Log processing method, arrangement, storage medium and program product

Abstract

Embodiments of the present disclosure provide a log processing method, a device, a storage medium and a program product. The method comprises displaying a log consumption interface, the log consumption interface comprising a result display area and an original display area; obtaining a plurality of logs; displaying log originals of the plurality of logs in the original display area in the order of context; obtaining at least one key log in the plurality of logs; displaying the at least one key log in the result display area; and in response to a touch operation on a target key log in the at least one key log in the result display area, displaying the log original corresponding to the target key log in the plurality of logs in the original display area. The method provided by the embodiments of the present disclosure is simple to operate and improves analysis efficiency.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a log processing method, settings, storage medium, and program product. Background Technology

[0002] Logs are records generated by systems, applications, or devices during operation, used to record various events, status information, error messages, etc. Developers and operations personnel can systematically utilize log analysis to locate and resolve problems encountered by users, thereby improving software stability and user experience.

[0003] How to efficiently perform log analysis to quickly resolve user issues is a pressing technical problem that needs to be addressed. Summary of the Invention

[0004] This disclosure provides a log processing method, settings, storage medium, and program product to improve log analysis efficiency.

[0005] In a first aspect, embodiments of this disclosure provide a log processing method, including:

[0006] The log consumption interface is displayed, which includes a result display area and a original text display area.

[0007] Retrieve multiple logs and display the original log texts of the multiple logs in the original text display area in the order of context;

[0008] Obtain at least one key log from the plurality of logs, and display at least one key log in the result display area;

[0009] In response to a touch operation on a target key log in at least one of the key logs in the results display area, the original text of the log corresponding to the target key log in the original text display area is located and displayed.

[0010] Secondly, embodiments of this disclosure provide a log processing device, including:

[0011] The interface display module is used to display the log consumption interface, which includes a result display area and a original text display area.

[0012] The original text display module is used to acquire multiple logs and display the original text of the multiple logs in the original text display area in the order of context.

[0013] The result display module is used to obtain at least one key log from the plurality of logs and display at least one key log in the result display area.

[0014] An interactive module is used to respond to a touch operation on a target key log in at least one key log in the result display area, and to locate and display the original text of the log corresponding to the target key log in the original text display area.

[0015] Thirdly, embodiments of this disclosure provide an electronic device, including: a processor and a memory;

[0016] The memory stores computer-executed instructions;

[0017] The processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the log processing method as described in the first aspect and various possible designs of the first aspect.

[0018] Fourthly, embodiments of this disclosure provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the log processing method described in the first aspect and various possible designs of the first aspect.

[0019] Fifthly, embodiments of this disclosure provide a computer program product, including a computer program that, when executed by a processor, implements the log processing method described in the first aspect and various possible designs of the first aspect.

[0020] This embodiment provides a log processing method, settings, storage medium, and program product. The method includes displaying a log consumption interface, which includes a result display area and a raw text display area. Multiple logs are acquired, and the raw text of the multiple logs is displayed in the raw text display area in context order. At least one key log from the multiple logs is acquired and displayed in the result display area. In response to a touch operation on a target key log from the at least one key log in the result display area, the raw text of the log corresponding to the target key log from the multiple logs is located and displayed in the raw text display area. The method provided in this embodiment displays log analysis results, such as key logs, and the raw log text in their respective areas on the same screen for easy comparison. It allows for quick location of the line containing the key log within the raw log text, enabling further analysis of the key log using its context. The method is simple to operate and improves analysis efficiency. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram illustrating an application scenario of the log processing method provided in the embodiments of this disclosure;

[0023] Figure 2 Flowchart of the log processing method provided in the embodiments of this disclosure Figure 1 ;

[0024] Figures 3a to 3i A schematic diagram of the interface for the log processing method provided in this embodiment of the disclosure;

[0025] Figure 4 Flowchart of the log processing method provided in the embodiments of this disclosure Figure 2 ;

[0026] Figure 5 Flowchart 3 of the log processing method provided in this embodiment of the disclosure;

[0027] Figure 6 This is a structural block diagram of a log processing device provided in an embodiment of the present disclosure;

[0028] Figure 7 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0030] Logs play a crucial role in software development and operations. They help developers troubleshoot online user issues, providing information such as operation tracing, code execution paths, environment information, performance metrics, and error messages, enabling rapid problem identification and resolution. A log consumption platform is a system used to collect, process, and analyze large amounts of log data.

[0031] In related technologies, log consumption platforms typically filter log text based on templates during log analysis, and then analyze the filtered log text. However, this method is cumbersome and inefficient.

[0032] To address the aforementioned technical problems, the inventors of this disclosure have discovered that the low analysis efficiency of the above-mentioned method is mainly due to the fact that after filtering the log text based on templates, unmatched log text is hidden, and only the successfully matched log text is displayed together. Subsequent analysis of the filtered log text usually requires contextual information. In this case, each log must be searched and located individually for contextual information, which is repetitive and cumbersome, impacting analysis efficiency. Therefore, the inventors of this disclosure have further discovered that by setting two areas on the display interface, simultaneously displaying the matched key logs and their original text, and establishing relationships between the logs in the left and right areas, clicking on any key log will locate the corresponding line in the log text, facilitating the viewing of the log's context and improving analysis efficiency. Based on this, embodiments of this disclosure provide a log processing method.

[0033] Figure 1 This is a schematic diagram illustrating an application scenario of the log processing method provided in the embodiments of this disclosure. For example... Figure 1 As shown, terminal device 101 and server 102 are communicatively connected. Terminal device 101 can obtain log files related to the problem to be solved from server 102, parse the log files, obtain analysis results, and then upload the analysis results to server 102. During the parsing process of the log files, terminal device 101 can perform local parsing without a network.

[0034] During the specific analysis process, terminal device 101 displays a log consumption interface, which includes a result display area and a original text display area. Multiple logs are retrieved, and the original text of the multiple logs is displayed in the original text display area according to their context. At least one key log from the multiple logs is retrieved and displayed in the result display area. In response to a touch operation on a target key log from the at least one key log in the result display area, the original text of the log corresponding to the target key log from the multiple logs is located and displayed in the original text display area. The log processing method provided in this embodiment of the present disclosure displays the log analysis results, such as key logs, and the original log text in their respective areas on the same screen, facilitating comparison. It allows for quick location of the line containing the key log in the original log text, enabling further analysis of the key log using the context of the corresponding log. The operation is simple and improves analysis efficiency.

[0035] It should be noted that, Figure 1The schematic diagram shown is merely an example. The log processing method and scenario described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of the system and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0036] The technical solutions of this application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0037] Figure 2 Flowchart of the log processing method provided in the embodiments of this disclosure Figure 1 The method described in this embodiment can be applied to terminal devices or servers. This log processing method includes:

[0038] 201. Display the log consumption interface, which includes a results display area and a original text display area.

[0039] Specifically, the relative positions of the result display area and the original text display area in the log consumption interface can be vertically opposite or horizontally opposite. The areas of the two areas can be the same or different. This disclosure does not limit this.

[0040] For example, taking a computer as the executing entity, after the application corresponding to the log consumption platform is started, the application can display on the computer's screen. Figure 3a The log consumption interface shown is 31.

[0041] like Figure 3a As shown, interface 31 includes a results display area 311 and a original text display area 312. The two areas are displayed side by side. Area 312 is used to display the original log text, and area 311 is used to display the key logs searched and matched from the original log text. Optionally, in order to enable quick copying of the original log text, interface 31 may also include an original text editing area 313. Area 313 is used to display the editable text of the original log text selected in area 312, so that the content of the text can be copied and edited.

[0042] 202. Retrieve multiple logs and display the original log text of multiple logs in the original text display area in the order of context.

[0043] Specifically, multiple logs can be from log files, or imported log files can be used. When the number of logs in a log file exceeds the maximum number of logs that can be displayed in the original text display area, a progress bar can be used to scroll through them. When displaying multiple logs, one log can be displayed per line, and each log can include information such as the corresponding line number, timestamp, and log content.

[0044] In this embodiment of the disclosure, the order of the context can be based on the order of the timestamps. Since the same timestamp may correspond to multiple logs, it can also be based on the order of the line numbers in the log file.

[0045] In one embodiment of this disclosure, acquiring multiple logs and displaying the original log text of the multiple logs in the original text display area in the order of context may include: in response to a touch operation on the original text display area, importing a target log file, and displaying the original log text of the multiple logs in the target log file in the original text display area in the order of context.

[0046] Specifically, log files can be in various formats, such as text, JSON, and XML.

[0047] Taking a log file in text format as an example, such as Figure 3a As shown, area 312 may include prompt information 3121, which is used to instruct the user on how to import the log file. An example prompt information 3121 could be "Drag and drop or click to upload the log file (.txt file)".

[0048] In one embodiment of this disclosure, in order to enable the parsing of large files and import the target log file, the following may be included: splitting the target log file into multiple sub-files and importing the multiple sub-files in batches; the length of the sub-files is less than a preset length.

[0049] Specifically, when importing the target log file, the target log file can be split into multiple sub-files smaller than the maximum supported file length, based on the maximum limit of the imported file length. These sub-files can then be imported in batches according to their context.

[0050] In one embodiment of this disclosure, in order to enable parsing of large files and improve parsing efficiency, after importing the target log file, at least one of the following is also included:

[0051] The first item: When rendering the log list corresponding to the target log file, the log list is rendered in chunks based on the React-Window library.

[0052] Specifically, React-Window is a high-performance React component library for rendering large lists and grids. It significantly improves scrolling performance by rendering only items within the viewport through virtualization and windowing techniques. In implementation, you can first add react-window to your project via npm or yarn. Import the FixedSizeList or VariableSizeList component from react-window, selecting based on whether the item size is fixed. Use the FixedSizeList or VariableSizeList component to set properties such as height, width, itemCount, and itemSize. Define how to render each item using the renderRow property.

[0053] The second item: When filtering multiple logs from the imported target log file by time, the corresponding filtering interval is determined based on the input time interval using a binary search method.

[0054] Specifically, for data sorted by time, binary search can quickly locate the start and end positions of a specific time range. First, ensure the log files are sorted by timestamps. Second, determine the user-input time range, for example, from `start_time` to `end_time`. Next, create a function that takes a log array and `start_time` as input and outputs the index of the first log in the array whose timestamp is greater than or equal to `start_time`. Use binary search to determine the index of this first log, whose timestamp is greater than or equal to `start_time`. Then, modify the binary search function to find the index of the last log in the array whose timestamp is less than or equal to `end_time`. Use the adjusted binary search to determine the index of the last matching log. Finally, based on the found start and end indices, use array slicing to extract the target log from the original log array.

[0055] The third item: When analyzing multiple logs of the imported target log file based on rules, if the current rule to be executed is the same as the previous rule, the cached execution result after the previous rule was executed is obtained, and the cached execution result is determined as the execution result corresponding to the current rule.

[0056] Specifically, for rules that are executed repeatedly, caching can avoid redundant calculations and improve execution efficiency. First, a Map or WeakMap can be used to store the rules and their results in the cache. Second, before executing a rule, check if the result is already in the cache. Finally, after executing a rule, store the result in the cache.

[0057] 203. Obtain at least one key log from multiple logs and display at least one key log in the results display area.

[0058] Specifically, the content displayed in critical logs can take many forms, such as the original log text, a portion of the original log text (e.g., line numbers, timestamps), or interpretive information obtained from analyzing the original log text.

[0059] In this embodiment of the disclosure, there are multiple ways to obtain key logs. In one possible implementation, at least one key log can be imported in the form of a file. For example, after filtering multiple logs, the filtered key logs can be exported as corresponding key log files for import into the results display area.

[0060] In another possible implementation, at least one key log entry can be obtained by filtering and matching multiple log entries based on rules. See the following example for details. Further elaboration is omitted here.

[0061] In another possible implementation, at least one key log entry can be obtained by manually adding notes to the original log text, as detailed in the following example. Further details will not be provided here.

[0062] 204. In response to a touch operation on a target key log in at least one key log in the results display area, locate and display the original text of the log corresponding to the target key log in the original text display area.

[0063] Specifically, to facilitate efficient understanding of the context of key logs, a correspondence can be established between key logs in the results display area and the original log text in the original text display area. This allows for easy navigation between the two areas to locate the corresponding log for comparison. The basis for establishing this correspondence could be configuring a unique identifier for each original log text, such as a line number. Both key logs and the original log text possess this unique identifier, allowing for lookup and location based on this identifier.

[0064] For example, when a target key log is selected in the results display area, the original text of the corresponding key log is displayed in the original text display area. For instance, the line containing the original log text can be displayed in the center of the original text display area. The relative positions of other lines to this line remain unchanged. When a key log is selected in the original text display area, if a key log corresponding to that key log exists in the results display area, that key log is displayed in a specific location. For instance, the key log can be displayed in the center of the results display area. It is understood that at least one key log in the results display area can be displayed in chronological order or by line number. When the key log corresponding to the selected key log is displayed in the center, the relative position of that key log among the selected key logs can remain unchanged.

[0065] As can be seen from the above description, the method provided in this disclosure displays the log analysis results, such as key logs, and the original log text on the same screen in their respective areas, which facilitates comparison. It allows for quick location of the line containing the key log in the original log text, enabling further analysis of the key log using the context of the corresponding log. The method is simple to operate and improves analysis efficiency.

[0066] The following combination Figures 3a-3e as well as Figure 4 An example is provided to illustrate how to obtain at least one key log based on rules.

[0067] Figure 4 Flowchart of the log processing method provided in the embodiments of this disclosure Figure 2 .like Figure 4 As shown, in one embodiment of this disclosure, in the above embodiments, as Figure 2 Based on the illustrated embodiment, at least one key log includes at least one first key log; the log consumption interface includes rule controls; step 203, obtaining at least one key log from multiple logs and displaying at least one key log in the result display area, may include:

[0068] 2031. In response to touch operations on rule controls, determine the target rule.

[0069] Specifically, the log consumption interface can be configured with rule controls to determine target rules. Rule controls can take various forms. In one implementation, a rule control can include a rule display area with multiple sub-controls. Different sub-controls correspond to different rules, and when a sub-control is touched, the corresponding rule is selected.

[0070] In another possible implementation, determining the target rule in response to a touch operation on the rule control may include: displaying a rule display panel in response to a touch operation on the rule control; the rule display panel including at least one rule; and determining the target rule in response to a selection operation on at least one rule.

[0071] Specifically, the rules display panel can be displayed in full screen, or it can be displayed above the results display area and the original text display area. This disclosure does not limit this aspect.

[0072] For example, such as Figure 3a As shown, interface 31 also includes a rule control 313. After importing multiple logs, the application receives touch operations (such as clicks or long presses) on control 313. In response to the touch operation, the application can display, for example, on the computer... Figure 3b The interface shown is 32.

[0073] like Figure 3b As shown, the original text display area 312 of interface 32 displays the original text of multiple logs. Interface 32 also includes a rule display panel 314, which includes multiple rules. Different rules include corresponding selection controls 3141. The application receives touch operations (such as click or long press) on the selection control 3141. In response to the touch operation, the corresponding rule is selected as the target rule and executed. After the target rule is executed, the application can display the original text of multiple logs on the computer, as exemplarily. Figure 3c Interface 33 is shown.

[0074] like Figure 3c As shown, the result display area 301 in interface 33 displays the execution results after the target rule is executed. The execution results include the key log display area 3111, which is used to display the matched key logs.

[0075] As described above, in terms of display, the logs collected by the rules are displayed centrally on the left side of the screen, contrasting with the full text of the logs on the right. Clicking on an entry on the left will automatically jump to the corresponding log in the full text on the right, allowing for quick access to the log's context. Furthermore, users can execute multiple rules simultaneously. In addition to displaying the results of each rule, the left panel also shows the aggregated results of these rules, providing a more comprehensive context for these rules.

[0076] In one embodiment of this disclosure, after analyzing multiple logs based on a target rule to obtain the execution result corresponding to the target rule, the method may further include: displaying a rule details panel in response to a touch operation on the target rule; the rule details panel includes an evaluation control; and updating the evaluation result of the target rule in response to a touch operation on the evaluation control.

[0077] Specifically, after executing the target rule, its performance can be evaluated, such as by liking, disliking, or commenting on the rule. This encourages the provider to maintain and update the rule, and allows users to select better rules based on the evaluation results, thereby improving efficiency and promoting cooperation between the provider and users.

[0078] For example, such as Figure 3c As shown, the application receives a touch operation on the rule control 313 and displays as follows. Figure 3d Panel 314 in the interface 34 shown, as Figure 3d As shown, the application receives touch operations on the controls associated with Rule 1 in panel 314, such as clicking on the area where Rule 1 is located, and displays the rule details panel 3142. Rule details panel 3142 may include rule details control 31421, comment control 31422, and details sub-panel 31423. Rule details control 31421 is used to display the corresponding details sub-panel 31423 on panel 314 when triggered. Comment control 31422 is used to display the corresponding comment sub-panel on panel 314 when triggered (not shown, but may include a comment addition control for adding comments, a comment display area for displaying the content of each comment, etc.). The comment sub-panel is used to add and display the user's comments on Rule 1 (which may include problems encountered during use, suggestions for rule improvement, user experience, etc.). Details sub-panel 31423 may include an evaluation control 31424, which is used to receive likes or dislikes. By setting up an evaluation control 314124 in the details sub-panel 31423 to collect user evaluations, users who have not yet used the rule can quickly understand the rule based on the likes and dislikes statistics, improving the efficiency of rule selection. By setting up a comment control 31422 and a comment sub-panel, more detailed suggestions and user experiences can be displayed, allowing the rule creator to improve the rule.

[0079] As described above, in terms of maintaining the quality of rules, this platform provides a rule details panel for each rule. The rule details panel contains basic information about the rule, as well as evaluation functions such as commenting and liking, to reflect the timeliness and reliability of the rule, help rule users quickly understand the rule, and also help rule providers improve the quality of the rule.

[0080] In one embodiment of this disclosure, the log consumption interface includes a rule management control; before determining a target rule in response to a touch operation on the rule control, the interface may further include: displaying a first creation interface in response to a touch operation on the rule management control; the first creation interface includes a mapping relationship configuration control; in response to a touch operation on the mapping relationship configuration control, obtaining corresponding mapping relationship configuration data, and generating a target rule based on the mapping relationship configuration data; the mapping relationship configuration data includes the mapping relationship between the input log matching items and log meaning information.

[0081] For example, such as Figure 3a As shown, the log consumption interface 31 may also include a rule management control 315. The application receives touch operations on the control 315, and the computer displays an example as shown below. Figure 3e The first creation interface shown is 35.

[0082] like Figure 3e As shown, interface 35 includes a mapping relationship configuration control 351, which receives touch operations on control 351 and displays configuration sub-controls 3521 to 3524 corresponding to the mapping relationship 352. Sub-control 3521 is used to add log matching items, such as keywords from the original log text; sub-control 3522 is used to add the meaning information corresponding to the log matching items; sub-control 3523 is used to delete the mapping relationship 352 when triggered; and sub-control 3524 is used to select the form of the log matching items, such as string or regular expression.

[0083] In one embodiment of this disclosure, the first creation interface further includes a condition configuration control; generating a target rule based on mapping relationship configuration data may include: generating condition configuration data corresponding to the target rule in response to a touch operation on the condition configuration control; the condition configuration data includes analysis conclusions corresponding to at least one preset condition; and generating the target rule based on the mapping relationship configuration data and the condition configuration data.

[0084] like Figure 3e As shown, the interface 35 may also include a condition configuration control 353, which receives touch operations on the control 353 and displays configuration sub-controls 3541 to 3544 corresponding to each judgment condition 354. Sub-control 3541 is used to add parameters to be configured, sub-control 3542 is used to add relationship judgment rules, sub-control 3543 is used to add preset thresholds, and sub-control 3544 is used to delete the judgment condition 354.

[0085] In one embodiment of this disclosure, the first creation interface further includes a rule invocation control; generating a target rule based on mapping relationship configuration data may include: displaying a sub-rule display panel in response to a touch operation on the rule invocation control; the sub-rule display panel includes multiple candidate sub-rules; the candidate sub-rules are obtained by marking the rules in the rule display panel; obtaining the configuration data of the target sub-rule in response to a touch operation on the target sub-rule among the multiple candidate sub-rules; and generating the target rule based on the mapping relationship configuration data and the configuration data of the target sub-rule.

[0086] like Figure 3e As shown, the interface 35 may also include a sub-rule calling control 355, which is used to add the mapping relationship and / or judgment condition corresponding to the sub-rule to the corresponding position after being triggered.

[0087] It should be noted that when there are multiple mapping relationships and judgment conditions, the multiple mapping relationships can be set to an OR relationship by default, and the relationship between judgment conditions can also be set to an OR relationship by default. In addition, in order to facilitate users to customize multiple mapping relationships or the relationship between multiple judgment conditions, corresponding controls can be set for configuration.

[0088] As can be seen from the above description, in order to improve efficiency, rule reuse can be implemented by setting common rules as sub-rules. When creating new rules, users can directly integrate the required sub-rules into their own rules and directly use the analysis results of the sub-rules in their own rules, thereby improving the rule reuse rate and increasing the efficiency of rule writing.

[0089] In one embodiment of this disclosure, to improve convenience, users can be provided with multiple rule generation methods, such as webpage input and hard code input.

[0090] In one possible implementation, for webpage input, to simplify the operation, rule generation can be performed using form input. Specifically, in response to a touch operation on the rule management control, a first creation interface is displayed, which may include: displaying a rule creation interface in response to a touch operation on the rule management control; the rule creation interface includes a method selection control; in response to a touch operation on the method selection control, the rule creation method is determined; if the rule creation method is form input, then the first creation interface is displayed.

[0091] In another possible implementation, for webpage input, to accommodate the complexity of the rules, rule generation can be performed using code input. Specifically, in response to a touch operation on the method selection control, after determining the rule creation method, the process may further include: if the rule creation method is code input, displaying a second creation interface; the first creation interface includes a code input box; in response to a touch operation on the code input box, acquiring the input code data, and determining the target rule based on the code data.

[0092] Specifically, rule entry methods can be divided into two types: webpage entry and hard-coding entry. Webpage entry refers to directly entering rules on the platform's webpage. Hard-coding entry refers to writing rules into the platform's source code. Webpage entry is more convenient and flexible, while hard-coding entry is easier to debug. To further improve the efficiency of webpage entry, in addition to entering rule source code, rules can also be entered through forms. Users do not need to write rule logic code; they only need to enter the log matching mapping relationship through a form, greatly improving the efficiency of rule entry. At the same time, form entry also supports regular expression matching mapping and placeholders, making form entry more flexible and applicable to a wider range of situations.

[0093] In terms of hard-coded input, a general writing rule pattern can be provided through the framework layer. Users define rules through annotations without having to worry about UI layer logic. The framework layer will centrally scan all annotations to collect these rules at runtime, which improves the efficiency of hard-coded rule input and lowers the threshold for hard-coded input.

[0094] 2032. Analyze multiple logs based on the target rule to obtain the execution result corresponding to the target rule; the execution result includes at least one first key log.

[0095] Specifically, in terms of rule classification, rules are divided into translation-type rules and conclusion-type rules based on their complexity. Translation-type rules collect matched log lines based on keyword matching principles to help users quickly locate key logs and assist in troubleshooting. Conclusion-type rules, in addition to collecting key log matches, also analyze the logs to draw conclusions, eliminating the need for users to perform further log analysis.

[0096] In one embodiment of this disclosure, the usage process of a translation-type rule is illustrated below. The target rule includes a mapping relationship between log matching items and log meaning information. Analyzing multiple logs based on the target rule to obtain the execution result corresponding to the target rule may include: matching at least one first key log from multiple logs according to the log matching items; the first key log includes corresponding log meaning information.

[0097] In one embodiment of this disclosure, the log matching item includes log keywords or regular expressions. The keywords can be characters, words, etc., from the original log text.

[0098] In one embodiment of this disclosure, the usage process of a conclusion-type rule is exemplified as follows. The target rule further includes at least one preset condition and analysis conclusions corresponding to each preset condition; the execution result further includes: analysis conclusions corresponding to at least one first key log; after obtaining at least one first key log by matching from multiple logs according to log matching items, it may further include: for each first key log, extracting the parameter values ​​of preset parameters corresponding to at least one preset condition; if the parameter values ​​of the preset parameters of multiple first key logs match the target preset condition among at least one preset condition, then the analysis conclusion corresponding to the target preset condition is determined as the analysis conclusion corresponding to at least one first key log.

[0099] 2033. Display the execution results in the results display area.

[0100] As can be seen from the above description, users can automatically analyze logs by using rules, thus avoiding repetitive troubleshooting processes. Moreover, anyone can use rules to automatically analyze logs, which lowers the barrier to log analysis.

[0101] To enable the collection of critical logs and their correlation with the original log text for viewing, in addition to the aforementioned usage rules, this disclosure also provides a "notes" function. The note function can be used when no existing rules exist suitable for resolving the current problem; notes can be manually added from the original text to identify critical logs. The following, in conjunction with... Figures 3f to 3i ,as well as Figure 5 This section provides an example of how to retrieve at least one key log entry based on adding notes.

[0102] Figure 5 Flowchart 3 illustrates the log processing method provided in this embodiment of the disclosure. Figure 5 As shown in the embodiments of this disclosure, in the above embodiments, as Figure 2 Based on the illustrated embodiment, at least one key log includes at least one second key log; step 203, obtaining at least one key log from multiple logs, may include:

[0103] 2034. In response to a touch operation on the original text display area, add note information to at least one first target log among multiple logs; the note information includes the meaning information of the corresponding log.

[0104] 2035. Identify at least one first target log as at least one second key log.

[0105] Specifically, you can take notes on a single log entry or take notes in batches based on search results, so that key log entries can be collected and displayed in the results display area. Clicking on an entry in the notes list in the results display area will quickly jump to the corresponding log entry on the right, allowing you to quickly enter the context.

[0106] At the bottom of the notes list, there is a "Convert to Rule" button, which can be used to quickly convert notes into rules so that the notes can be used again later.

[0107] For example, such as Figure 3f As shown, the result display area 311 in interface 36 displays multiple key logs corresponding to logs with added notes. The content displayed in the key logs includes information about the corresponding added notes. The original text display area 312 displays the original text of multiple logs. Selecting the original text of one log, such as log text 5, displays the note-adding control 3122. Control 3122 is used to display the note-adding panel 3123 for adding notes to a single log after being triggered. Panel 3123 includes a text input box for entering note content and a submission control for confirming submission.

[0108] In one embodiment of this disclosure, the original text display area includes a batch processing control; in response to a touch operation on the original text display area, adding note information to at least one first target log among a plurality of logs may include: in response to a selection operation on a plurality of logs in the original text display area, determining a plurality of first target logs; in response to a touch operation on the batch processing control, simultaneously adding the same note information to the plurality of first target logs.

[0109] For example, such as Figure 3g As shown, the result display area 311 in interface 37 displays multiple key logs corresponding to logs with added notes. The content displayed in the key logs includes information about the corresponding added notes. The original text display area 312 displays the original text of multiple logs. The original text display area 312 includes a search control 3124 and a batch processing control 3125. Touch operations on the search control 3124 allow selection of multiple target log texts from the original text of multiple logs, such as log texts 2, 3, and 5. Touch operations on the batch processing control 3125, in response to these touch operations, display a note-adding panel 3126 for batch adding notes to multiple logs. The panel 3126 includes a text input box for entering note content and a submission control for confirming submission.

[0110] In one embodiment of this disclosure, the result display area includes a rule conversion control; after displaying the meaning information corresponding to at least one log in the result display area, it may further include: in response to a selection operation for at least one second key log, determining a second target log; in response to a touch operation for the rule conversion control, generating a first rule based on the note information of the second target log, and adding the first rule to the rule display panel.

[0111] Specifically, users can select relevant key logs from the results display area, or select the original text of the corresponding logs from the original text display area. After selecting a log with added notes, users can perform rule transformation based on the note information of that log so that the rules can be directly used for log analysis later.

[0112] For example, such as Figure 3h As shown, the result display area 311 in interface 38 displays multiple key logs corresponding to logs with added notes. The key logs display information including the corresponding added notes. The original text display area 312 displays the original text of multiple logs. First, a touch operation can be received for key log 3. In response to this touch operation, key log 3 is selected. Then, a touch operation can be received for rule conversion control 316. In response to this touch operation, the computer displays, for example, as shown below. Figure 3i Interface 39 is shown.

[0113] In one embodiment of this disclosure, generating a first rule based on note information of a second target log in response to a touch operation on the rule conversion control may include: displaying a rule creation panel in response to a touch operation on the rule conversion control; the rule creation panel includes a keyword input box and a log meaning input box; filling the keyword input box with the original log text of the second target log; filling the log meaning input box with the meaning information of the second target log; retaining at least one keyword in the keyword input box in response to an editing operation on the original log text filled in the keyword input box; and generating a first rule based on at least one keyword and the meaning information filled in the log meaning input box.

[0114] For example, such as Figure 3i As shown, control 3521 in interface 39 displays the original log text of key log 3, allowing for editing of the original log text to retain the required keywords. Control 3522 displays the note information for key log 3. By directly populating controls 3521 and 3522 with the original log text and note information, the efficiency of rule conversion can be improved. For introductions to the other controls, please refer to [link / reference needed]. Figure 3e The details described in the text will not be repeated here.

[0115] In one embodiment of this disclosure, to improve search efficiency, simultaneous searching of multiple keywords can be supported; simply add multiple keywords to the search text box. The log consumption interface includes a log search control; the method may further include: in response to an addition operation of at least one keyword to the log search control, distinguishing and displaying the original log text corresponding to at least one keyword from multiple logs in the original text display area based on the input at least one keyword.

[0116] In one embodiment of this disclosure, the log consumption interface includes a reverse filtering control; the method may further include: in response to an addition operation for at least one keyword to the reverse filtering control, hiding the original log text corresponding to at least one keyword in a plurality of logs in the original text display area based on the input at least one keyword.

[0117] As described above, to improve the convenience of search filtering, this disclosure provides multi-keyword search / filtering, enabling users to search for multiple keywords simultaneously and navigate between search results without discarding context. It also provides a reverse filtering function to remove irrelevant logs, making the log context more concise and clear.

[0118] In summary, by using the above embodiments individually or in different combinations to obtain the embodiments, at least the following beneficial effects exist:

[0119] 1. Logs are automatically analyzed using rules. After analysis, key logs are collected and displayed centrally, along with conclusions. Key logs and the full text of the logs are presented side-by-side. Clicking on a key log will automatically navigate to the corresponding log in the full text area.

[0120] 2. General rules are made into sub-rules, and users can directly use the conclusions of the sub-rules when creating rules.

[0121] 3. Take notes on the logs. Collect key logs in the form of notes and put them into a note list. The note list and the full text of the log will be displayed side by side. Clicking on a note will automatically jump to the corresponding log in the full text area.

[0122] 4. Supports reverse filtering, removing logs containing a certain keyword from the logs.

[0123] 5. Supports multi-keyword filtering and searching.

[0124] Corresponding to the log processing method in the above embodiments, Figure 6 This is a structural block diagram of a log processing device provided in an embodiment of this disclosure. For ease of explanation, only the parts relevant to the embodiments of this disclosure are shown. (Refer to...) Figure 6The device 60 includes: an interface display module 601, an original text display module 602, a result display module 603, and an interaction module 604.

[0125] The interface display module 601 is used to display the log consumption interface, which includes a result display area and a original text display area.

[0126] The original text display module 602 is used to obtain multiple logs and display the original text of the multiple logs in the original text display area according to the order of the context;

[0127] The result display module 603 is used to obtain at least one key log from multiple logs and display at least one key log in the result display area.

[0128] The interaction module 604 is used to respond to a touch operation on a target key log in at least one key log in the result display area, and to locate and display the original text of the log corresponding to the target key log in the original text display area.

[0129] In one embodiment of this disclosure, at least one key log includes at least one first key log; the log consumption interface includes a rule control; the result display module 603 is specifically used to: determine a target rule in response to a touch operation on the rule control; analyze multiple logs based on the target rule to obtain the execution result corresponding to the target rule; the execution result includes at least one first key log; and display the execution result in the result display area.

[0130] In one embodiment of this disclosure, the target rule includes a mapping relationship between log matching items and log meaning information; the result display module 603 is specifically used for:

[0131] Based on the log matching items, at least one first key log is obtained by matching from multiple logs; the first key log includes the corresponding log meaning information.

[0132] In one embodiment of this disclosure, log matching items include log keywords or regular expressions.

[0133] In one embodiment of this disclosure, the target rule further includes at least one preset condition and analysis conclusions corresponding to each preset condition; the execution result further includes: analysis conclusions corresponding to at least one first key log; the result display module 603 is specifically used to: extract parameter values ​​of preset parameters corresponding to at least one preset condition for each first key log; if the parameter values ​​of preset parameters of multiple first key logs match the target preset condition in at least one preset condition, then the analysis conclusions corresponding to the target preset condition are determined as the analysis conclusions corresponding to at least one first key log.

[0134] In one embodiment of this disclosure, the result display module 603 is specifically configured to: display a rule display panel in response to a touch operation on a rule control; the rule display panel includes at least one rule; and determine a target rule in response to a selection operation on at least one rule.

[0135] In one embodiment of this disclosure, the result display module 603 is specifically configured to: display a rule details panel in response to a touch operation on the target rule; the rule details panel includes an evaluation control; and update the evaluation result of the target rule in response to a touch operation on the evaluation control.

[0136] In one embodiment of this disclosure, the log consumption interface includes a rule management control; the result display module 603 is specifically used to: display a first creation interface in response to a touch operation on the rule management control; the first creation interface includes a mapping relationship configuration control; in response to a touch operation on the mapping relationship configuration control, obtain the corresponding mapping relationship configuration data, and generate a target rule based on the mapping relationship configuration data; the mapping relationship configuration data includes the mapping relationship between the input log matching items and log meaning information.

[0137] In one embodiment of this disclosure, the first creation interface further includes a condition configuration control; the result display module 603 is specifically used to: generate condition configuration data corresponding to the target rule in response to a touch operation on the condition configuration control; the condition configuration data includes analysis conclusions corresponding to at least one preset condition; and generate the target rule based on the mapping relationship configuration data and the condition configuration data.

[0138] In one embodiment of this disclosure, the result display module 603 is specifically used to: generate condition configuration data corresponding to the target rule in response to a touch operation on the condition configuration control; the condition configuration data includes analysis conclusions corresponding to at least one preset condition; and generate the target rule based on the mapping relationship configuration data and the condition configuration data.

[0139] In one embodiment of this disclosure, the first creation interface further includes a rule invocation control; the result display module 603 is specifically configured to: display a sub-rule display panel in response to a touch operation on the rule invocation control; the sub-rule display panel includes multiple candidate sub-rules; the candidate sub-rules are obtained by marking the rules in the rule display panel; and obtain the configuration data of the target sub-rule in response to a touch operation on the target sub-rule among the multiple candidate sub-rules.

[0140] In one embodiment of this disclosure, the result display module 603 is specifically used to: display a rule creation interface in response to a touch operation on the rule management control; the rule creation interface includes a method selection control; determine the rule creation method in response to a touch operation on the method selection control; if the rule creation method is a form entry method, then display a first creation interface.

[0141] In one embodiment of this disclosure, the result display module 603 is specifically used to: display a second creation interface if the rule creation method is code input; the first creation interface includes a code input box; in response to a touch operation on the code input box, obtain the input code data, and determine the target rule based on the code data.

[0142] In one embodiment of this disclosure, at least one key log includes at least one second key log; the result display module 603 is specifically configured to: in response to a touch operation on the original text display area, add note information to at least one first target log among a plurality of logs; the note information includes the meaning information of the corresponding log; and determine at least one first target log as at least one second key log.

[0143] In one embodiment of this disclosure, the original text display area includes a batch processing control; the result display module 603 is specifically used to: determine multiple first target logs in response to a selection operation of multiple logs in the original text display area; and add the same note information to the multiple first target logs simultaneously in response to a touch operation of the batch processing control.

[0144] In one embodiment of this disclosure, the result display area includes a rule conversion control; the result display module 603 is specifically configured to: determine a second target log in response to a selection operation for at least one second key log; generate a first rule based on the note information of the second target log in response to a touch operation on the rule conversion control, and add the first rule to the rule display panel.

[0145] In one embodiment of this disclosure, the result display module 603 is specifically configured to: display a rule creation panel in response to a touch operation on the rule conversion control; the rule creation panel includes a keyword input box and a log meaning input box; fill the keyword input box with the original log text of the second target log; fill the log meaning input box with the meaning information of the second target log; retain at least one keyword in the keyword input box in response to an editing operation on the original log text filled in the keyword input box; and generate a first rule based on at least one keyword and the meaning information filled in the log meaning input box.

[0146] In one embodiment of this disclosure, the original text display module 602 is specifically used to: in response to a touch operation on the original text display area, import a target log file, and display the original text of multiple logs in the target log file in the original text display area according to the order of the context.

[0147] In one embodiment of this disclosure, the original text display module 602 is specifically used to: split the target log file into multiple sub-files, and import the multiple sub-files in batches; the length of the sub-files is less than a preset length.

[0148] In one embodiment of this disclosure, the original text display module 602 is specifically used for: rendering the log list corresponding to the target log file in blocks based on the React-Window library; filtering multiple logs of the imported target log file according to time, determining the corresponding filtering interval based on the input time interval using a binary search method; and analyzing multiple logs of the imported target log file based on rules, if the current rule to be executed is the same as the previous rule, obtaining the cached execution result after the previous rule was executed, and determining the cached execution result as the execution result corresponding to the current rule.

[0149] In one embodiment of this disclosure, the log consumption interface includes a log search control; the interaction module 604 is further configured to: in response to an addition operation for at least one keyword in the log search control, distinguish and display the original log text corresponding to at least one keyword in multiple logs in the original text display area according to the input at least one keyword.

[0150] In one embodiment of this disclosure, the log consumption interface includes a reverse filtering control; the interaction module 604 is further configured to: in response to an addition operation for at least one keyword to the reverse filtering control, hide the original log text corresponding to at least one keyword in a plurality of logs in the original text display area according to the input at least one keyword.

[0151] The device provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0152] To implement the above embodiments, this disclosure also provides an electronic device.

[0153] refer to Figure 7The diagram illustrates a structural schematic of an electronic device 700 suitable for implementing embodiments of the present disclosure. The electronic device 700 can be a terminal device or a server. The terminal device can include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, personal digital assistants (PDAs), tablet computers, portable media players (PMPs), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 7 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0154] like Figure 7 As shown, the electronic device 700 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the electronic device 700. The processing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0155] Typically, the following devices can be connected to I / O interface 705: input devices 706 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 707 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 708 including, for example, magnetic tapes, hard disks, etc.; and communication devices 709. Communication device 709 allows electronic device 700 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 7 An electronic device 700 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0156] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 709, or installed from storage device 708, or installed from ROM 702. When the computer program is executed by processing device 701, it performs the functions defined in the methods of embodiments of this disclosure.

[0157] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0158] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0159] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods shown in the above embodiments.

[0160] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0161] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0162] The units described in the embodiments of this disclosure can be implemented in software or in hardware. The name of a unit does not necessarily limit the unit itself; for example, the first acquisition unit can also be described as "a unit that acquires at least two Internet Protocol addresses".

[0163] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0164] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0165] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0166] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. A log processing method, characterized in that, include: The log consumption interface is displayed, which includes a result display area and a original text display area. Retrieve multiple logs and display the original log texts of the multiple logs in the original text display area in the order of context; Obtain at least one key log from the plurality of logs, and display at least one key log in the result display area; In response to a touch operation on a target key log in at least one of the key logs in the results display area, the original text of the log corresponding to the target key log in the original text display area is located and displayed.

2. The method according to claim 1, characterized in that, The at least one key log includes at least one first key log; the log consumption interface includes a rule control; obtaining at least one key log from the plurality of logs and displaying at least one key log in the result display area includes: In response to a touch operation on the rule control, a target rule is determined; The multiple logs are analyzed based on the target rule to obtain the execution result corresponding to the target rule; the execution result includes at least one first key log. The execution results are displayed in the results display area.

3. The method according to claim 2, characterized in that, The target rule includes a mapping relationship between log matching items and log meaning information; the step of analyzing the multiple logs based on the target rule to obtain the execution result corresponding to the target rule includes: Based on the log matching item, at least one first key log is obtained by matching from the plurality of logs; the first key log includes corresponding log meaning information.

4. The method according to claim 3, characterized in that, The log matching items include log keywords or regular expressions.

5. The method according to claim 3, characterized in that, The target rule further includes at least one preset condition and analysis conclusions corresponding to the at least one preset condition; the execution result further includes: the analysis conclusions corresponding to the at least one first key log; after obtaining at least one first key log by matching from the plurality of logs according to the log matching item, it further includes: For each of the first key logs, extract the parameter values ​​of the preset parameters corresponding to the at least one preset condition; If the parameter values ​​of preset parameters of multiple first key logs match the target preset condition in at least one preset condition, then the analysis conclusion corresponding to the target preset condition is determined as the analysis conclusion corresponding to the at least one first key log.

6. The method according to claim 2, characterized in that, The step of determining the target rule in response to a touch operation on the rule control includes: In response to a touch operation on the rule control, a rule display panel is displayed; the rule display panel includes at least one rule. In response to the selection operation for the at least one rule, a target rule is determined.

7. The method according to claim 6, characterized in that, After analyzing the multiple logs based on the target rule to obtain the execution result corresponding to the target rule, the method further includes: In response to a touch operation on the target rule, a rule details panel is displayed; the rule details panel includes evaluation controls; In response to a touch operation on the evaluation control, the evaluation result of the target rule is updated.

8. The method according to claim 2, characterized in that, The log consumption interface includes a rule management control; before determining the target rule in response to a touch operation on the rule control, the following steps are also included: In response to a touch operation on the rule management control, a first creation interface is displayed; the first creation interface includes a mapping relationship configuration control. In response to a touch operation on the mapping relationship configuration control, the corresponding mapping relationship configuration data is obtained, and the target rule is generated based on the mapping relationship configuration data; the mapping relationship configuration data includes the mapping relationship between the input log matching items and log meaning information.

9. The method according to claim 8, characterized in that, The first creation interface also includes a condition configuration control; the step of generating the target rule based on the mapping relationship configuration data includes: In response to a touch operation on the condition configuration control, condition configuration data corresponding to the target rule is generated; the condition configuration data includes analysis conclusions corresponding to at least one preset condition. The target rule is generated based on the mapping relationship configuration data and the condition configuration data.

10. The method according to claim 9, characterized in that, The first creation interface also includes a rule invocation control; the step of generating the target rule based on the mapping relationship configuration data includes: In response to a touch operation on the control invoked for the rule, a sub-rule display panel is displayed; the sub-rule display panel includes multiple candidate sub-rules; the candidate sub-rules are obtained by marking the rules in the rule display panel. In response to a touch operation on a target sub-rule among the plurality of candidate sub-rules, the configuration data of the target sub-rule is obtained; The target rule is generated based on the mapping relationship configuration data and the target sub-rule configuration data.

11. The method according to claim 8, characterized in that, The first creation interface is displayed in response to a touch operation on the rule management control, including: In response to a touch operation on the rule management control, a rule creation interface is displayed; the rule creation interface includes a method selection control. In response to a touch operation that selects a control for the aforementioned method, the rule creation method is determined; If the rule is created using a form entry method, the first creation interface will be displayed.

12. The method according to claim 11, characterized in that, After determining the rule creation method in response to a touch operation on the control selected for the method, the method further includes: If the rule is created using code input, a second creation interface is displayed; the first creation interface includes a code input box. In response to a touch operation on the code input box, the input code data is acquired, and the target rule is determined based on the code data.

13. The method according to claim 1, characterized in that, The at least one key log includes at least one second key log; obtaining at least one key log from the plurality of logs includes: In response to a touch operation on the original text display area, note information is added to at least one first target log among the plurality of logs; the note information includes the meaning information of the corresponding log. The at least one first target log is identified as the at least one second key log.

14. The method according to claim 13, characterized in that, The original text display area includes batch processing controls; the step of adding note information to at least one first target log among the plurality of logs in response to a touch operation on the original text display area includes: In response to a selection operation on multiple logs in the original text display area, multiple first target logs are determined; In response to a touch operation on the batch processing control, the same note information is added simultaneously to the multiple first target logs.

15. The method according to claim 13, characterized in that, The result display area includes a rule conversion control; after displaying the meaning information corresponding to the at least one log in the result display area, it further includes: In response to the selection operation for the at least one second key log, a second target log is determined; In response to a touch operation on the rule conversion control, a first rule is generated based on the note information of the second target log, and the first rule is added to the rule display panel.

16. The method according to claim 15, characterized in that, The step of generating a first rule in response to a touch operation on the rule transformation control, based on the note information of the second target log, includes: In response to a touch operation on the rule conversion control, a rule creation panel is displayed; the rule creation panel includes a keyword input box and a log meaning input box; Fill the keyword input box with the original text of the second target log; Fill the log meaning input box with the meaning information of the second target log; In response to an editing operation on the log text filled in the keyword input box, at least one keyword is retained in the keyword input box; A first rule is generated based on the at least one keyword and the meaning information filled in the log meaning input box.

17. The method according to any one of claims 1-16, characterized in that, The step of acquiring multiple logs and displaying the original log texts of the multiple logs in the original text display area in context order includes: In response to a touch operation on the original text display area, a target log file is imported, and the original text of multiple logs in the target log file is displayed in the original text display area in the order of context.

18. The method according to claim 17, characterized in that, The imported target log file includes: The target log file is split into multiple sub-files, and the multiple sub-files are imported in batches; the length of each sub-file is less than a preset length.

19. The method according to claim 17, characterized in that, After importing the target log file, at least one of the following is also included: When rendering the log list corresponding to the target log file, the log list is rendered in blocks based on the React-Window library; When filtering multiple logs from the imported target log file by time, the corresponding filtering interval is determined based on the input time interval using a binary search method. When analyzing multiple logs of an imported target log file based on rules, if the current rule to be executed is the same as the previous rule, the cached execution result after the previous rule was executed is obtained, and the cached execution result is determined as the execution result corresponding to the current rule.

20. The method according to any one of claims 1-16, characterized in that, The log consumption interface includes a log search control; the method further includes: In response to the addition operation of at least one keyword for the log search control, the log text corresponding to the at least one keyword in the plurality of logs is displayed separately in the original text display area according to the input at least one keyword.

21. The method according to any one of claims 1-16, characterized in that, The log consumption interface includes a reverse filtering control; the method further includes: In response to the addition operation for at least one keyword of the reverse filtering control, the log text corresponding to the at least one keyword in the plurality of logs is hidden in the original text display area according to the input at least one keyword.

22. A log processing device, characterized in that, include: The interface display module is used to display the log consumption interface, which includes a result display area and a original text display area. The original text display module is used to acquire multiple logs and display the original text of the multiple logs in the original text display area in the order of context. The result display module is used to obtain at least one key log from the plurality of logs and display at least one key log in the result display area. An interactive module is used to respond to a touch operation on a target key log in at least one key log in the result display area, and to locate and display the original text of the log corresponding to the target key log in the original text display area.

23. An electronic device, characterized in that, include: Processor and memory; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the log processing method as described in any one of claims 1 to 21.

24. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by the processor, implement the log processing method as described in any one of claims 1 to 21.

25. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the log processing method as described in any one of claims 1 to 21.

Images