to perform path reasoning based on the detected abnormal indicators, and determines the downstream services affected by the abnormal indicators; and a report generation module, which generates an insight report containing potential root causes and the scope of impact based on the key dimensions causing the abnormality and the downstream services affected by the abnormal indicators.

[0087] In summary, this embodiment of the invention, through a splitting and expansion module, determines the source channel based on the acquired end-to-end embedded logs. Based on the source channel, it identifies target fields to split end-to-end logs from different sources according to their source channels, achieving data isolation. Furthermore, it combines device identifiers for dimensional expansion, providing rich device attribute context for each log entry. This allows subsequent indicator calculations and indicator insight analysis to drill down from macro-statistics to specific individuals and scenarios. The indicator determination module then determines evaluation indicators based on the expanded dimension distribution log data stream and expanded dimension response log data stream, cross-validating from different dimensions to comprehensively and deeply understand the device status. This provides objective evidence for subsequent automated monitoring. Finally, the anomaly observation module asynchronously calls the indicator insight intelligent agent to identify abnormal indicators, quickly and accurately locating them. This avoids a large number of invalid alarms caused by business fluctuations, freeing the operations and maintenance team from alarm storms and allowing them to focus on truly critical issues, thus improving work efficiency.

[0088] Figure 5 illustrates a schematic diagram of the physical structure of an electronic device. As shown in Figure 5, the electronic device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540. The processor 510, communication interface 520, and memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a device connection platform intelligent observation method. This method includes: determining the source channel based on the acquired end-to-end embedded logs; identifying target fields based on the source channel and performing dimensional expansion in conjunction with device identifiers to obtain expanded-dimensional distribution log data streams and expanded-dimensional response log data streams; determining evaluation indicators based on the expanded-dimensional distribution log data streams and expanded-dimensional response log data streams; and asynchronously calling the indicator insight agent based on the evaluation indicators to identify abnormal indicators that deviate from normal periodic or trend fluctuations.

[0089] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0090] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the intelligent observation method for the device connection platform provided by the above methods. The method includes: determining the source channel based on the acquired end-to-end embedded logs; identifying the target field based on the source channel and performing dimensional expansion in combination with the device identifier to obtain an expanded-dimensional distribution log data stream and an expanded-dimensional response log data stream; determining evaluation indicators based on the expanded-dimensional distribution log data stream and the expanded-dimensional response log data stream; and asynchronously calling the indicator insight agent based on the evaluation indicators to identify abnormal indicators that deviate from normal periodic or trend fluctuations based on the evaluation indicators.

[0091] On another front, this application also provides a computer-readable storage medium, which includes a stored program. When the program runs, it executes the intelligent observation method for the device connection platform provided by the methods described above. This method includes: determining the source channel based on acquired end-to-end embedded logs; identifying target fields based on the source channel and performing dimensional expansion in conjunction with device identifiers to obtain expanded-dimensional distribution log data streams and expanded-dimensional response log data streams; determining evaluation metrics based on the expanded-dimensional distribution log data streams and expanded-dimensional response log data streams; and asynchronously invoking a metric insight agent based on the evaluation metrics to identify abnormal metrics that deviate from normal periodic or trend fluctuations.

[0092] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0093] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for intelligent observation of a device connection platform, characterized in that, include: Based on the acquired end-to-end tracking logs, the source channel is determined. Based on the source channel, the target field is identified, and the dimension is expanded in combination with the device identifier to obtain the expanded dimension distribution log data stream and the expanded dimension response log data stream. The evaluation metrics are determined based on the expanded dimension distribution log data stream and the expanded dimension response log data stream; Based on the evaluation metrics, the metrics insight agent is asynchronously invoked to identify abnormal metrics that deviate from normal periodic or trend fluctuations.

2. The intelligent observation method for the equipment connection platform according to claim 1, characterized in that, Based on the source channel, target fields are identified and combined with device identifiers for dimensional expansion to obtain expanded-dimensional distribution log data streams and expanded-dimensional response log data streams. This includes: identifying target fields based on the source channel to split the end-to-end tracking logs into distribution log data streams and response log data streams; using the device identifier as a query key, asynchronously and in parallel querying a preset database, and backfilling the queried device attributes into the logs of the corresponding log data streams to form corresponding expanded-dimensional distribution log data streams and expanded-dimensional response log data streams; wherein, the preset database is constructed in advance based on the device identifier and corresponding device attributes.

3. The intelligent observation method for the equipment connection platform according to claim 2, characterized in that, Based on the source channel, target fields are identified to split the end-to-end event logs into delivery log data streams and response log data streams. This includes: identifying business fields as target fields based on the source channel being a user-side channel to determine the business intent; when the business intent is determined to be a request, the corresponding event log is determined to be a delivery log data stream; when the business intent is determined to be a response, the corresponding event log is determined to be a response log data stream; and the delivery log data stream and the response log data stream are associated and matched.

4. The intelligent observation method for the equipment connection platform according to claim 3, characterized in that, Based on the source channel, the target field is identified to split the end-to-end event logs into a delivery log data stream and a response log data stream. This also includes: identifying the step field as the target field based on the source channel being the Unified Device Service Engine (UDSE) to determine the step node; when the step node is determined to be a process initiation or task distribution node, the corresponding event log is determined to be a delivery log data stream; when the step node is determined to be a process termination node, the corresponding event log is determined to be a response log data stream; and the delivery log data stream and the response log data stream are associated and matched.

5. The intelligent observation method for the equipment connection platform according to claim 3, characterized in that, Based on the source channel, target fields are identified to split the end-to-end event logs into distribution log data streams and response log data streams. This also includes: identifying business fields in the corresponding event logs based on the source channel being a single-batch or batch control channel of a domain model to obtain the business domain; wherein the domain model is constructed prior to device control business, control entities, and interaction rules; when the business domain is determined to be device control, the control type field of the corresponding event log is identified, and the corresponding event log is divided into single-control data streams and batch control data streams according to the identified control type field; for each of the single-control data streams and the batch control data streams, corresponding step fields are identified, and based on the identified step node being a process initiation or task distribution node, the corresponding event log is determined to be a distribution log data stream; based on the identified step node being a process termination node, the corresponding event log is determined to be a response log data stream; for the single-control data stream, the corresponding distribution log data stream and the corresponding response log data stream are associated and matched; and for the batch control data stream, each distribution log in the corresponding distribution log data stream is associated and matched with multiple response logs in the corresponding response log data stream.

6. The intelligent observation method for the equipment connection platform according to any one of claims 3-5, characterized in that, Based on the expanded dimension distribution log data stream and the expanded dimension response log data stream, evaluation metrics are determined, including: determining the interface call volume metric based on the expanded dimension distribution log data stream; determining the control success rate metric and the error code quantity metric based on the expanded dimension distribution log data stream, the expanded dimension response log data stream, and the corresponding associated and matched distribution log data stream and response log data stream, combined with the response code field in the logs; determining the interface time consumption metric based on the expanded dimension distribution log data stream, the associated and matched distribution log data stream and response log data stream, combined with the distribution phase time and response phase time; and obtaining the evaluation metrics based on the interface call volume metric, the control success rate metric, the error code quantity metric, and the interface time consumption metric.

7. The intelligent observation method for the equipment connection platform according to claim 1, characterized in that, Based on the evaluation metrics, an asynchronous call is made to the metric insight agent to identify abnormal metrics that deviate from normal periodic or trend fluctuations, including: based on the evaluation metrics, the asynchronous call is made to the metric insight agent to identify abnormal metrics that deviate from normal periodic or trend fluctuations using a target detection algorithm; wherein, the target detection algorithm is obtained by matching historical evaluation metrics based on the stability, periodicity, and volatility of historical full-link tracking logs according to a preset algorithm matching strategy, and the stability, periodicity, and volatility of the historical evaluation metrics are identified by the candidate detection algorithm in parallel based on the meta-learning module built into the called metric insight agent.

8. The intelligent observation method for the equipment connection platform according to claim 7, characterized in that, The candidate detection algorithm includes at least one of the three Sigma rule, long short-term memory network, and isolated forest; the preset algorithm matching strategy is used to: select the three Sigma rule when the indicator is stable and non-periodic; select the long short-term memory network when the indicator is periodic; and select the isolated forest when the indicator fluctuates drastically and has no fluctuation pattern.

9. The intelligent observation method for the equipment connection platform according to claim 1, characterized in that, After determining the evaluation metrics based on the expanded dimension distribution log data stream and the expanded dimension response log data stream, the process further includes: using query statements predefined by the visualization platform to search for corresponding evaluation metrics in the time series database; wherein, the visualization platform first uses the time series database as the target data source and defines corresponding query statements for different types of visualization; the evaluation metric data in the time series database is stored in the time series database after determining the corresponding evaluation metrics based on the expanded dimension distribution log data stream and the expanded dimension response log data stream; based on the found evaluation metrics, multi-dimensional data is analyzed, and combined with business objectives or detected abnormal metrics, a visualization dashboard template is generated or recommended; based on the found evaluation metrics and the visualization dashboard template, a visualization dashboard is constructed.

10. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the method of any one of claims 1 to 9 through the computer program.

Images