Server device for log data analysis, program, data analysis system, and data analysis method

Abstract

To freely analyze log data obtained from a measurement instrument or the like, and to output an analysis result which is easily determined even by a person with little experience.SOLUTION: A server device 60 analyzes log data collected by a data collection device 30 in response to an analysis request from a client terminal 70, and provides the analysis result to the client terminal 70. A server device 60 acquires corresponding data corresponding to the analysis request from the log data, inputs a prompt included in the analysis request and the corresponding data into a large-scale language model 81, and acquires an analysis result of the corresponding data according to the prompt from the large-scale language model 81.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a server device, a data analysis program, a data analysis system, and a data analysis method for analyzing log data such as the operating status of an air conditioning facility and the measured values ​​of a sensor. [Background technology]

[0002] Various types of measuring and control devices are installed in buildings, factories, commercial facilities, etc. Measuring devices include devices for measuring physical quantities related to the air conditioning of each facility (such as temperature, flow rate, voltage, and power consumption), while control devices include devices related to the control of the air conditioning equipment of each facility.

[0003] For example, Patent Document 1 discloses a browser-based air conditioning control system. In this system, a building management computer connected to a building management controller functions as a web server, and an environment is created in which this web server can be constantly connected to the Internet via a router and an internet provider. Furthermore, remote client terminals are connected to this web server via the Internet and are configured to be able to view HTML files stored on the web server using a browser. Patent Document 1 also proposes a program that uses the client terminal's browser as an execution environment and can dynamically create a display screen based on data passed from the web server. Specifically, Patent Document 1 describes displaying the individual operating status of each air conditioner in a building on the browser's display screen, and displaying detailed data about the air conditioners not only numerically but also using components such as meters and trend graphs. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2002-071198 Summary of the Invention [Problem to be solved by the invention]

[0005] The system described in Patent Document 1, as described above, is configured to dynamically create a display screen based on data received from a web server using a program executed on a client terminal's browser, and to arrange components on the browser's display screen that allow users to easily visually grasp the status of the air conditioning controller and the entire building air conditioning system. However, because these components are program-defined, the types and formats of meters and trend graphs are predetermined, resulting in a problem of the data that can be displayed by the components being uniform. Specifically, the log data output and accumulated from measuring devices in buildings is diverse and large in volume, including data on temperature, flow rate, voltage, and power consumption. However, uniform components cannot freely analyze data of this nature, and often limit analysis to simple analyses such as whether a single numerical value is large or small. Furthermore, gaining deeper insights from the data displayed by such simple components requires the skilled knowledge of an experienced administrator, while inexperienced administrators have difficulty identifying subtle anomalies or unusual behavior in measuring and control devices from the data displayed by the components.

[0006] Therefore, a main object of the present invention is to enable free analysis of log data obtained from measuring devices and control devices, and to output analysis results that are easy to interpret even for those with little experience. [Means for solving the problem]

[0007] The inventors of the present invention have intensively studied means for solving the problems of conventional inventions, and have discovered that by extracting data corresponding to a user's analysis request from a large amount of accumulated log data and inputting the extracted data together with the user's analysis request (prompt) into a large-scale language model, the degree of freedom in data analysis can be improved, and analysis results that are easy to interpret even for inexperienced people can be obtained from this large-scale language model. Based on this discovery, the inventors have conceived that the problems of the conventional technology can be solved, and have completed the present invention. Specifically, the present invention has the following configuration or steps.

[0008] A first aspect of the present invention relates to a server device 60. The server device 60 according to the present invention is configured to analyze log data collected by the data collection device 30 in response to an analysis request from a client terminal 70 and provide the analysis results to the client terminal 70. The server device 60 is a cloud-based web server connected to the data collection device 30 and the client terminal 70 via the Internet. The server device 60 includes a log data acquisition unit 61e and an analysis unit 61f. The analysis unit 61f acquires corresponding data corresponding to the user's analysis request from the log data. Note that this log data may be stored in the server device 60 itself, or may be stored in another device (e.g., the data collection device 30) connected to the server device 60 via a network. The analysis unit 61f inputs the prompt and corresponding data included in the user's analysis request into a large-scale language model 81 and acquires the analysis results of the corresponding data according to the prompt from the large-scale language model 81. It is assumed that the large-scale language model 81 is basically operated by a web server (a generation AI server) of another business operator connected to the server device 60 via a network. However, it is also possible to store this large-scale language model 81 in the server device 60 itself.

[0009] As configured above, analyzing log data using the large-scale language model 81 allows for flexible analysis results in response to prompts, rather than a standardized analysis. Furthermore, the analysis results of large amounts of log data by the large-scale language model 81 are displayed in verbal or graphical form on the display screen of the client terminal 70, making it easy for even inexperienced users to interpret and gain the same in-depth insight as experienced users. Furthermore, using the large-scale language model 81 is expected to verbalize phenomena that are difficult for humans to interpret. Furthermore, while a typical large-scale language model 81 has an upper limit on the number of data tokens that can be input, the present invention does not input all of the log data into the large-scale language model 81. Instead, data corresponding to the user's analysis request (corresponding data) is partially extracted from the log data and only that portion of data is input. This reduces the number of data tokens input into the large-scale language model 81.

[0010] In the present invention, the log data is preferably time-series data accumulated over time. In this case, the analysis request preferably includes, in addition to the prompt, information on the time interval at which data is acquired from the log data (e.g., 1-minute intervals, 5-minute intervals, 10-minute intervals, 60-minute intervals, etc.) and the period at which data is acquired from the log data (e.g., the start and end of the acquisition period). In this way, by including the time interval and period for data acquisition in the analysis request, it becomes easier to acquire data to be analyzed from the log data, which is time-series data. As a result, the number of data tokens input to the large-scale language model 81 can be efficiently reduced.

[0011] In the present invention, the log data is preferably data accumulated for each item. In this case, the analysis request preferably includes information about the item (e.g., temperature, flow rate, voltage, power consumption, etc.) for which data is to be acquired from the log data. In this way, by accumulating the log data for each item, it becomes possible to acquire data for each item and have the large-scale language model 81 analyze it. As a result, the large-scale language model 81 can provide an analysis result that is easy to understand.

[0012] The server device 60 according to the present invention may further include a related information acquisition unit 61h. The related information acquisition unit 61h acquires related information related to the user's analysis request from a database storing characters and / or images related to the device that outputs data accumulated as log data. Such a database may be stored in the server device 60 itself, or in another device (e.g., the client terminal 70) connected to the server device 60 via a network. In this case, the analysis unit 61f inputs the prompt, corresponding data, and related information included in the user's analysis request into the large-scale language model 81, and acquires the analysis results of the corresponding data and related information according to the prompt from the large-scale language model 81. Examples of related information include device specifications and documents related to operational know-how. By inputting such related information into the large-scale language model 81, more comprehensive analysis results related to the device can be obtained.

[0013] A second aspect of the present invention is a program for causing a computer such as a web server to function as the server device 60 according to the first aspect. Such a program may be downloadable via the Internet, or may be stored on a non-transitory recording medium such as a CD-ROM.

[0014] A third aspect of the present invention relates to a data analysis system 100. The data analysis system 100 according to the present invention includes a client terminal 70, a data collection device 30, and a server device 60. The client terminal 70 is configured to input an analysis request to the server device 60. The data collection device 30 collects data output by one or more devices 10 to be monitored and stores the data as log data. The data collection device 30 is basically assumed to be located within the same local area network as the monitored devices 10. The server device 60 relates to the first aspect described above. That is, the server device 60 analyzes the log data in response to an analysis request from the client terminal 70 and provides the analysis results to the client terminal 70. The server device 60 includes a log data acquisition unit 61e that acquires corresponding data corresponding to the analysis request from the log data, and a data analysis unit 61f that inputs a prompt and the corresponding data included in the analysis request into a large-scale language model 81 and acquires, from the large-scale language model 81, an analysis result of the corresponding data according to the prompt.

[0015] In the data analysis system 100 according to the present invention, the data collection device 30 preferably includes a data acquisition unit 31b and a data conversion unit 31c. The data acquisition unit 31b acquires output data from the devices 10. The data conversion unit 31c converts the output data into text data in a predetermined format. Examples of text data include highly compatible data such as CSV, TSV, SSV, XML, and JSON. This text data is provided from the data collection device 30 to the server device 60 via the Internet using any communication protocol. In this case, the log data is text data accumulated over time. In the data analysis system 100, a data collection device 30 is provided in the same local area network as the monitored devices 10, and has the function of converting output data from each device 10 into text data and uploading it to the server device 60. Note that in this system, the data collection device 30 itself does not function as a web server. Furthermore, it is relatively easy to install such a data collection device 30 on-site in a building, factory, or the like, without impairing the flexibility of the network. Furthermore, in this system, when viewing output data from the monitored device 10 from outside, the client terminal 70 simply accesses the server device 60 on the cloud, and there is no need to directly access the on-site data collection device 30 or other systems, thereby eliminating security issues.

[0016] In the data analysis system 100 according to the present invention, the data acquisition unit 31b preferably acquires multiple types of output data output by the device 10. The data collection device 30 preferably further includes a data classification unit 31a that stores classification information that defines the frequency at which output data is acquired for each type of output data from the device 10. In this case, the data conversion unit 31c preferably references the classification information and integrates output data acquired with the same frequency to generate text data. In this way, by combining output data acquired with the same frequency into a single piece of text data, the frequency and communication volume of text data transmitted from the data collection device 30 to the server device 60 can be reduced.

[0017] A fourth aspect of the present invention relates to a data analysis method. In the data analysis method according to the present invention, a server device 60 analyzes log data collected by a data collection device 30 in response to an analysis request from a client terminal 70, and provides the analysis results to the client terminal 70. In the data analysis method according to the present invention, first, the server device 60 acquires corresponding data corresponding to the analysis request from the log data (log data acquisition step). Next, the server device 60 inputs the prompt and corresponding data included in the analysis request into a large-scale language model 81, and acquires the analysis results of the corresponding data according to the prompt from the large-scale language model 81 (analysis step). [Effects of the Invention]

[0018] According to the present invention, log data obtained from measuring devices and control devices can be freely analyzed, and analysis results that are easy to interpret even for those with little experience can be output. [Brief explanation of the drawings]

[0019] [Figure 1] FIG. 1 shows an overview of a data analysis system according to the first embodiment. [Figure 2] FIG. 2 shows an overview of the monitoring log data collection process performed by the data analysis system. [Figure 3] FIG. 3 is a block diagram showing an example of a functional configuration in the monitoring log data collection process of the data analysis system. [Figure 4] FIG. 4 is a flow diagram illustrating an example of a monitoring log data collection process. [Figure 5] FIG. 5 is a schematic diagram showing an example of a method for acquiring output data from a device to be monitored at a predetermined interval by referring to classification information. [Figure 6] FIG. 6 is a block diagram showing an example of the functional configuration of the data analysis process of the data analysis system. [Figure 7] FIG. 7 shows an example of a display screen of a client terminal in the data analysis process. [Figure 8] FIG. 8 shows an overview of a data analysis system according to the second embodiment. [Figure 9] FIG. 9 is a block diagram showing an example of the functional configuration in the data analysis process of the data analysis system according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0020] Hereinafter, embodiments of the present invention will be described with reference to the drawings. The present invention is not limited to the embodiments described below, and includes appropriate modifications of the embodiments described below within the scope obvious to those skilled in the art.

[0021] [1. First embodiment] FIG. 1 shows an overview of a data analysis system 100 according to a first embodiment of the present invention. As shown in FIG. 1, the data analysis system 100 according to this embodiment basically includes a data collection device 30, a server device 60, a client terminal 70, and a generation AI server 80. The processing steps performed by the data analysis system 100 are mainly divided into a monitoring log data collection step and a data analysis step. The monitoring log data collection step is a step in which data output from monitored devices is collected by the data collection device 30 to create monitoring log data 62a. The data analysis step is a step in which the monitoring log data 62a created in the monitoring log data collection step is analyzed in accordance with a user's analysis request. Therefore, the monitoring log data collection step will be described first, followed by a description of the data analysis step.

[0022] [1-1. Monitoring log data collection process] FIG. 2 shows an overview of the monitoring log data collection process. In this process, data is collected from the monitored devices 10 to create monitoring log data 62a. As shown in FIG. 2, in the data analysis system 100, a local network (LAN) is established in a facility, such as a building or factory, where the monitored devices 10 are installed. In addition to the multiple monitored devices 10, a central monitoring device 20 and a data collection device 30 are also installed within this LAN. These devices 10, 20, and 30 are connected to each other via a gateway 40. The data collection device 30 is also connected to the Internet via a router 50 within the LAN, and can upload various data, such as measurement data and control data, acquired from the monitored devices 10 to a server device 60 on the cloud. The server device 60 stores the various data acquired from the monitored devices 10 in a storage unit 62 as monitoring log data 62a. The server device 60 also generates a web screen to be displayed on a computer display or the like from the various data acquired from the monitored devices 10 and distributes it over the Internet. As a result, various data collected by the data collection device 30 is stored as monitoring log data 62a in the server device 60. Furthermore, multiple users can view this web screen from remote locations using the client terminal 70. This allows users to grasp various data output from the devices 10 to be monitored without having to go to the location where these devices are installed.

[0023] As described above, in the data analysis system 100 of the present invention, the on-site where the monitored device 10 is installed and the remote monitoring site where the user is located are connected via a cloud-based server device 60 via a relay connection, allowing simultaneous connection between the on-site and multiple remote monitoring sites. Furthermore, while there are multiple connection paths between the remote monitoring site and the cloud-based server device 60, there is only one connection path between the on-site and the server device 60, thereby maintaining high security of the on-site LAN. In particular, in this embodiment, the central monitoring device 20 aggregates and stores data obtained from the monitored device 10 within the LAN. However, the central monitoring device 20 is not directly connected to the router 50 and is isolated from the Internet. This prevents information leaks from occurring in the central monitoring device 20. Furthermore, by limiting the connection path between the on-site and the server device 60 to a single path, the device 10 can be remotely monitored simultaneously from multiple remote monitoring sites without placing a burden on the on-site LAN. The monitoring log data collection process performed by the data analysis system 100 of the present invention will now be described in detail.

[0024] Fig. 3 is a block diagram showing the main functional configuration required for executing the monitoring log data collection process in the data analysis system 100. As shown in Fig. 3, the data analysis system 100 mainly includes the monitored device 10, the central monitoring device 20, the data collection device 30, the server device 60, and the client terminal 70 in the monitoring log data collection process. As described with reference to Fig. 2, the device 10, the central monitoring device 20, and the data collection device 30 are connected to each other via the gateway 40 to form a LAN, and the data collection device 30 in this LAN is connected to the Internet via the router 50.

[0025] The device 10 is a machine or instrument to be monitored by the data analysis system 100, and has a function of outputting output data such as measurement data and control data. The type of device 10 is not particularly limited, and examples include various measuring instruments such as a thermometer, a hygrometer, a pressure gauge, a flow meter, and a power consumption measuring instrument (a circuit meter, an ammeter, and a voltmeter). The device 10 may also be, for example, various sensors that detect abnormal / normal conditions and output control signals such as alarm signals and start / stop signals. The output data from the device 10 may be either analog values ​​or digital values. The output data from the device 10 preferably includes information regarding the date and time when the data was output.

[0026] The central monitoring device 20 is a device for aggregating and storing output data output from the devices 10. The multiple devices 10 continuously output output data, such as measurement data and control data, which are aggregated once in the central monitoring device 20. The central monitoring device 20 has a storage device for holding the output data from each device 10. The storage device of the central monitoring device 20 preferably functions as a database that stores the output data by type while maintaining its chronological order. If the output data from the devices 10 includes information about the date and time, the central monitoring device 20 stores the output data according to this information. If the output data from the devices 10 does not include information about the date and time, the central monitoring device 20 adds information about the date and time when the output data was received to the output data and stores the output data together with the date and time information. The central monitoring device 20 can be realized by a general computer equipped with such a storage device and a processing device (a processor such as a CPU) for processing the output data. In the data analysis system 100 according to the present invention, the central monitoring device 20 is optional, and the data collection device 30 may acquire output data directly from each device 10 without going through the central monitoring device 20. Furthermore, since the functions of the central monitoring device 20 can be publicly known, a detailed description of its structure will be omitted in this specification.

[0027] The data collection device 30 is a device that acquires output data from the device 10 at a predetermined period (predetermined frequency), converts the data into text data, and transmits the text data to a server device 60 on the cloud. As shown in FIG. 3 , the data collection device 30 mainly includes a processing unit 31, a storage unit 32, an input unit 33, and a communication unit 34. The processing unit 31 includes, for example, a processor and a main memory. The processor executes predetermined arithmetic processing according to a program loaded in the main memory. The main memory is used to write or read the progress of the arithmetic processing executed by the processor, the results of the arithmetic processing, and the like. The processor may be a known central processing unit (CPU) or a graphics processing unit (GPU). The main memory may be a known volatile memory such as a RAM or DRAM. The storage unit 32 temporarily stores, for example, output data acquired from the device 10 and text data obtained by converting the output data. In this case, the processing unit 31 reads the output data from the storage unit 32, converts it into text data, and temporarily stores the obtained text data in the storage unit 32. The storage unit 32 may also store programs that cause the processing unit 31 to execute various types of arithmetic processing. The storage unit 32 may be a non-volatile memory such as a known HDD or SSD. The input unit 33 is a known interface for inputting data from the central monitoring device 20 or various devices 10 to the processing unit 31. The communication unit 34 is a communication device connected to the Internet via the router 50. The communication unit 34 may be connected to the router 50 in a wired manner or in a wireless manner.

[0028] 3, the processing unit 31 of the data collection device 30 has functional blocks such as a data classification unit 31a, a data acquisition unit 31b, a data conversion unit 31c, and an upload unit 31d in the monitoring log data collection process. These functional blocks are functions obtained by the processing unit 31 executing a predetermined program, and are actually realized by cooperation between the processor and the main memory. Details of these functional blocks will be described later with reference to the flowchart of the monitoring log data collection process shown in FIG. 4.

[0029] The server device 60 accumulates monitoring log data 62a based on the text data obtained from the data collection device 30. The server device 60 can also update a web screen based on the text data obtained from the data collection device 30 and distribute the web screen over the Internet. The server device 60 is configured with one or more web servers on a cloud. All functions may be realized by a single web server, or the functions may be shared among multiple web servers. The server device 60 mainly includes a processing unit 61, a storage unit 62, and a communication unit 63. The processing unit 61 of the server device 60 includes, for example, a processor (CPU or GPU) and main memory (RAM or DRAM), similar to the processing unit 31 of the data collection device 30. The storage unit 62 may be a non-volatile memory such as a known HDD or SSD. The storage unit 62 preferably functions as a database for accumulating the text data obtained from the data collection device 30. The monitoring log data 62a is accumulated in the database constructed in the storage unit 62. Specifically, it is preferable that the measurement data and control data contained in the text data be stored in this database in chronological order for each type of output data.

[0030] 3, the processing unit 61 of the server device 60 has functional blocks such as a web screen generation unit 61a, a data update unit 61b, and a distribution unit 61c. These functional blocks are functions obtained by the processing unit 61 executing a predetermined program, and are actually realized by cooperation between the processor and the main memory. Details of these functional blocks will also be described later with reference to the monitoring log data collection process shown in FIG. 4.

[0031] The client terminal 70 is used by a user, and in the monitoring log data collection process, it is used to view the web screen distributed by the server device 60. Note that in the data analysis process described below, the client terminal 70 is used to input analysis requests to the server device 60 and display analysis results obtained from the server device 60. The client terminal 70 may be one on which a known browser 71 (application program) for viewing web screens via the Internet is installed. There are no particular limitations on the type of client terminal 70, and a smartphone, tablet terminal, desktop terminal, laptop terminal, or the like can be used as appropriate.

[0032] Next, the flow of the monitoring log data collection process will be described with reference to Fig. 4. As shown in Fig. 4, various devices 10 installed in the LAN basically output output data at all times (step S1). As described above, this output data includes measurement data from measuring devices and control data from sensors, etc. The output data from each device 10 is transmitted to the central monitoring device 20 and stored in this central monitoring device 20 (step S2). At this time, the central monitoring device 20 may store the output data for each device 10 that output it and / or for each type of output data, while maintaining the chronological order of the data.

[0033] Next, a description will be given of the processing in the data collecting device 30. As shown in Fig. 4, the data collecting device 30 creates and stores in advance classification information that defines the period (frequency) for acquiring output data from the central monitoring device 20 (or the device 10) (step S3). The processing for creating and storing such classification information is performed by the data classifying unit 31a in the processing unit 31 of the data collecting device 30.

[0034] An example of classification information held by the data classification unit 31a is shown in FIG. 5. The classification information defines the period for acquiring output data for each type of output data. The classification information may include classification information for identifying whether the output data is a digital value or an analog value, and information specifying the values ​​and maximum values ​​that the output data can take. The types of output data are not particularly limited, but in the example shown in FIG. 5, the types of output data include "alarm," "on / off," "control method," "season," "chilled water flow rate," "supply air temperature," "room temperature," and "power consumption" obtained from multiple devices 10 present in the LAN. As shown in FIG. 5, multiple different types of output data may be obtained from a single device 10 (e.g., device A).

[0035] The classification information also specifies the acquisition period for each type of output data. For example, because output data with high urgency, such as "alarm," needs to be acquired early, its acquisition period is set to "10 seconds" (a short period). Furthermore, output data for "on / off" (starting or stopping) is not highly urgent but is important for controlling the equipment, so its acquisition period is set to "1 minute" (a medium period). Furthermore, output data for "chilled water flow rate" does not change frequently and changes slowly, so its acquisition period is set to "10 minutes" (a long period). In this way, the acquisition period can be freely set for each type of output data according to its characteristics. However, if the acquisition period is different for each output data, it would be difficult to collectively convert the output data for each acquisition period into text data, as described below. For this reason, as shown in the example of FIG. 5, it is preferable to divide the acquisition periods into multiple groups, the number of which is fewer than the number of output data types. The number of groups can be set arbitrarily, such as three (10 seconds, 1 minute, 10 minutes) as in the example of FIG. 5.

[0036] As shown in FIG. 4, the data collecting device 30 acquires output data from the central monitoring device 20 (or the device 10) at a predetermined interval (step S4). This output data acquisition process is performed by the data acquiring unit 31b in the processing unit 31 of the data collecting device 30. Note that, "acquiring output data" here means that the data collecting device 30 accesses the central monitoring device 20, reads out output data accumulated in the central monitoring device 20, and stores the data in the main memory or storage unit 32 of the data collecting device 30. When acquiring output data from the central monitoring device 20, the data acquiring unit 31b refers to the classification information held by the data classification unit 31a described above. For example, in the example of classification information shown in FIG. 5, the acquisition interval for "alarm" and "supply air temperature" is set to 10 seconds, so the data acquiring unit 31b acquires these output data from the central monitoring device 20 at 10-second intervals. Furthermore, since the acquisition cycle for "On / Off," "Control Method," and "Indoor Temperature" is set to one minute, the data acquisition unit 31b acquires this output data from the central monitoring device 20 at one-minute intervals. Furthermore, since the acquisition cycle for "Season," "Chilled Water Flow Rate," and "Power Consumption" is set to ten minutes, the data acquisition unit 31b acquires this output data from the central monitoring device 20 at ten-minute intervals.

[0037] Next, the data collection device 30 converts the output data acquired from the central monitoring device 20 into text data in a predetermined format (step S5). This conversion process is performed by the data conversion unit 31c in the processing unit 31 of the data collection device 30. A typical example of text data is CSV (Comma Separated Values). However, examples of text data are not limited to this. Instead of CSV, data written in text-based formats such as TSV (Tab Separated Values), SSV (Space Separated Values), XML (Extensible Markup Language), and JSON (JavaScript Object Notation) can also be used. Note that while XML files and JSON files are convenient formats for web applications, they have the problem of allowing malicious code to be inserted. In contrast, text data in delimited formats such as CSV, TSV, and SSV has a low risk of being executed and causing infection even if malicious code is written in them, and therefore employing these formats improves security. Furthermore, character-format text data is suitable for handling tabular data, and it is relatively easy to integrate the output data for "On / Off," "Control Method," and "Indoor Temperature" into one text data, as shown in Figure 5. Furthermore, it is preferable that the data conversion unit 31c converts the output data acquired by the data acquisition unit 31b from the central monitoring device 20 into text data in real time. In other words, it is preferable that the frequency at which the data acquisition unit 31b outputs the output data and the frequency at which the data conversion unit 31c converts the output data into text data match, and that these processes are performed continuously.

[0038] As described with reference to FIG. 5 , the data acquisition unit 31b divides the acquisition cycle into multiple groups (e.g., 10 seconds, 1 minute, 10 minutes) and acquires output data from the device 10 in batches for each group. In this case, the data conversion unit 31c may integrate the multiple pieces of output data acquired by the data acquisition unit 31b into a single text data set. That is, the data conversion unit 31c integrates multiple types of output data acquired at the same frequency to generate a single text data set. For example, in the example shown in FIG. 5 , the acquisition cycles for the output data for "alarm" and "supply air temperature" are both set to 10 seconds, so the data conversion unit 31c integrates and converts the output data for "alarm" and "supply air temperature" into a single text data set. Similarly, the acquisition cycles for the output data for "on / off," "control method," and "room temperature" are both set to 1 minute, so the data conversion unit 31c integrates and converts the output data for "on / off," "control method," and "room temperature" into a single text data set. The same applies to the output data for "season," "chilled water flow rate," and "power consumption." In this way, one piece of text data can include multiple types of output data acquired at the same cycle.

[0039] Next, the data collecting device 30 uploads the text data generated by the data conversion unit 31c to the server device 60 via the Internet (step S6). This uploading process is performed by the uploading unit 31d in the processing unit 31 of the data collecting device 30. There are no particular limitations on the method or protocol for uploading the text data, and any known method can be used. For example, a folder in the data collecting device 30 and a folder in the server device 60 may be synchronized by a folder sharing program. When text data is stored in a shared folder in the data collecting device 30, the same text data may be automatically copied to the shared folder in the server device 60. Also, known file transfer protocols such as FTP, FTPS, and SCP can be used to upload the text data. For example, when FTP is used, an FTP client may be installed in the data collecting device 30 and an FTP server may be installed in the server device 60, and the text data may be uploaded to the server. That is, in this case, the uploading process may be performed by an uploading unit installed in the server device 60 instead of the uploading unit 31d in the data collecting device 30.

[0040] Next, the processing in the server device 60 will be described. As shown in Fig. 4, the server device 60 stores the text data received from the data collection device 30 in a database-like storage unit 62, and saves this as monitoring log data 62a (step S8). The text data received from the data collection device 30 has been converted into a predetermined format and uploaded to the server device 60 in chronological order along with information about the date and time, so it is easy to store in the database in the storage unit 62. The monitoring log data 62a accumulated in the server device 60 is the subject of analysis in the data analysis step described below.

[0041] As shown in FIG. 4, a web screen is generated in advance in the server device 60 (step S7). This upload process is performed by the web screen generation unit 61a in the processing unit 61 of the server device 60. Specifically, the display data for displaying this web screen is written in a known configuration language such as HTML or CSS. The configuration of the web screen can be set arbitrarily, as long as the layout is such that various output data output from the monitored device 10 can be easily viewed by the user. The web screen generation unit 61a can also accept edit instructions for the web screen from the client terminal 70 and modify the layout, etc., of the web screen. In this way, the user can use the client terminal 70 not only to view the web screen but also to edit the web screen.

[0042] When the server device 60 receives the text data uploaded from the data collecting device 30, it automatically updates the display data for displaying the Web screen based on the text data (step S9). This update process is performed by the data update unit 61b in the processing unit 61 of the server device 60. The data update unit 61b updates the Web screen by adding measurement data and control data of various devices 10 contained in the text data to the display data of the Web screen written in a configuration language such as HTML or CSS, or by replacing the data. The data update unit 61b preferably updates the display data of the Web screen in real time based on the text data uploaded from the data collecting device 30. This allows the user to grasp the measurement data and control data obtained from the monitored device 10 in real time.

[0043] The server device 60 also constantly distributes a web screen via the Internet (step S10). This distribution process is performed by a distribution unit 61c in the processing unit 61 of the server device 60. The web screen distributed by the distribution unit 61c can be viewed by a client terminal 70 having a known internet browser 71 (step S11). By viewing the web screen using the client terminal 70, a user can check measurement data and control data of various devices 10 installed on-site, such as in a building or factory, at any time. Because the user can check this data in real time using such a simple method, any environment connected to the Internet can be used as a remote monitoring base.

[0044] [1-2. Data analysis process] Next, the data analysis process performed by the data analysis system 100 will be described. In the data analysis process, the monitoring log data 62a collected in the monitoring log data collection process described above is analyzed. FIG. 1 shows an overview of the flow of the data analysis process performed by the data analysis system 100 according to the first embodiment. FIG. 6 is a block diagram showing the main functional configuration of the data analysis system 100 required to execute the data analysis process. FIG. 7 shows an example of a display screen of the client terminal 70, showing how an analysis request is input and the corresponding analysis results are displayed.

[0045] 1 and 6, the data analysis system 100 uses a large-scale language model 81 (hereinafter referred to as "LLM 81") provided in the generation AI server 80 to analyze the monitoring log data 62a. That is, the data collection device 30 does not analyze the monitoring log data 62a, but rather the data collection device 30 accepts an analysis request from the client terminal 70, obtains data corresponding to the analysis request (hereinafter referred to as "corresponding data") from the monitoring log data 62a, and passes the analysis request and the corresponding data to the LLM 81 of the generation AI server 80. The LLM 81 then analyzes the corresponding data.

[0046] As shown in Fig. 6, the processing unit 31 of the data collection device 30 has functional blocks such as an input support unit 61d, a log data acquisition unit 61e, an analysis unit 61f, and a defect analysis unit 61g in the data analysis process. These functional blocks are functions obtained by the processing unit 31 executing a predetermined program, and are actually realized by cooperation between a processor and a main memory. Each of these functional blocks 61d to 61g will be described with reference to the flow shown in Fig. 1 and the display screen example shown in Fig. 7.

[0047] 1, the input support unit 61d of the server device 60 supports the reception of an analysis request input from the client terminal 70 (step (1)). Specifically, when the client terminal 70 starts an internet browser and accesses the server device 60 via the internet, the input support unit 61d of the server device 60 displays an analysis request input screen on the browser of the client terminal 70.

[0048] This analysis request may include, for example, the "data item," "data interval," "data period," and "analysis content" or "question content" to be analyzed. The "data item" may be, for example, a classification of the type of data output from the monitored device 10. For example, if the monitored device 10 includes measuring instruments such as a thermometer, hygrometer, pressure gauge, flow meter, and power consumption meter (circuit meter, ammeter, voltmeter), the types of data output from these measuring instruments may be designated as the respective data items. Furthermore, if the monitored device 10 includes a control device, the respective data items may include alarm signals, start / stop signals, and signals specifying the control method output from the control device. The "data interval" refers to the interval between data extracted from the monitoring log data 62a and may be any interval, such as 1 minute, 3 minutes, 5 minutes, 10 minutes, 15 minutes, 30 minutes, or 60 minutes. The "data period" refers to the period of data extracted from the monitoring log data 62a. For example, the start and end of the data period may be determined arbitrarily. The "analysis content" or "question content" is what is called a prompt, and is an analysis instruction or question entered by the user in dialogue with the generation AI server 80 equipped with the LLM 81. By entering this prompt, the user can specify to the generation AI server 80 how to analyze the monitoring log data, etc.

[0049] 7 shows an example of an input screen for an analysis request that is displayed on the user's client terminal 70. This input screen is displayed on the browser of the client terminal 70, and the display data for this input screen is provided to the client terminal 70 from the input support unit 61d of the server device 60. The user can operate the client terminal 70 to input a request for analysis of monitoring log data via this input screen.

[0050] Specifically, when log analysis is turned "ON," the user can enter the log interval (minutes), log start date and time, log end date and time, and analysis item. In the illustrated example, the log interval is entered as "10 minutes." This log interval is a drop-down list that lists potential time intervals, allowing the user to select the desired interval from among those options. Alternatively, the user can enter any other time interval. In the illustrated example, the log interval date and time is "Monday, January 1, 2024, 00:00," and the log end date and time is "Friday, January 5, 2024, 00:00." The user can enter any date and time for each of the log interval date and time and the log end date and time. In the illustrated example, the analysis item is "outside air temperature." This analysis item is also a drop-down list that lists potential items that can be analyzed, allowing the user to select the desired item from those options. The analysis item is not limited to one item; multiple items can also be selected. The analysis items are just examples, but in addition to "outside temperature," various other items can be listed, such as "outside humidity," "air conditioning load heat," "alarm," "on / off," "control method," "season," "chilled water flow rate," "supply air temperature," "indoor temperature," and "power consumption."

[0051] In the illustrated example, the question entered is, "Please display a graph for the relevant data period." The user can freely enter the question via the client terminal 70. Fixed phrases are also provided for the question, and clicking a fixed phrase allows the user to select any question from the pre-prepared fixed phrases. Possible fixed phrases include, for example, "Please tell me an overview of the data," "Please tell me the maximum and minimum values ​​of the data," "Please tell me the data trends," "Please predict the data for 24 hours from the end date of the log," "Please introduce yourself," and "What can this system do?" These fixed phrases may also be prepared for each analysis item. In other words, changing the analysis item may also change the prepared fixed phrases. Clicking the "Add" icon allows the user to add a question. After completing the analysis request input via the input screen, the user clicks the "Send" icon to send the analysis request from the client terminal 70 to the server device 60.

[0052] Next, as shown in FIG. 1, the log data acquisition unit 61e of the server device 60 acquires data (corresponding data) corresponding to the analysis request from the monitoring log data 62a based on the analysis request received from the client terminal 70 (steps (2) and (3)). As described above, the analysis request includes a "data item," a "data interval," a "data period," and an "analysis content" or "question content." When acquiring data from the monitoring log data 62a, information on the "data item," the "data interval," and the "data period" in the analysis request is used. The monitoring log data 62a stores output data from the monitored device 10 as time-series data by type. The type of this output data basically corresponds to the "data item" referred to here. Specifically, the log data acquisition unit 61e acquires data of the type corresponding to the "data item" specified in the analysis request from the monitoring log data 62a, within the period specified by the "data period," at the interval specified by the "data interval." Regarding the "data interval," for example, if data is accumulated at one-minute intervals in the monitoring log data 62a and five minutes is specified as the "data interval," the data accumulated in the monitoring log data 62a will be thinned from one-minute intervals to five-minute intervals before being acquired. In this way, by including a "data interval" specification in the analysis request, the amount of data to be analyzed can be reduced.

[0053] In this embodiment, the monitoring log data 62a is stored in the storage unit 62 of the server device 60 (see FIG. 6). Storing the monitoring log data 62a collected by the data collection device 30 in the server device 60 in this manner can speed up the process of acquiring corresponding data corresponding to an analysis request from the monitoring log data 62a. However, the monitoring log data 62a is not limited to being stored in the server device 60, and can also be stored in other devices connected to the server device 60.

[0054] Next, as shown in FIG. 1, the analysis unit 61f of the server device 60 inputs the analysis request input from the client terminal 70 and the corresponding data acquired from the monitoring log data 62a to the LLM 81 of the generation AI server 80, and requests the LLM 81 to analyze the corresponding data (step (4)). As described above, the analysis request includes the "data item," "data interval," "data period," and "analysis content" or "question content." The server device 60 may input all of this information to the LLM 81, or, for example, only a portion of it. However, input of the "analysis content" or "question content" is mandatory. Here, the information input to the LLM 81 is referred to as a "prompt." The analysis unit 61f inputs the prompt and the corresponding data acquired from the monitoring log data 62a to the LLM 81, and causes the LLM 81 to analyze the corresponding data according to the prompt. In other words, the corresponding data is the subject of data analysis by the LLM 81.

[0055] The generative AI server 80 is a web server on the Internet that has the LLM 81 and is constructed from one or more servers. The generative AI server 80 is operated by a business that provides services related to the use of the LLM 81. The generative AI server 80 is not particularly limited, and any publicly known server that provides such services may be used. The LLM (Large Language Model) 81 is a language model trained from a massive amount of text data. The LLM 81 has billions to tens of billions of parameters and can model the expression and meaning of natural language with high accuracy. The LLM 81 demonstrates excellent performance in various natural language processing tasks, such as text generation, data analysis, question answering, and summarization. The LLM 81 has a deep understanding of the context of the prompt entered therein and can generate natural, human-like responses. The LLM 81 is pre-trained from a massive amount of text data on the Internet using methods such as supervised learning and unsupervised learning. The Transformer is the mainstream architecture for LLM81, but other architectures such as LSTM (Long Short-Term Memory), CNN (Convolutional Neural Network), Sparse Transform, and FeedForward Neural Network can also be used, and it is also possible to use a combination of different architectures depending on the application.

[0056] The upper part of the example display screen of the client terminal 70 in FIG. 7 shows an example of a prompt and corresponding data input from the server device 60 to the LLM 81. In the illustrated example, the following information is input to the LLM 81: "Analysis item: Outside air temperature (Toa), Log period: 2024-01-01 00:00 to 2024-01-05 00:00, Question: Please display a graph for the relevant data period." Furthermore, as the data to be analyzed, data from the relevant period, thinned out at 10-minute intervals, is input to the LLM 81. Because there is usually a limit to the number of tokens that can be input to the LLM 81, it may not be possible to input all of the data from the relevant period. In this regard, by thinning the data from the relevant period at predetermined intervals and inputting it into the LLM 81, the number of tokens can be saved. Although there is a limit to the number of tokens that can be input to the LLM 81, the more information input to the LLM 81, the more accurate the answer can be expected. For this reason, the server device 60 may be equipped with a function for automatically determining the time interval and period for acquiring data from the monitoring log data 62a so that as much information as possible can be input to the LLM 81 without exceeding the upper limit of the number of tokens. For example, if a question is entered specifying only the log start date and time and the log end date and time without inputting the log interval, the log data acquisition unit 61e of the server device 60 may automatically determine the time interval for acquiring data from the monitoring log data 62a so that as much information as possible can be input to the LLM 81 without exceeding the upper limit of the number of tokens, and acquire data from the monitoring log data 62a.

[0057] Next, as shown in FIG. 1, the generation AI server 80 transmits the analysis results of the LLM 81 to the server device 60 (step (5)). The analysis results of the LLM 81 vary depending on the input prompt and the corresponding data to be analyzed, but generally include text data explaining the analysis results and data for graphs showing the analysis results. Next, the server device 60 transmits data for displaying the analysis results of the LLM 81 obtained from the generation AI server 80 to the client terminal 70 that input the analysis request (step (6)). When the client terminal 70 receives the display data for the analysis results from the server device 60, the analysis results are displayed on the display screen of the internet browser. Note that when a graph is displayed on the client terminal 70, the LLM 81 itself may create the graph, or the server device 60 may create the graph based on the output from the LLM 81, or the client terminal 70 may create the graph based on the output from the server device 60.

[0058] The middle section of the example display screen of the client terminal 70 in Fig. 7 shows an example of an analysis result of the LLM 81 obtained in response to the prompt shown in the upper section of Fig. 7. As described above, in the example of Fig. 7, data on outside air temperature (Toa) thinned out at 10-minute intervals over a specified period (2024-01-01 00:00 to 2024-01-05 00:00) is input to the LLM 81, and an instruction to "display a graph for the period corresponding to the data" is input to the LLM 81. Therefore, the analysis result from the LLM 81 is data for generating a line graph showing changes in outside air temperature (Toa) over the specified period, and this line graph is displayed on the client terminal 70.

[0059] Note that the input to and output from the LLM 81 shown in Figure 7 are merely examples. Other possible input and output examples include the following: (Example 1) Trend analysis Input: Outside temperature + data from the past week + "Analyze data trends" Output: "In the mornings, it drops to around 3°C. During the day, it rises to around 12°C, and then tends to drop again at night, down to around 4°C." (Example 2) Maximum and minimum value analysis Input: Air conditioning load heat amount + data from the past month + "Please tell me the maximum and minimum values" Output: "The maximum temperature was 15°C at 3:00 PM on Wednesday, December 22nd, and the minimum temperature was 1°C at 4:00 AM on December 8th." (Example 3) Graph display Input: Air conditioning load heat value + data from the past two weeks + "Display graph" Output: A graph for two weeks is displayed. (Example 4) Data prediction Input: Air conditioning load heat value + data from the past week + "Predict the value for the next 24 hours every hour and display it in a graph" Output: A forecast graph is displayed for the next 24 hours from now.

[0060] The processing unit 61 of the server device 60 may further include a defect analysis unit 61g for analyzing defects in the monitoring log data 62a. The defect analysis unit 61g has a function of analyzing whether or not there is a defect in the data in the monitoring log data 62a and complementing the data in the defective portion when, for example, reading data corresponding to an analysis request from the monitoring log data 62a.

[0061] For example, when reading data corresponding to an analysis request from the monitoring log data 62a, the loss analysis unit 61g examines all data for the period specified in the analysis request. Data for the specified period should generally be accumulated at predetermined time intervals, but if, for example, an abnormality occurs in the monitored device 10, data may not be output correctly from the device 10, resulting in missing data in the monitoring log data 62a. If the loss analysis unit 61g finds such missing data, it notifies the client terminal 70. This allows the user to check whether or not there is missing data when performing data analysis.

[0062] Furthermore, if the defect analysis unit 61g finds data loss during the above-described inspection when reading data corresponding to an analysis request from the monitoring log data 62a, it may complement the lost data. For example, the missing data may be complemented by calculating an average value from data before and after the missing portion. Other well-known complementation methods, such as linear interpolation, moving average interpolation, polynomial interpolation, and spline interpolation, may also be employed. The complemented data thus obtained is incorporated into the data that the analysis unit 61f passes to the LLM 81. That is, even if data acquired from the monitoring log data 62a contains a loss, the lost portion is complemented and input to the LLM 81. This allows the LLM 81 to obtain analysis results that ignore the data loss.

[0063] Furthermore, if the defect analysis unit 61g finds data loss through the above-described inspection when reading data corresponding to an analysis request from the monitoring log data 62a, it may compile information related to the data loss and input it to the LLM 81 along with the data obtained from the monitoring log data 62a. In this case, appropriate advice regarding the data loss can be obtained from the LLM 81. As an example, if the defect analysis unit 61g compiles the following missing data and inputs it to the LLM 81, it is expected that the LLM 81 will produce the following analysis results: (example) - Information summarizing missing data 2024-01-23 15:06 Outside temperature January 23, 2024, 15:07 Outside temperature January 23, 2024, 15:08 Outside temperature February 2, 2024 03:08 Air conditioning load heat amount LLM analysis answer example for missing data "There was a loss of outdoor temperature data for three minutes from 15:06 on January 23, 2024. There were no abnormalities in other data, and it has since been restored, so we recommend checking the wiring of the outdoor air sensor and the wiring of the communication device. In addition, there has been a loss of air conditioning load heat quantity data since 3:08 on February 2, 2024. There are no abnormalities in other data, so this is thought to be a malfunction of the calorimeter itself."

[0064] [2. Second Embodiment] Next, a data analysis system 100 according to a second embodiment of the present invention will be described with reference to Figures 8 and 9. The second embodiment will be described mainly focusing on the differences from the first embodiment described above, and a description of the same points as the first embodiment will be omitted.

[0065] As shown in FIG. 8, the data analysis system 100 according to the second embodiment performs a related information accumulation step. In the related information accumulation step, information related to the device 10 (see FIG. 2) to be monitored is accumulated in a database to create related information data 62b. Specifically, as related information about the device 10, documents (document files) describing specifications, instruction manuals, and operational know-how for each device 10 are stored in a data storage. These documents are assumed to be in well-known formats, such as Word files, Excel files, and PDF files. Data storages storing documents containing such related information are present in various computers, including the client terminal 70. In this case, character information and image information are extracted from the documents stored in the data storage, and the extracted information is stored in a database as related information data 62b. The extraction process of character information and image information may be performed, for example, by the client terminal 70 or the server device 60. The character information and image information may be extracted from the documents using a well-known method. Furthermore, the related information data 62b is preferably stored in the storage unit 62 of the server device 60, but may also be stored in another device connected to the server device 60.

[0066] The related information data 62b thus created in advance by the related information accumulation step can be used in the data analysis step described above. That is, in the second embodiment shown in Fig. 8, similarly to the first embodiment shown in Fig. 1, a step (step (1)) of inputting an analysis request from the client terminal 70 to the server device 60 and a step (steps (2) and (3)) of the server device 60 acquiring data corresponding to this analysis request from the monitoring log data 62a are performed. Thereafter, the related information acquisition unit 61h (see Fig. 9) of the processing unit 61 of the server device 60 searches the related information data 62b and acquires related information (text information and / or image information) of the device 10 corresponding to this analysis request from the related information data 62b (steps (4) and (5)). Thereafter, the analysis unit 61f (see FIG. 9) of the processing unit 61 of the server device 60 inputs the analysis request input from the client terminal 70, the corresponding data acquired from the monitoring log data 62a, and the related information of the device 10 acquired from the related information data 62b to the LLM 81 of the generation AI server 80, and requests the LLM 81 to analyze the corresponding data and the related information (step (6)). As a result, the LLM 81 obtains an analysis result of the corresponding data based on the related information of the device 10, and the server device 60 transmits the analysis result to the client terminal 70 to display it on the browser screen (steps (7) and (8)).

[0067] In this way, in the second embodiment, specifications describing the capabilities and performance of the device 10 to be monitored and documented data of previously known knowledge are input to the LLM 81 along with a prompt. This makes it possible to obtain more accurate analysis results from the LLM 81. Although merely an example, the following are assumed examples of input to the LLM 81 and output from the LLM. (Example 5) Trend analysis Input: Air conditioning load heat amount + data from the past week + "Please tell me the maximum and minimum values ​​and general situation" Output: "The maximum value was 1800kW at 3pm on Wednesday, December 22nd, and the minimum value was 100kW at 4am on December 8th, but the chilled water production capacity is insufficient with just one chiller. A second chiller must be started."

[0068] In the above description of the present invention, the embodiments of the present invention have been described with reference to the drawings in order to express the contents of the present invention. However, the present invention is not limited to the above embodiments, and includes modifications and improvements that are obvious to those skilled in the art based on the matters described in the present specification. [Explanation of symbols]

[0069] 10…Equipment 20…Central monitoring device 30...Data collection device 31...Processing unit 31a...Data classification unit 31b...Data acquisition unit 31c...Data conversion section 31d...Upload section 32...Memory section 33...Input section 34...Communication unit 40...Gateway 50...Router 60...Server device 61... Processing unit 61a... Web screen generation unit 61b...Data update section 61c...Distribution section 61d...input support unit 61e...log data acquisition unit 61f...Analysis section 61g...Defect analysis section 61h... Related information acquisition unit 62... Storage unit 62a...Monitoring log data 62b...Related information data 63...Communication unit 70...Client terminal 71...Browser 80...Generative AI server 81...Large-scale language models 100...Data analysis systems

Claims

1. A server device that analyzes log data collected by a data collection device in response to an analysis request from a client terminal and provides the analysis result to the client terminal, a log data acquisition unit that acquires corresponding data corresponding to the analysis request from the log data; an analysis unit that inputs the prompt and the corresponding data included in the analysis request into a large-scale language model and obtains an analysis result of the corresponding data according to the prompt from the large-scale language model; Server device.

2. The log data is time-series data accumulated over time, In addition to the prompt, the analysis request includes information about a time interval for acquiring data from the log data and a period for acquiring data from the log data. The server device according to claim 1 .

3. The log data is further accumulated data for each item, The analysis request further includes information about an item for which data is to be obtained from the log data. The server device according to claim 2 .

4. a related information acquisition unit that acquires related information related to the analysis request from a database that stores characters and / or images related to a device that outputs data that is accumulated as the log data; The analysis unit inputs the prompt, the corresponding data, and the related information included in the analysis request into a large-scale language model, and obtains an analysis result of the corresponding data and the related information according to the prompt from the large-scale language model. The server device according to claim 1 .

5. A program for causing a computer to function as the server device according to claim 1.

6. A data analysis system including a client terminal, a data collection device that collects data output by one or more devices to be monitored and stores the data as log data, and a server device that analyzes the log data in response to an analysis request from the client terminal and provides the analysis results to the client terminal, The server device a log data acquisition unit that acquires corresponding data corresponding to the analysis request from the log data; a data analysis unit that inputs the prompt and the corresponding data included in the analysis request into a large-scale language model and acquires an analysis result of the corresponding data according to the prompt from the large-scale language model; Data analysis system.

7. The data collection device a data acquisition unit that acquires output data output by the device; a data conversion unit that converts the output data into text data in a predetermined format; The log data is the text data accumulated over time. The data analysis system of claim 6 .

8. the data acquisition unit acquires a plurality of types of output data output by the device, the data collection device further includes a data classification unit that stores classification information that defines a frequency of acquiring the output data for each type of the output data of the device; The data conversion unit refers to the classification information, integrates the output data acquired with the same frequency, and generates the text data. The data analysis system of claim 7 .

9. A data analysis method in which a server device analyzes log data collected by a data collection device in response to an analysis request from a client terminal, and provides the analysis results to the client terminal, comprising: a log data acquisition step of acquiring corresponding data corresponding to the analysis request from the log data; an analysis step of inputting the prompt and the corresponding data included in the analysis request into a large-scale language model and obtaining an analysis result of the corresponding data according to the prompt from the large-scale language model; Data analysis methods.

Images