Log data retrieval method, log data retrieval device, computer equipment, and computer program

Abstract

The present application relates to a log data search method, the method includes: a step (202) of determining a target node matching a search time range from a log search time tree, where each node in the log search time tree records a time range of a log search, and the time range recorded in the target node and the search time range have an intersection; a step (204) of determining a target subtree from a subtree under the target node; a step (206) of starting a leaf node scanning process from an edge leaf node of the target subtree, and stopping the scanning after finding a target leaf node by scanning, where log data corresponding to a time value within the target time range recorded in the target leaf node exists on a disk; a step (208) of obtaining a boundary time value corresponding to the search time range by determining a time value in a critical state corresponding to the log data recorded in the target leaf node; and a step (210) of obtaining the log data matching the search time range from the disk based on the boundary time value.

Description

Technical Field

[0001] This application claims priority based on a Chinese patent application filed with the China National Intellectual Property Administration on July 20, 2022, with an application number of 202210862134.9 and an invention title of "Log Data Search Method, Apparatus, Device, and Medium", and all of its content is incorporated herein by reference.

[0002] This application relates to data search technology, and further relates to the field of cloud technology, particularly to log data search methods, apparatuses, devices, and media.

Background Art

[0003] Log data generated by daily business interactions is usually stored on a disk. Since the amount of log data is generally relatively large, it is highly probable that log data is stored in multiple sectors of the disk respectively. This brings great difficulties to the search of log data. For example, when searching for log data within a certain time range from the disk using a binary search method, distributed access is likely to occur. That is, there is a high probability that the log data at the intermediate position in the binary search process is distributed in multiple sectors of the disk. Each time the log data at the intermediate position is read, it is necessary to execute a read / write operation on the corresponding sector once. Since multiple read / write operations on multiple sectors take a long time, the search efficiency of log data is reduced.

Summary of the Invention

Problems to be Solved by the Invention

[0004] Based on this, it is necessary to provide a log data search method, apparatus, device, and medium for the above technical problems.

Means for Solving the Problems

[0005] According to a first aspect, this application provides a log data search method executed by a computer device. The method includes: A step of determining a target node that matches the search time range from a log search time tree, wherein each node in the log search time tree is for recording the time range to be used for log search, and there is a common set between the time range recorded in the target node and the search time range. A step of determining a target subtree from the subtrees under the target node, wherein the target subtree is for searching for boundary time values ​​corresponding to the search time range. The steps include: starting a leaf node scanning process from the edge leaf node of the target subtree, stopping the scanning (also called "traversing") after finding the target leaf node, wherein log data corresponding to the time value within the target time range recorded on the target leaf node exists on disk; The steps include: obtaining boundary time values ​​corresponding to the search time range by determining the critical time values ​​corresponding to the log data recorded in the target leaf node; The process includes the step of obtaining log data from disk that matches the search time range based on the boundary time value.

[0006] According to a second aspect, the present application provides a log data retrieval device. The device includes a determination module, a scanning module, and an acquisition module. The decision module determines a target node that matches the search time range from the log search time tree, and each node in the log search time tree is for recording the time range to be used for log searching, and there is a common set between the time range recorded in the target node and the search time range. The decision module further determines a target subtree from the subtrees under the target node, and the target subtree is for searching for boundary time values ​​corresponding to the search time range. The scanning module starts the leaf node scanning process from the edge leaf node of the target subtree, and after finding the target leaf node through scanning, stops scanning and confirms that log data corresponding to the time value within the target time range recorded in the target leaf node exists on disk. The decision module further determines the critical time value corresponding to the log data recorded on the target leaf node, thereby obtaining the boundary time value corresponding to the search time range. The acquisition module retrieves log data from disk that matches the search time range based on the boundary time value.

[0007] According to a third aspect, the present invention provides a computer device comprising memory and one or more processors. The memory stores computer-readable instructions, and the processors, upon executing the computer-readable instructions, realize the steps in each embodiment of the present invention.

[0008] According to a fourth aspect, the present application provides one or more computer-readable storage media storing computer-readable instructions. When executed by one or more processors, these computer-readable instructions realize the steps in each embodiment of the present application.

[0009] According to a fifth aspect, the present application provides a computer program product that includes computer-readable instructions. When executed by one or more processors, the computer-readable instructions realize the steps in each embodiment of the present application.

[0010] Details of one or more embodiments of the present application are described in the following drawings and description. Other features, purposes, and advantages of the present application will become apparent from the specification, drawings, and claims.

[0011] To more clearly explain the configuration of the embodiments of this application, the following is a brief introduction of the drawings necessary for describing the embodiments. Clearly, the drawings in the following description only show some embodiments of this application, and those skilled in the art can obtain other drawings from these without any creative work. [Brief explanation of the drawing]

[0012] [Figure 1] This is a diagram illustrating the application environment of a log data search method in one embodiment. [Figure 2] This is a schematic diagram illustrating the flow of a log data search method in one embodiment. [Figure 3] This is a schematic diagram of the log search time tree structure in one embodiment. [Figure 4] This is a schematic diagram illustrating the principle of binary search in one embodiment. [Figure 5] This is a schematic diagram showing the search time range and the common set of each subtree under the target node in one embodiment. [Figure 6] This is a schematic diagram illustrating the flow of the boundary time value search step in one embodiment. [Figure 7] This is a schematic diagram illustrating the flow of the log data search method in another embodiment. [Figure 8] This is a block diagram of the configuration of a log data retrieval device in one embodiment. [Figure 9] This is a diagram showing the internal configuration of a computer device in one embodiment. [Figure 10] This is a diagram showing the internal configuration of a computer device in another embodiment. [Modes for carrying out the invention]

[0013] To further clarify the purpose, structure, and merits of this application, the application will be described in more detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are for interpretation purposes only and do not limit the application.

[0014] The log data retrieval method provided in this application is applicable to the application environment shown in Figure 1. Here, terminal 102 communicates with server 104 via a network. A data storage system can store data that server 104 needs to process. The data storage system may be embedded in server 104, or it may be located in the cloud or on another server. Here, terminal 102 may be, but is not limited to, various desktop computers, laptop computers, smartphones, tablet computers, Internet of Things devices, and portable wearable devices. Internet of Things devices may include smart speakers, smart TVs, smart air conditioners, smart in-car devices, etc. Portable wearable devices may include smartwatches, smart bracelets, head-mounted devices, etc. Server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides base cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDNs, and big data and artificial intelligence platforms. The terminal 102 and the server 104 may be connected directly or indirectly by a wired or wireless communication method. This invention is not limited thereto.

[0015] Server 104 may determine target nodes that match the search time range from the log search time tree. Each node in the log search time tree is for recording the time range to be used for log search, and there is a common set between the time range recorded in the target node and the search time range. Server 104 determines a target subtree for searching for boundary time values corresponding to the search time range from the subtrees under the target node, starts leaf node scanning processing from the edge leaf nodes of the target subtree, and may stop the scanning after finding the target leaf node by scanning. Log data corresponding to the time values within the target time range recorded in the target leaf node exists on the disk. Server 104 may obtain the boundary time value corresponding to the search time range by determining the time value in the critical state corresponding to the log data recorded in the target leaf node. Server 104 may obtain the log data that matches the search time range from the disk based on the boundary time value.

[0016] As can be understood, terminal 102 may obtain the search time range and send the search time range to server 104. Furthermore, server 104 can determine target nodes that match the search time range from the log search time tree. Also, as can be understood, server 104 may send the obtained log data that matches the search time range to terminal 102. Thereby, it is provided for terminal 102 to perform corresponding business processing. This embodiment does not limit this. As can be understood, the application scenario in FIG. 1 is only a schematic description and is not limited thereto.

[0017] In one embodiment, as shown in FIG. 2, a log data search method is provided. This method is applicable to computer devices (the computer device may be a terminal or a server), and may be executed alone by the terminal or the server itself, or may be realized by the interaction between the terminal and the server. In this embodiment, the case of applying this method to a computer device will be described as an example. This method includes the following steps.

[0018] In step 202, a target node matching the search time range is determined from the log search time tree. Each node in the log search time tree is used to record the time range to be used for log searching, and there is a common set between the time range recorded in the target node and the search time range.

[0019] Here, the search time range is the time range for searching log data. For example, if a user wants to search for log data within the time range of 10:00 to 11:00 yesterday, then the search time range would be 10:00 to 11:00 yesterday. The target node is a node in the log search time tree that has an intersection with the search time range.

[0020] Specifically, each node in the log search time tree may record the time range to be used for log searching, and the log search time tree may be stored on the computer's disk. The computer may determine a target node that matches the search time range entered by the user from the log search time tree on the disk.

[0021] In step 204, the target subtree is determined from the subtrees under the target node, and the target subtree is used to find boundary time values ​​corresponding to the search time range.

[0022] Here, boundary time values ​​are critical time values ​​within the search time range that correspond to log data. To help you understand, let's look at an example. For instance, the search time range entered by the user is 10:00 to 11:00. There is no log data corresponding to each point in the two time ranges 10:00 to 10:09 and 10:51 to 11:00, but there is log data corresponding to the two time values ​​10:10 and 10:50, and there is also a possibility that there is log data corresponding to each time value within the 10:10 to 10:50 time range. To help you understand, the two time values ​​10:10 and 10:50 are at the critical point within the 10:10 to 10:50 time range. Therefore, the two time values ​​10:10 and 10:50 become boundary time values.

[0023] Specifically, the number of subtrees under the target node is at least one, and the computer equipment may determine the target subtree for searching for boundary time values ​​from each subtree under the target node.

[0024] In one embodiment, the computer device may determine the intersection of the search time range entered by the user with each subtree under the target node, and based on the intersection of the search time range with each subtree under the target node, determine a target subtree from each subtree under the target node to search for boundary time values ​​corresponding to the search time range.

[0025] In step 206, the leaf node scanning process is started from the edge leaf nodes of the target subtree. After finding the target leaf node through scanning, the scanning is stopped, and log data corresponding to the time value within the target time range recorded on the target leaf node is stored on disk.

[0026] Here, a leaf node is a node in the log search time tree that does not have an out-degree. node To understand, a leaf node is a node that has no successor nodes or is the terminal node of a branch in the log search time tree. An edge leaf node is a leaf node located at an edge among the leaf nodes of the target subtree. To understand, an edge leaf node may include a left edge leaf node and a right edge leaf node. The left edge leaf node is the leftmost leaf node of the target subtree. The right edge leaf node is the rightmost leaf node of the target subtree. A target leaf node is a leaf node in which log data corresponding to time values ​​within a recorded time range resides on disk. The target time range is the time range recorded on the target leaf node.

[0027] Specifically, the computer may sequentially scan leaf nodes from the edge leaf node of the target subtree to the adjacent leaf node, and stop scanning after finding the target leaf node. To make it easier to understand, the computer may sequentially scan leaf nodes from the edge leaf node of the target subtree to the adjacent leaf node. Once log data corresponding to a time value within the time range recorded on the currently scanned leaf node exists on disk, the computer may stop scanning leaf nodes, designating this currently scanned leaf node as the target leaf node, and thus not scan leaf nodes beyond the target leaf node.

[0028] In one embodiment, a computer device The computer may determine the attribute information of the boundary time value that needs to be searched. Furthermore, the computer may decide, based on the attribute information of the boundary time value that needs to be searched, whether to start the leaf node scanning process from the left edge leaf node of the target subtree or from the right edge leaf node of the target subtree. Here, the attribute information of the boundary time value indicates whether the boundary time value that needs to be searched is a lower boundary time value corresponding to the search time range or an upper boundary time value corresponding to the search time range. The lower boundary time value is the smallest of the two boundary time values ​​corresponding to the search time range, and the upper boundary time value is the largest of the two boundary time values ​​corresponding to the search time range.

[0029] To make it clear, in the example above, the time value of 10:10 is the lower boundary time value corresponding to the search time range, and the time value of 10:50 is the upper boundary time value corresponding to the search time range.

[0030] In one embodiment, the log search time tree may specifically be a multi-search tree for recording the time range used for log searches, such as a binary search tree or a ternary search tree. This embodiment is not limited to this.

[0031] In one embodiment, the log search time tree is a binary search tree for recording the time range used for log searches. As shown in Figure 3, the log search time tree contains seven nodes (i.e., nodes 1 to 7). If the time range recorded in the log search time tree is [min, max], then, as can be understood, node 1 is the root node of the log search time tree, and the time range recorded in node 1 is also [min, max]. Here, min represents the minimum value of the time range recorded in the log search time tree, and max represents the maximum value of the time range recorded in the log search time tree. Intermediate value 1 is the time value at the midpoint within the time range [min, max]. As can be understood, based on intermediate value 1, the time range of node 1 can be divided into two parts to form node 2 and node 3, respectively. The time range recorded in node 2 is [min, intermediate value 1], and the time range recorded in node 3 is [intermediate value 1, max]. Similarly, median value 2 is the time value at the midpoint within the time range [min, median value 1], and median value 3 is the time value at the midpoint within the time range [median value 1, max]. Based on median value 2, the time range of node 2 can be divided into two parts to form node 4 and node 5, respectively. Based on median value 3, the time range of node 3 can be divided into two parts to form node 6 and node 7, respectively. As can be seen, nodes 4 through 7 have no successor nodes. Nodes 4 through 7 are leaf nodes in the log search time tree.

[0032] In step 208, the boundary time values ​​corresponding to the search time range are obtained by determining the critical time values ​​corresponding to the log data recorded on the target leaf node.

[0033] Specifically, the computer equipment may obtain boundary time values ​​corresponding to the search time range by determining the critical time value corresponding to the log data recorded on the target leaf node. To understand this, there may be multiple time values ​​corresponding to each log data within the search time range entered by the user. The computer equipment may determine the critical time value from among these multiple time values ​​corresponding to the log data and use the determined time value as the boundary time value corresponding to the search time range.

[0034] In one embodiment, the target time range has two endpoint time values, which are the start and end values ​​of the target time range. The computer equipment may search for critical time values ​​corresponding to the log data within the target time range by scanning each time value within the target time range from one endpoint time value toward the other endpoint time value, thereby obtaining boundary time values ​​corresponding to the search time range. In this way, by sequentially scanning each time value within the target time range from one endpoint time value toward the other endpoint time value, it is possible to avoid missing time values ​​and improve the accuracy of log data retrieval.

[0035] In step 210, log data matching the search time range is retrieved from disk based on boundary time values.

[0036] In one embodiment, each boundary time value corresponding to the search time range corresponds to a log data identifier in the log data stored on disk. The computer equipment may retrieve log data from disk that matches the search time range based on the log data identifier corresponding to each boundary time value.

[0037] In the log data search method described above, a target node matching the search time range is determined from the log search time tree. Each node in the log search time tree is for recording the time range used for log searching, and there is a common set between the time range recorded in the target node and the search time range. The log search time tree records the time range used for log searching, and the amount of data is small. Therefore, the storage space used for the log search time tree is smaller than the storage space used for storing log data, and it does not require as many sectors as storing log data. A target subtree for searching boundary time values ​​corresponding to the search time range is determined from the subtrees under the target node, and leaf node scanning is started from the edge leaf node of the target subtree. After finding the target leaf node through scanning, the scanning is stopped, and log data corresponding to the time value within the target time range recorded in the target leaf node exists on disk. By determining the critical time value corresponding to the log data recorded in the target leaf node, the boundary time value corresponding to the search time range is obtained, and log data matching the search time range is retrieved from disk based on the boundary time value. The memory space used for log search time trees does not need to use as many sectors as it does to store log data, thereby reducing read and write operations to sectors, saving log data search time, and improving log data search efficiency.

[0038] Furthermore, in this invention, the leaf node scanning process is started from the edge leaf nodes of the target subtree, and the scanning is stopped after the target leaf node is found through the scanning. This allows for accurate searching of boundary time values ​​corresponding to the search time range without scanning all leaf nodes, saving time in searching for boundary time values ​​and further improving the search efficiency of log data.

[0039] Conventional log search methods can be implemented using a binary search method. When log data is stored in internal memory, the log data is not stored sector by sector in internal memory, so the binary search method is efficient for searching logs in internal memory. However, log data is enormous in volume, and storing it in internal memory is costly and increases the risk of data loss. Therefore, log data is usually stored on disk, and because of the large volume of log data, it is stored in multiple sectors on the disk. Searching for log data within a certain time range from the disk using a binary search method directly results in distributed access and low log data search efficiency.

[0040] To help you understand, let's explain with an example. As shown in Figure 4, each gray rectangular block 401 represents a time value. To help you understand, each time value is ordered from left to right. 402 is a sector on the disk. When searching for log data within a certain time range from the disk using a binary search method directly, it is necessary to perform read and write operations on multiple sectors during the binary search process, and since each sector access takes time, the efficiency of searching for log data is low. In this application, a log search time tree with a small amount of data is introduced to record the time range to be used for log searching. Therefore, the storage space used for the log search time tree is smaller than the storage space used to store log data, and it is not necessary to use as many sectors as it does to store log data. This reduces read and write operations on sectors, saves log data search time, and improves the efficiency of searching for log data.

[0041] In one embodiment, there are at least two subtrees under the target node, and the step of determining the target subtree from the subtrees under the target node includes the step of setting the subtree with the common set between the search time range and the time range recorded in one of the at least two subtrees under the target node as the target subtree.

[0042] Specifically, there are at least two subtrees under the target node, and the computer equipment may determine the intersection between the search time range and the time ranges recorded in each subtree under the target node. If there is a common set between the search time range and the time range recorded in one of the at least two subtrees under the target node, the subtree with the common set is designated as the target subtree for searching for boundary time values ​​corresponding to the search time range.

[0043] In one embodiment, the log search time tree is a binary search tree for recording the time range used for log searching, and the subtrees under the target node include a left subtree and a right subtree. As shown in Figure 5, part (a) of Figure 5 shows the search time range entered by the user, which is [search-min, search-max]. In part (b) of Figure 5, the gray rectangular frame represents the target node, and the time range recorded in the target node is [node-min, node-max], with the intermediate value being the time value at the midpoint within the time range [node-min, node-max]. Based on the intermediate value, the target node can be divided into a left subtree and a right subtree, where the time range recorded in the left subtree is [node-min, intermediate value], and the time range recorded in the right subtree is [intermediate value, node-max]. If there is a common set between the search time range and the time range recorded in the left subtree under the target node (i.e., Case 1 in part (b) of Figure 5), the computer device may use the left subtree containing the common set as the target subtree for searching for boundary time values ​​corresponding to the search time range. If there is a common set between the search time range and the time range recorded in the right subtree under the target node (i.e., Case 2 in part (b) of Figure 5), the computer device may use the right subtree containing the common set as the target subtree for searching for boundary time values ​​corresponding to the search time range.

[0044] In the above embodiment, if there is a common set between the search time range and the time range recorded in at least one of the two subtrees under the target node, the boundary time value that needs to be searched can only exist in the subtree where the common set exists. Therefore, the subtree where the common set exists can be directly used as the target subtree for searching for the boundary time value. This improves the search efficiency of the boundary time value.

[0045] In one embodiment, the log search time tree includes a log search time binary tree, the subtrees under the target node include the left and right subtrees of the log search time binary tree, the boundary time value includes the lower boundary time value, the step of determining the target subtree from the subtrees under the target node includes the step of setting the left subtree as the target subtree if there is a common set between the search time range and the time range recorded in either the left or right subtree, and if it is necessary to search for the lower boundary time value, the step of starting the leaf node scanning process from the edge leaf node of the target subtree and stopping the scanning after finding the target leaf node by scanning includes the step of starting the leaf node scanning process from the left edge leaf node of the left subtree and stopping the scanning after finding the target leaf node by scanning.

[0046] Specifically, the log search time binary tree is a binary search tree for recording the time range to be used for log searching. The subtrees under the target node include the left subtree and the right subtree, and the boundary time values ​​corresponding to the search time range include the lower boundary time value and the upper boundary time value. The computer equipment may determine the intersection of the search time range and the time ranges recorded in each subtree under the target node. If there is a common set between the search time range and the time ranges recorded in either the left subtree or the right subtree (i.e., case 3 in part (b) of Figure 5), and it is necessary to search for the lower boundary time value, the computer equipment may use the left subtree (i.e., the subtree in Figure 5 whose recorded time range is [node-min, intermediate value]) as the target subtree, start a leaf node scanning process from the left edge leaf node of the left subtree, and stop the scanning after finding the target leaf node.

[0047] In the above embodiment, if there is a common set between the search time range and the time ranges recorded in either the left or right subtree, then the boundary time value that needs to be searched can exist in both the left and right subtrees. As the time values ​​recorded in each node within each hierarchy of the log search time tree increase sequentially from left to right, the probability that the lower boundary time value exists in the left subtree is greater than the probability that it exists in the right subtree. Therefore, if it is necessary to search for the lower boundary time value, the left subtree may be directly targeted as the target subtree, and the scan may be preferentially started from the left subtree to search for the lower boundary time value. In this way, the search efficiency of the lower boundary time value can be improved.

[0048] In one embodiment, the above The method further includes the step of scanning the left subtree and, if the target leaf node is not found, starting the leaf node scanning process from the left edge leaf node of the right subtree, and stopping the scanning after finding the target leaf node through the scanning.

[0049] Specifically, if the target leaf node is not found by scanning the left subtree (i.e., the subtree in Figure 5 where the recorded time range is [node-min, midpoint]), the computer equipment may start the leaf node scanning process from the left edge leaf node of the right subtree (i.e., the subtree in Figure 5 where the recorded time range is [midpoint, node-max]), and stop scanning after finding the target leaf node through the scan.

[0050] In the above embodiment, if the target leaf node is not found after scanning the left subtree, it indicates that the boundary time value that needs to be searched exists in the right subtree. Since the time values ​​recorded at each node within each hierarchy of the log search time tree increase sequentially from left to right, the efficiency of searching for boundary time values ​​can be improved by directly starting the leaf node scanning process from the left edge leaf node of the right subtree.

[0051] In one embodiment, the subtrees under the target node include the left subtree and the right subtree, the boundary time value includes the upper boundary time value, and the step of determining the target subtree from the subtrees under the target node includes the step of setting the right subtree as the target subtree if there is a common set between the search time range and the time range recorded in either the left subtree or the right subtree, and if it is necessary to search for the upper boundary time value, and the step of starting the leaf node scanning process from the edge leaf node of the target subtree and stopping the scanning after finding the target leaf node by scanning includes the step of starting the leaf node scanning process from the right edge leaf node of the right subtree and stopping the scanning after finding the target leaf node by scanning.

[0052] Specifically, the log search time tree is a binary search tree for recording the time range to be used for log searching. The subtrees under the target node include the left subtree and the right subtree, and the boundary time values ​​corresponding to the search time range include the lower boundary time value and the upper boundary time value. The computer equipment may determine the intersection of the search time range and the time ranges recorded in each subtree under the target node. If there is a common set between the search time range and the time ranges recorded in either the left subtree or the right subtree (i.e., case 3 in part (b) of Figure 5), and it is necessary to search for the upper boundary time value, the computer equipment may use the right subtree (i.e., the subtree in Figure 5 whose recorded time range is [intermediate value, node-max]) as the target subtree, start a leaf node scanning process from the right edge leaf node of the right subtree, and stop the scanning after finding the target leaf node.

[0053] In the above embodiment, if there is a common set between the search time range and the time ranges recorded in either the left or right subtree, then the boundary time value that needs to be searched can exist in both the left and right subtrees. As the time values ​​recorded in each node within each hierarchy of the log search time tree increase sequentially from left to right, the probability that the upper boundary time value exists in the right subtree is greater than the probability that it exists in the left subtree. Therefore, if it is necessary to search for the upper boundary time value, the scan may be preferentially started from the right subtree to search for the upper boundary time value, and the right subtree may be directly used as the target subtree. In this way, the search efficiency of the upper boundary time value can be improved.

[0054] In one embodiment, the above The method further includes the step of scanning the right subtree and, if the target leaf node is not found, starting the leaf node scanning process from the right edge leaf node of the left subtree, and stopping the scanning after finding the target leaf node through the scanning.

[0055] Specifically, if the target leaf node is not found by scanning the right subtree (i.e., the subtree in Figure 5 whose recorded time range is [intermediate value, node-max]), the computer equipment may start scanning leaf nodes from the right edge leaf node of the left subtree (i.e., the subtree in Figure 5 whose recorded time range is [node-min, intermediate value]), and stop scanning after finding the target leaf node through the scan.

[0056] In the above embodiment, if the target leaf node is not found after scanning the right subtree, it indicates that the boundary time value that needs to be searched exists in the left subtree. Since the time values ​​recorded at each node within each hierarchy of the log search time tree increase sequentially from left to right, the efficiency of searching for boundary time values ​​can be improved by directly starting the leaf node scanning process from the right edge leaf node of the left subtree.

[0057] In one embodiment, as shown in Figure 6, the step of searching for a critical time value corresponding to the log data within the target time range and obtaining a boundary time value corresponding to the search time range by scanning each time value within the target time range from one endpoint time value within the target time range recorded in the target leaf node toward the other endpoint time value within the target time range includes the following steps:

[0058] In step 602, the endpoint time value within the target time range is used as the start time value for this round, and the search time range is used as the target search range for this round. Starting from the start time value, a log time value search process is performed within the target search range, and the log time value is the time value corresponding to the log data.

[0059] Here, the endpoint time value is the time value corresponding to the endpoint within the target time range. The start time value of this round is the first time value to be searched in the log time value search process of this round. The target search range of this round is the time range of the log time value search process of this round. As you can see, the start time value and the target search range are constantly updated.

[0060] Specifically, the target time range includes two endpoint time values, and the computer equipment may use one of these two endpoint time values ​​as the start time value for this round, and the user-entered search time range as the target search range for this round. Furthermore, the computer equipment may perform a log time value search process within the target search range starting from the start time value.

[0061] In step 604, after finding the log time value through the search, the updated time range is obtained by updating the search time range based on the log time value.

[0062] Specifically, the computer equipment may obtain the updated time range by searching for log time values ​​within the target search range and then updating the search time range entered by the user based on the searched log time values.

[0063] In step 606, until the search termination condition is met, the log time value is used as the start time value for the next round of the search, the updated time range is used as the target search range for the next round, and the search for the log time value is performed again from the start time value back to the step where the log time value search process is performed within the target search range. The last log time value found during the search is taken as the critical time value corresponding to the log data recorded on the target leaf node, and the boundary time value corresponding to the search time range is obtained.

[0064] Here, the search termination condition is the condition that stops the iterative process of searching for log time values.

[0065] In one embodiment, the search termination condition includes at least one of the following: completion of scanning each time value within the target time range, or the number of log time value search operations reaching a predetermined number of searches. In this way, the conditions for repeatedly stopping the log time value search operation can be diversified, thereby improving the efficiency of the log time value search operation.

[0066] Specifically, the computer equipment may, until the search termination condition is met, use the log time value found during the search in the current round as the start time value for the next round's search, the updated time range of the current round as the target search range for the next round, treat the next round as the current round, and return to the step of performing log time value search processing within the target search range from the start time value, and perform the search in the next round. The computer equipment may also obtain the boundary time value corresponding to the search time range, using the last log time value found during the search as the critical time value corresponding to the log data recorded on the target leaf node.

[0067] In the above embodiment, the log time value search process is performed iteratively within the target search range, and each time a log time value is found, the search time range is updated based on the log time value, gradually narrowing the search range. This makes it possible to quickly find critical time values ​​corresponding to log data recorded in the target leaf node, improving the efficiency of searching for boundary time values ​​and further improving the efficiency of searching for log data.

[0068] In one embodiment, the endpoint time value is a time value corresponding to the offset amount of the log data storage file on the disk pointed to by the target leaf node, and the endpoint time value within the target time range is set as the start time value of this round, the search time range is set as the target search range of this round, and the log time value search process is performed from the start time value to the target search range, with the time value corresponding to the offset amount set as the start time value of this round, the search time range being set as the target search range of this round, and the log time value search process is performed from the start time value to the disk pointed to by the target leaf node logThe steps include starting to update the offset amount of the data storage file and performing log time value search processing within the target search range.

[0069] Here, the log data storage file is a file used to store log data.

[0070] Specifically, the endpoint time value is the time value corresponding to the offset amount of the log data storage file on the disk pointed to by the target leaf node, and the computer equipment uses the time value corresponding to the offset amount as the start time value of this round, and the search time range as the target search range of this round, from the start time value to the disk pointed to by the target leaf node log The log time value search process within the target search range may be implemented by starting to update the offset amount of the data storage file and reading log data from the corresponding location in the log data storage file on disk.

[0071] In one embodiment, referring to Figure 3, if node 7 is a target leaf node found by the search, and the time range recorded in node 7 is [intermediate value 3, max], then if the endpoint time value is "intermediate value 3", then "intermediate value 3" recorded in the log data storage file (i.e., the time value corresponding to 301 in Figure 3) is the time value corresponding to the offset amount of the log data storage file on the disk pointed to by node 7. The computer equipment then uses the time value corresponding to 301 in Figure 3 to determine the time on the disk pointed to by the target leaf node. logThe log time value search process within the target search range may be implemented by starting to update the offset amount of the data storage file and reading the log data from the corresponding location in the log data storage file on disk. To understand this, if a log data number corresponding to the time value found by the search exists in the log data storage file, it can be said that the log data corresponding to the time value found by the search exists in the log data storage file, and the time value found by the search is, in other words, the log time value found by the search. Here, the log data number is used to uniquely identify the log data. To understand this, the log data number is one representation of the log data identifier.

[0072] In the above embodiment, the time value corresponding to the offset amount is set as the start time value of this round, and from the start time value, the disk pointed to by the target leaf node log By continuously updating the offset amount of the data storage file, quickly reading the corresponding data from disk, and performing log time value search processing within the target search range, the search efficiency of boundary time values ​​can be improved, and the search efficiency of log data can be further enhanced.

[0073] In one embodiment, after finding a log time value through a search, the step of obtaining the updated time range by updating the search time range based on the log time value includes, when searching for a lower boundary time value corresponding to the search time range, the step of obtaining the updated time range by updating the upper limit of the search time range with the log time value.

[0074] Here, the upper limit of the search time range refers to the largest time value among all time values ​​within the search time range.

[0075] Specifically, the boundary time values ​​corresponding to the search time range include the upper boundary time value and the lower boundary time value. When searching for the lower boundary time value corresponding to the search time range, the computer equipment may obtain the updated time range by updating the upper limit of the search time range with the log time value.

[0076] Let's explain with an example. If the search time range is [min,max] and the log time value found within [min,max] is V1, the computer equipment may obtain the updated time range [min,V1] by updating the upper limit max of the search time range [min,max] with this log time value V1.

[0077] In the above embodiment, when searching for a lower boundary time value corresponding to the search time range, the lower boundary time value finally found is always the log time value closest to the lower limit of the search time range. Therefore, updating the upper limit of the search time range with the log time value to obtain the updated time range can improve the search efficiency of the lower boundary time value.

[0078] In one embodiment, after finding a log time value through a search, the step of obtaining the updated time range by updating the search time range based on the log time value includes, when searching for an upper boundary time value corresponding to the search time range, the step of obtaining the updated time range by updating the lower limit of the search time range with the log time value.

[0079] Here, the lower limit of the search time range refers to the smallest time value among all time values ​​within the search time range.

[0080] Specifically, the boundary time values ​​corresponding to the search time range include the upper boundary time value and the lower boundary time value. When searching for the upper boundary time value corresponding to the search time range, the computer equipment may obtain the updated time range by updating the lower limit of the search time range with the log time value.

[0081] Let's explain with an example. If the search time range is [min,max] and the log time value found by searching from [min,max] is V2, the computer equipment may obtain the updated time range [V2,max] by updating the lower limit min of the search time range [min,max] with this log time value V2.

[0082] In the above embodiment, the search time range corresponds to above When searching for boundary time values, the upper boundary time value ultimately found is always the log time value closest to the upper limit of the search time range. Therefore, updating the lower limit of the search time range with the log time value to obtain the updated time range can improve the efficiency of searching for upper boundary time values.

[0083] In one embodiment, the boundary time values ​​include a lower boundary time value and an upper boundary time value, and the step of obtaining log data from disk that matches the search time range based on the boundary time values ​​includes the step of obtaining log data corresponding to each log data number within the target number range as log data that matches the search time range from disk. Here, the target number range is a number range where the log data number corresponding to the lower boundary time value is the range start value and the log data number corresponding to the upper boundary time value is the range end value.

[0084] Specifically, the boundary time values ​​include lower boundary time values ​​and upper boundary time values. The computer equipment may obtain the log data number corresponding to the lower boundary time value and the log data number corresponding to the upper boundary time value. The computer equipment may construct a target number range using the log data number corresponding to the lower boundary time value as the range start value and the log data number corresponding to the upper boundary time value as the range end value. The computer equipment may obtain the log data corresponding to each log data number within the target number range from disk as log data that matches the search time range.

[0085] In the above embodiment, the target number range is a range of numbers where the log data number corresponding to the lower boundary time value is the range start value and the log data number corresponding to the upper boundary time value is the range end value. Therefore, each log data number included in the target number range corresponds to each log time value within the search time range. Furthermore, the log data corresponding to each log data number within the target number range can be retrieved from disk and directly matched to the search time range, further improving the efficiency of log data searches.

[0086] As shown in Figure 7, one embodiment provides a log data retrieval method. This method is applicable to computer equipment (which may be a terminal or a server), and may be executed independently by the terminal or server itself, or may be implemented through communication between the terminal and the server. In this embodiment, the case in which this method is applied to computer equipment will be described as an example. Specifically, this method includes the following steps.

[0087] In step 702, a target node matching the search time range is determined from the log search time tree. Each node in the log search time tree is used to record the time range to be used for log searching, and there is a common set between the time range recorded in the target node and the search time range.

[0088] In step 704, if there is a common set between the search time range and the time range recorded in one of the left or right subtrees under the target node, the subtree with the common set is designated as the target subtree for searching for boundary time values, and the boundary time values ​​include the lower boundary time value and the upper boundary time value.

[0089] In step 706, if there is a common set between the search time range and the time ranges recorded in either the left or right subtree, and it is necessary to search for the lower boundary time value, the left subtree is designated as the target subtree, and the leaf node scanning process is started from the left edge leaf node of the left subtree. After finding the target leaf node through the scanning, the scanning is stopped. If the target leaf node is not found by scanning the left subtree, the leaf node scanning process is started from the left edge leaf node of the right subtree, and after finding the target leaf node through the scanning, the scanning is stopped.

[0090] In step 708, if there is a common set between the search time range and the time ranges recorded in either the left or right subtree, and it is necessary to search for the upper boundary time value, the right subtree is designated as the target subtree, and the leaf node scanning process is started from the right edge leaf node of the right subtree. After finding the target leaf node through the scanning, the scanning is stopped. If the target leaf node is not found by scanning the right subtree, the leaf node scanning process is started from the right edge leaf node of the left subtree, and after finding the target leaf node through the scanning, the scanning is stopped.

[0091] In step 710, the leaf node scanning process is started from the edge leaf nodes of the target subtree. After finding the target leaf node through scanning, the scanning is stopped, and log data corresponding to the time value within the target time range recorded on the target leaf node is present on disk.

[0092] In step 712, the endpoint time value within the target time range is used as the start time value for this round, and the search time range is used as the target search range for this round. Starting from the start time value, a log time value search process is performed within the target search range, and the log time value is the time value corresponding to the log data.

[0093] In step 714, after finding the log time value through the search, the updated time range is obtained by updating the search time range based on the log time value.

[0094] In step 716, until the search termination condition is met, the log time value is used as the start time value for the next round of the search, the updated time range is used as the target search range for the next round, and the process returns to the step where the log time value search is performed within the target search range from the start time value. The search for the next round is then performed, and the last log time value found during the search is taken as the critical time value corresponding to the log data recorded on the target leaf node, and the boundary time value corresponding to the search time range is obtained.

[0095] In step 718, log data corresponding to each log data number within the target number range is retrieved from disk as log data that matches the search time range. The target number range is defined as a number range where the log data number corresponding to the lower boundary time value is the range start value and the log data number corresponding to the upper boundary time value is the range end value.

[0096] Further application scenarios are provided in this application scenarios. In these application scenarios, the log data retrieval method described above is applied. Specifically, this log data retrieval method is applicable to scenarios in which log data retrieval is performed based on a binary search tree. To make it clear, the log search time tree is a log search time binary tree. A computer device may determine a target node that matches the search time range from the log search time binary tree. Each node in the log search time binary tree is for recording the time range to be used for log retrieval, and there is a common set between the time range recorded in the target node and the search time range. If there is a common set between the search time range and the time range recorded in one of the left subtrees and right subtrees under the target node, the subtree with the common set is set as the target subtree for searching boundary time values. Boundary time values ​​include lower boundary time values ​​and upper boundary time values.

[0097] If there is a common set between the search time range and the time range recorded in either the left or right subtree, and it is necessary to search for the lower boundary time value, the computer equipment may start a leaf node scan process from the left edge leaf node of the left subtree, using the left subtree as the target subtree, and stop the scan after finding the target leaf node. If the target leaf node is not found after scanning the left subtree, the computer equipment may start a leaf node scan process from the left edge leaf node of the right subtree, and stop the scan after finding the target leaf node. If there is a common set between the search time range and the time range recorded in either the left or right subtree, and it is necessary to search for the upper boundary time value, the computer equipment may start a leaf node scan process from the right edge leaf node of the right subtree, using the right subtree as the target subtree, and stop the scan after finding the target leaf node. If the target leaf node is not found after scanning the right subtree, the computer equipment may start a leaf node scan process from the right edge leaf node of the left subtree, and stop the scan after finding the target leaf node.

[0098] The computer equipment may start the leaf node scanning process from the edge leaf node of the target subtree, and stop scanning after finding the target leaf node through the scan. Log data corresponding to the time values ​​within the target time range recorded in the target leaf node exists on disk. The endpoint time value within the target time range is used as the start time value of this round, and the search time range is used as the target search range for this round. The log time value search process is performed from the start time value within the target search range. The log time value is the time value corresponding to the log data. After finding the log time value through the search, the updated time range is obtained by updating the search time range based on the log time value. Until the search termination condition is met, the process returns to the step of performing the log time value search process within the target search range from the start time value, using the log time value as the start time value of the next round's search, and the updated time range as the target search range for the next round. The search for the next round is performed, and the last log time value found during the search is used as the critical time value corresponding to the log data recorded in the target leaf node. The boundary time value corresponding to the search time range is obtained.

[0099] The computer equipment may retrieve the log data corresponding to each log data number within the target number range from disk as log data that matches the search time range. Here, the target number range is a number range where the log data number corresponding to the lower boundary time value is the range start value and the log data number corresponding to the upper boundary time value is the range end value.

[0100] This application provides further application scenarios in which the above-described log data retrieval method is applied. Specifically, this log data retrieval method is applicable to scenarios in which log data retrieval is implemented based on a multi-search tree. As can be understood, the log retrieval time tree may be a multi-log retrieval time tree, such as a log retrieval time tertiary tree or a log retrieval time quaternary tree. As can be understood, each node in the multi-log retrieval time tree is for recording the time range to be used for log retrieval. Based on the multi-log retrieval time tree, high-speed retrieval of log data on disk can be achieved, and the efficiency of log data retrieval can be improved.

[0101] It should be understood that while the steps in the flowcharts of each embodiment above are shown sequentially in order, these steps are not necessarily performed sequentially in order. Unless explicitly stated herein, there are no strict restrictions on the order in which these steps are performed. These steps may be performed in other orders. Also, at least some of the steps in each embodiment above may include multiple substeps or multiple stages. These substeps or stages do not necessarily have to be completed at the same time, but may be performed at different times. The order in which these substeps or stages are performed also does not necessarily have to be sequential, but may be performed alternately or in rotation with other steps, or at least some of the substeps or stages of other steps.

[0102] In one embodiment, a log data retrieval device 800 is provided, as shown in Figure 8. This device can become part of a computer system through a software module, a hardware module, or a combination of both. Specifically, this device includes the following modules:

[0103] The decision module 802 determines a target node that matches the search time range from the log search time tree. Each node in the log search time tree is used to record the time range to be used for log searching, and there is a common set between the time range recorded in the target node and the search time range.

[0104] The decision module 802 further determines a target subtree from the subtrees under the target node, and the target subtree is used to search for boundary time values ​​corresponding to the search time range.

[0105] The scanning module 804 starts the leaf node scanning process from the edge leaf nodes of the target subtree. After finding the target leaf node through scanning, it stops scanning, and log data corresponding to the time value within the target time range recorded on the target leaf node is stored on disk.

[0106] The decision module 802 further obtains boundary time values ​​corresponding to the search time range by determining critical time values ​​corresponding to log data recorded on the target leaf node.

[0107] The acquisition module 806 retrieves log data from disk that matches the search time range based on boundary time values.

[0108] In one embodiment, if there are at least two subtrees under the target node, the decision module 802 further determines that if there is a common set between the search time range and the time range recorded in one of the at least two subtrees under the target node, the subtree with the common set is the target subtree.

[0109] In one embodiment, the subtree under the target node includes the left subtree and the right subtree, and the boundary time value includes the lower boundary time value. The decision module 802 further determines that if there is a common set between the search time range and the time range recorded in either the left subtree or the right subtree, and if it is necessary to search for the lower boundary time value, it sets the left subtree as the target subtree. The scanning module 804 further starts the leaf node scanning process from the left edge leaf node of the left subtree, and stops the scanning after finding the target leaf node through scanning.

[0110] In one embodiment, if the scanning module 804 does not find the target leaf node after scanning the left subtree, it starts scanning leaf nodes from the left edge leaf node of the right subtree, and stops scanning after finding the target leaf node through the scan.

[0111] In one embodiment, the subtree under the target node includes the left subtree and the right subtree, and the boundary time value includes the upper boundary time value. The decision module 802 further determines that if there is a common set between the search time range and the time range recorded in either the left subtree or the right subtree, and if it is necessary to search for the upper boundary time value, it sets the right subtree as the target subtree. The scanning module 804 further starts the leaf node scanning process from the right edge leaf node of the right subtree, and stops the scanning after finding the target leaf node through scanning.

[0112] In one embodiment, if the scanning module 804 does not find the target leaf node after scanning the right subtree, it starts the leaf node scanning process from the right edge leaf node of the left subtree, and stops scanning after finding the target leaf node through the scan.

[0113] In one embodiment, the target time range recorded in the target leaf node has two endpoint time values, and the decision module 802 further searches for critical time values ​​corresponding to the log data from the target time range by scanning each time value in the target time range from one endpoint time value in the target time range recorded in the target leaf node toward the other endpoint time value in the target time range, thereby obtaining boundary time values ​​corresponding to the search time range.

[0114] In one embodiment, the decision module 802 further uses the endpoint time value within the target time range recorded in the target leaf node as the start time value of the current round, sets the search time range as the target search range for the current round, performs a log time value search process within the target search range from the start time value, finds a log time value through the search, updates the search time range based on the log time value to obtain the updated time range, and returns to the step of performing a log time value search process within the target search range from the start time value until the search termination condition is met, sets the log time value as the start time value of the next round's search, sets the updated time range as the target search range for the next round, performs the search for the next round, obtains the boundary time value corresponding to the search time range, and uses the last log time value found through the search as the critical time value corresponding to the log data recorded in the target leaf node, the log time value is the time value corresponding to the log data.

[0115] In one embodiment, the endpoint time value is a time value corresponding to the offset amount of the log data storage file on the disk pointed to by the target leaf node, and the decision module 802 further uses the time value corresponding to the offset amount as the start time value of this round, and the search time range as the target search range of this round, and from the start time value on the disk pointed to by the target leaf node log The offset amount of the data storage file is updated, and the log time value search process is performed within the target search range.

[0116] In one embodiment, when the decision module 802 searches for a lower boundary time value corresponding to the search time range, it updates the upper limit of the search time range with the log time value to obtain the updated time range.

[0117] In one embodiment, when the decision module 802 searches for an upper boundary time value corresponding to the search time range, it updates the lower limit of the search time range with the log time value to obtain the updated time range.

[0118] In one embodiment, the search termination condition includes at least one of the following: completion of scanning each time value within the target time range, or the number of log time value search operations reaching a predetermined number of searches.

[0119] In one embodiment, the boundary time values ​​include a lower boundary time value and an upper boundary time value, and the acquisition module 806 further acquires log data corresponding to each log data number within the target number range from disk as log data that matches the search time range. Here, the target number range is a number range where the log data number corresponding to the lower boundary time value is the range start value and the log data number corresponding to the upper boundary time value is the range end value.

[0120] The log data retrieval device described above determines a target node that matches the search time range from the log search time tree. Each node in the log search time tree is for recording the time range to be used for log retrieval, and there is a common set between the time range recorded in the target node and the search time range. The log search time tree records the time range to be used for log retrieval, and the amount of data is small. Therefore, the storage space used for the log search time tree is smaller than the storage space used for storing log data, and it does not require as many sectors as storing log data. From the subtrees under the target node, a target subtree for searching boundary time values ​​is determined, and leaf node scanning is started from the edge leaf node of the target subtree. After finding the target leaf node through scanning, the scanning is stopped, and log data corresponding to the time value within the target time range recorded in the target leaf node exists on disk. By determining the critical time value corresponding to the log data recorded in the target leaf node, the boundary time value corresponding to the search time range is obtained, and log data that matches the search time range is retrieved from disk based on the boundary time value. The memory space used for log search time trees does not need to use as many sectors as it does to store log data, thereby reducing read and write operations to sectors, saving log data search time, and improving log data search efficiency.

[0121] Each module of the log data retrieval device described above may be implemented in whole or in part by software, hardware, or a combination thereof. Each module may be embedded in the processor of the computer device in hardware form, independently, or stored in the memory of the computer device in software form. This facilitates the processor to call and execute the operations corresponding to each module.

[0122] In one embodiment, a computer device is provided. This computer device may be a server, and its internal configuration may be as shown in Figure 9. The computer device includes one or more processors, memory, input / output interfaces (I / O), and communication interfaces. Here, the processors, memory, and I / O interfaces are connected via a system bus, and the communication interfaces are connected to the system bus via the I / O interfaces. Here, the processor of the computer device provides computation and control functions. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer-readable instructions, and a database. The internal memory provides an environment for the execution of the operating system and computer-readable instructions in the non-volatile storage medium. The I / O interfaces of the computer device are for exchanging information between the processor and external devices. The network interfaces of the computer device are for communicating with external terminals via a network connection. When the computer-readable instructions are executed by the processor, they enable a log data retrieval method.

[0123] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal configuration diagram may be as shown in Figure 10. The computer device includes one or more processors, memory, input / output interfaces, communication interfaces, a display unit, and input devices. Here, the processors, memory, and input / output interfaces are connected via a system bus, and the communication interfaces, display units, and input devices are connected to the system bus via the input / output interfaces. Here, the processor of the computer device provides computation and control functions. The memory of the computer device includes a non-volatile storage medium, internal memory. The non-volatile storage medium stores an operating system and computer-readable instructions. The internal memory provides an environment for the execution of the operating system and computer-readable instructions in the non-volatile storage medium. The input / output interfaces of the computer device are for exchanging information between the processor and external devices. The communication interfaces of the computer device are for wired or wireless communication with external terminals, and the wireless method may be implemented by Wi-Fi, mobile cellular networks, near-field communication (NFC), or other technologies. The computer-readable instruction, when executed by the processor, enables a log data retrieval method. The display unit of the computer device is for forming a visually visible screen and may be a display screen, a projection device, or a virtual reality imaging device. The display screen may be a liquid crystal display screen or an E-ink display screen. The input device of the computer device may be a touch layer superimposed on the display screen, a button, trackball, or touchpad provided on the housing of the computer device, or an external keyboard, touchpad, or mouse.

[0124] As those skilled in the art will understand, the configurations shown in Figures 9 and 10 are merely block diagrams of some of the configurations relating to the present invention and do not limit the computer equipment to which the present invention applies. Specific computer equipment may include more or fewer components than those shown, or may be a combination of some components, or may have different arrangements of components.

[0125] In one embodiment, a computer device is further provided comprising memory and one or more processors. The memory stores computer-readable instructions, and when the processor executes a computer-readable instruction, it accomplishes the steps in each of the above-described embodiment of the method.

[0126] In one embodiment, one or more computer-readable storage media storing computer-readable instructions are provided. When these computer-readable instructions are executed by one or more processors, they realize the steps in each of the above-described embodiment of the method.

[0127] In one embodiment, a computer program product is provided that includes computer-readable instructions. When executed by one or more processors, the computer-readable instructions realize the steps in each of the above-described embodiment of the method.

[0128] Furthermore, user information (including, but not limited to, user equipment information and user personal information) and data (including, but not limited to, analytical data, storage data, and display data) relating to this application are all information and data authorized by the user or fully authorized by each party, and the collection, use, and processing of the relevant data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0129] As those skilled in the art will understand, all or part of the method flow according to the above embodiments may be implemented by instructing the relevant hardware via computer-readable instructions. The computer-readable instructions may be stored in a non-volatile computer-readable storage medium. When the computer-readable instructions are executed, the flow of each embodiment of the method described above is executed. Here, any reference to memory, storage, database, or other medium used in each embodiment provided herein may include at least one of non-volatile memory and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical memory. Volatile memory may include random access memory (RAM) or an external cache. For illustrative purposes only, rather than limiting, RAM may take many forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0130] The constituent elements of the embodiments described above may be combined in any way. For the sake of brevity, not all possible combinations of the constituent elements of the embodiments described above are described. However, these combinations of constituent elements should be considered to fall within the scope described herein, as long as they do not contradict each other.

[0131] The embodiments described above are merely examples of some embodiments of the present application, and although the descriptions are specific and detailed, they should not be understood as limiting the scope of the patent. It should be noted that a person skilled in the art can make some modifications and improvements without departing from the concept of the present application. All of these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of patent protection of the present application should be in accordance with the attached claims. [Explanation of Symbols]

[0132] 102 terminals 104 Servers 401 Gray rectangular block 800 Log Data Search Device 802 Decision Module 804 Scanning Module 806 Acquisition Module

Claims

1. A method for searching log data performed by computer equipment, A step of determining a target node that matches the search time range from a log search time tree, wherein each node in the log search time tree is for recording the time range to be used for log search, and there is a common set between the time range recorded in the target node and the search time range. A step of determining a target subtree from the subtrees under the target node, wherein the target subtree is for searching for boundary time values ​​corresponding to the search time range. The steps include: starting a leaf node scanning process from the edge leaf node of the target subtree, stopping the scanning after finding the target leaf node, wherein log data corresponding to the time value within the target time range recorded on the target leaf node exists on disk; A step of obtaining boundary time values ​​corresponding to the search time range by determining critical time values ​​corresponding to log data recorded in the target leaf node, wherein the critical time values ​​are the first log time value and the last log time value corresponding to the log data within the search time range. The steps include: obtaining log data from disk that matches the search time range based on the boundary time value; A log data search method characterized by the following:

2. The subtrees under the aforementioned target node consist of at least two, The step of determining the target subtree from the subtrees under the target node is as follows: If there is a common set between the search time range and the time range recorded in one of the at least two subtrees under the target node, the step includes setting the subtree containing the common set as the target subtree. The log data search method according to feature 1.

3. The log search time tree includes a log search time binary tree, the subtrees under the target node include the left and right subtrees of the log search time binary tree, and the boundary time value includes the lower boundary time value. The step of determining the target subtree from the subtrees under the target node is as follows: If there is a common set between the search time range and the time ranges recorded in either the left subtree or the right subtree, and if it is necessary to search for the lower boundary time value, the step includes setting the left subtree as the target subtree. The step of starting a leaf node scanning process from the edge leaf node of the target subtree, and stopping the scanning after finding the target leaf node through scanning, The process includes starting a leaf node scanning process from the left edge leaf node of the left subtree, and stopping the scanning after finding the target leaf node through the scanning. The log data search method according to feature 1.

4. If the target leaf node is not found after scanning the left subtree, the process further includes starting a leaf node scan from the left edge leaf node of the right subtree, and stopping the scan after finding the target leaf node through the scan. The log data search method according to feature 3.

5. The subtree under the target node includes the left subtree and the right subtree, and the boundary time value includes the upper boundary time value. The step of determining the target subtree from the subtrees under the target node is as follows: If there is a common set between the search time range and the time ranges recorded in either the left subtree or the right subtree, and if it is necessary to search for the upper boundary time value, the step includes setting the right subtree as the target subtree. The step of starting a leaf node scanning process from the edge leaf node of the target subtree, and stopping the scanning after finding the target leaf node through scanning, The process includes starting a leaf node scanning process from the right edge leaf node of the aforementioned right subtree, and stopping the scanning after finding the target leaf node through the scanning. The log data search method according to feature 1.

6. If the target leaf node is not found after scanning the right subtree, the process further includes starting a leaf node scan from the right edge leaf node of the left subtree, and stopping the scan after finding the target leaf node through the scan. The log data search method according to feature 5.

7. The target time range recorded in the target leaf node has two endpoint time values, and the step of obtaining boundary time values ​​corresponding to the search time range by determining the critical time value corresponding to the log data recorded in the target leaf node is as follows: The step of searching for critical time values ​​corresponding to log data within the target time range and obtaining boundary time values ​​corresponding to the search time range is obtained by scanning each time value within the target time range from one of the endpoint time values ​​within the target time range recorded in the target leaf node toward the other endpoint time value within the target time range, thereby searching for critical time values ​​corresponding to log data within the target time range. The log data search method according to feature 1.

8. The step of searching for a critical time value corresponding to the log data within the target time range and obtaining a boundary time value corresponding to the search time range by scanning each time value within the target time range from one of the endpoint time values ​​within the target time range recorded in the target leaf node toward the other endpoint time value within the target time range, is as follows: A step of performing a log time value search process within the target search range, using the endpoint time value within the target time range recorded in the target leaf node as the start time value of this round, and the search time range as the target search range of this round, wherein the log time value is a time value corresponding to log data. The steps include: finding the log time value through a search, and then updating the search time range based on the log time value to obtain the updated time range; The process includes the steps of: performing the search for the next round, using the log time value as the start time value for the next round of the search, using the updated time range as the target search range for the next round, and returning to the step of performing the log time value search process within the target search range from the start time value until the search termination condition is met; obtaining the boundary time value corresponding to the search time range as the critical time value corresponding to the log data recorded in the target leaf node, until the last log time value found during the search is met; and obtaining the boundary time value corresponding to the search time range. The log data search method according to feature 7.

9. The endpoint time value is a time value corresponding to the offset amount of the log data storage file on the disk pointed to by the target leaf node. The step of using the endpoint time value within the target time range as the start time value of this round, and the search time range as the target search range of this round, and performing a log time value search process within the target search range from the start time value, is as follows: The process includes the steps of setting the time value corresponding to the offset amount as the start time value of this round, setting the search time range as the target search range of this round, starting to update the offset amount of the log data storage file on the disk pointed to by the target leaf node from the start time value, and performing log time value search processing within the target search range. The log data search method according to feature 8.

10. The step of obtaining the updated time range by finding the log time value through a search and then updating the search time range based on the log time value is as follows: When searching for a lower boundary time value corresponding to the search time range, the process includes the step of obtaining the updated time range by updating the upper limit of the search time range with the log time value. The log data search method according to feature 8.

11. The step of obtaining the updated time range by finding the log time value through a search and then updating the search time range based on the log time value is as follows: When searching for an upper boundary time value corresponding to the aforementioned search time range, the process includes the step of obtaining the updated time range by updating the lower limit of the search time range with the log time value. The log data search method according to feature 8.

12. The search termination condition includes at least one of the following: completion of scanning each time value within the target time range, or the number of log time value search operations reaching a predetermined number of searches. The log data search method according to feature 8.

13. The boundary time values ​​include lower boundary time values ​​and upper boundary time values, and the step of obtaining log data from disk that matches the search time range based on the boundary time values ​​is: The step includes obtaining log data corresponding to each log data number within the target number range from disk as log data that matches the search time range, The aforementioned target number range is a number range where the log data number corresponding to the lower boundary time value is the range start value and the log data number corresponding to the upper boundary time value is the range end value. The log data search method according to feature 1.

14. A log data retrieval device comprising a determination module, a scanning module, and an acquisition module, The decision module determines a target node that matches the search time range from the log search time tree, and each node in the log search time tree is for recording the time range to be used for log searching, and there is a common set between the time range recorded in the target node and the search time range. The decision module further determines a target subtree from the subtrees under the target node, and the target subtree is for searching for boundary time values ​​corresponding to the search time range. The scanning module starts the leaf node scanning process from the edge leaf node of the target subtree, and after finding the target leaf node through scanning, stops scanning and confirms that log data corresponding to the time value within the target time range recorded in the target leaf node exists on disk. The decision module further obtains boundary time values ​​corresponding to the search time range by determining critical time values ​​corresponding to log data recorded on the target leaf node, and the critical time values ​​are the first and last log time values ​​corresponding to the log data within the search time range. The acquisition module acquires log data from disk that matches the search time range based on the boundary time value. A log data retrieval device characterized by the following features.

15. A computer device comprising memory and one or more processors, wherein the memory stores computer-readable instructions, and the processor, upon executing the computer-readable instructions, implements the log data retrieval method described in any one of claims 1 to 13.

16. A computer program characterized by causing a computer to perform the method described in any one of claims 1 to 13.

Images