Log processing method, and electronic device, storage medium and computer program product

Abstract

The embodiments of the present disclosure relate to the technical field of computers. Provided are a log processing method, and an electronic device, a storage medium and a computer program product. The method comprises: receiving a log processing request that is input by a user; on the basis of first log description information, acquiring from a preset knowledge graph a first knowledge graph node, which has corresponding node description information that matches the first log description information; acquiring at least one relational node on a target path between the first knowledge graph node and a root node of the knowledge graph; and on the basis of node information corresponding to the at least one relational node, acquiring a target log from a log library. By using the technical solution described above, at least one relational node on a target path can be determined by means of log description information of a knowledge graph node in a preset knowledge graph, and on the basis of node information respectively corresponding to relational nodes in multiple levels, matching is performed in a log library to obtain a corresponding target log.

Description

Log processing methods, electronic devices, storage media, and computer program products

[0001] Cross-references

[0002] This application claims priority to Chinese Patent Application No. 202411024149.3, filed on July 29, 2024, entitled "Method for Log Processing, Electronic Device, Storage Medium and Computer Program Product", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure relates to the field of computer technology, and in particular to a log processing method, electronic device, storage medium, and computer program product. Background Technology

[0004] Log analysis is a common technique in fault handling. Taking Android system set-top boxes and mobile phones as an example, when a fault occurs (such as a program crashing), the relevant technologies usually rely on manual analysis of the Android system logs. Identifying the corresponding target log from a massive log library is a huge challenge in the relevant technologies. On the one hand, it is time-consuming and wastes manpower. On the other hand, it requires high skills from the analysts, resulting in long fault handling times. Summary of the Invention

[0005] The purpose of this disclosure is to provide a log processing method, electronic device, storage medium, and computer program product.

[0006] According to a first aspect of the present disclosure, a log processing method is provided, the method comprising: receiving a log processing request input by a user, the log processing request including first log description information; obtaining a first knowledge graph node whose corresponding node description information matches the first log description information from a preset knowledge graph based on the first log description information; obtaining at least one relation node on a target path between the first knowledge graph node and the root node of the knowledge graph; and obtaining a target log from a log database based on node information corresponding to the at least one relation node.

[0007] According to a second aspect of the present disclosure, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to perform the steps of the log processing method described in the first aspect.

[0008] According to a third aspect of the present disclosure, a computer-readable storage medium is provided that stores one or more programs, which, when executed by an electronic device including a plurality of applications, cause the electronic device to perform the steps of the log processing method described in the first aspect.

[0009] According to a fourth aspect of the present disclosure, a computer program product is provided, the computer program product including a computer program that, when executed by a processor, implements the steps of the log processing method described in the first aspect. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 shows a schematic flowchart of a log processing method provided in an embodiment of the present disclosure;

[0012] Figure 2 shows a schematic diagram of a knowledge graph provided in an embodiment of this disclosure;

[0013] Figure 3 shows a schematic diagram of relationship nodes in a knowledge graph provided in an embodiment of this disclosure;

[0014] Figure 4 shows another schematic flowchart of the log processing method provided in this embodiment of the present disclosure;

[0015] Figure 5 illustrates a schematic diagram of determining the matching degree based on relation nodes in a knowledge graph according to an embodiment of this disclosure;

[0016] Figure 6 shows another schematic flowchart of the log processing method provided in the embodiments of this disclosure;

[0017] Figure 7 illustrates a schematic diagram of multiple paths in a knowledge graph provided in an embodiment of this disclosure;

[0018] Figure 8 shows another schematic flowchart of the log processing method provided in an embodiment of this disclosure;

[0019] Figure 9 shows another schematic flowchart of the log processing method provided in this embodiment of the present disclosure;

[0020] Figure 10 shows a schematic diagram of a relation node deletion provided in an embodiment of this disclosure;

[0021] Figure 11 illustrates another schematic diagram of relation node deletion provided in an embodiment of this disclosure;

[0022] Figure 12 illustrates a schematic diagram of the addition of relation nodes provided in an embodiment of this disclosure;

[0023] Figure 13 shows another schematic flowchart of the log processing method provided in an embodiment of this disclosure;

[0024] Figure 14 illustrates a flowchart of a knowledge graph update provided in an embodiment of this disclosure.

[0025] Figure 15 illustrates a schematic diagram of knowledge graph updating provided in an embodiment of this disclosure;

[0026] Figure 16 is a schematic diagram of the hardware structure of an electronic device that performs the log processing method provided in the embodiments of this disclosure. Detailed Implementation

[0027] To enable those skilled in the art to better understand the technical solutions in this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this disclosure.

[0028] First, the terminology used in this application will be explained.

[0029] A log repository is a storage medium for logs and can take various forms. For example, it can be a database-style repository, where multiple tables are created in chronological order of log generation. Each table can store multiple log entries in chronological order, and different fields in each row of a table can represent the log's keywords and their corresponding positions. Alternatively, a log repository can also consist of log files created in chronological order, with each file storing multiple log entries in chronological order. Each line in a log file can represent the log's keywords and their corresponding positions.

[0030] Large Model: Large model is short for Large Language Model (LLM). A large language model is an artificial intelligence model trained to understand and generate human language, and to complete corresponding processing tasks based on the input of the large model.

[0031] Figure 1 shows a schematic flowchart of a log processing method provided in an embodiment of the present disclosure. As shown in Figure 1, the method may include the following steps:

[0032] In step S101, a log processing request input by the user is received.

[0033] The log processing request includes a first log description. This first log description can be a summary of the fault displayed to the user when a failure occurs. For example, in the Android system, if an application is not responding quickly enough, the system will display an ANR (Application Not Response) dialog box to the user. The first log description could be "The process encountered an ANR."

[0034] In step S102, based on the first log description information, the first knowledge graph node whose corresponding node description information matches the first log description information is obtained from the preset knowledge graph.

[0035] The pre-defined knowledge graph is a data structure that integrates expert knowledge on fault handling to determine the target path for fault resolution. In some possible implementations, this step S102 can be implemented using a large model, that is, by using a pre-trained large model to match the first log description information with the node description information of the knowledge graph nodes.

[0036] Figure 2 illustrates a schematic diagram of a knowledge graph provided in an embodiment of this disclosure. As shown in Figure 2, the knowledge graph may include a root node and at least one knowledge graph node. The root node and knowledge graph nodes form directed connections directly or through at least one knowledge graph node, forming at least one path from the root node to each knowledge graph node. For example, the path for the knowledge graph node "APK was killed" is "Knowledge graph root node => Process ANR => APK was killed".

[0037] Each knowledge graph node corresponds to at least one relation node. In some embodiments, the relation node is a branch node or a leaf node in the relation node tree. The branch node may include the next-level branch node and / or a leaf node, and the leaf node is a keyword and / or a second knowledge graph node.

[0038] Figure 3 illustrates a schematic diagram of relation nodes in a knowledge graph provided in an embodiment of this disclosure. The structure of relation branch node A in Figure 2 is shown in Figure 3(a). Relationship branch node A is a branch node in the relation node tree, including leaf nodes composed of 5 keywords. The structure of relation branch node B in Figure 2 is shown in Figure 3(b). Relationship branch node B is another branch node in the relation node tree, including leaf nodes composed of 2 keywords. It is understood that a branch node can include only leaf nodes, only next-level branch nodes, or both. The leaf nodes of the relation node tree can include only keywords. For example, in Figure 2, the knowledge graph node "Process ANR" corresponds to 5 relation nodes, all of which are keywords (i.e., 5 independent leaf nodes). Leaf nodes can also include second knowledge graph nodes, that is, knowledge graph nodes other than those corresponding to relation nodes. When a leaf node is a keyword, log matching can be performed using the keyword. When a leaf node is a second knowledge graph node, log matching can be performed based on the relation node corresponding to that second knowledge graph node. The log matching result of the relation node corresponding to that second knowledge graph node is the log matching result of that leaf node. It can be understood that multiple leaf nodes under the same branch node can also be combinations of second knowledge graph nodes and keywords. As shown in Figure 3(c), branch node C is the next-level branch node of branch node A, and keywords "KEYC" and "KEYD" are all child nodes of branch node A. The child nodes of branch node C include two leaf nodes, namely the second knowledge graph node and the keyword "KEYE".

[0039] In some embodiments, each knowledge graph node has corresponding node description information, which is used to obtain the corresponding first knowledge graph node through the first log description information. The node description information of the knowledge graph node is a natural language description, such as "APK was killed".

[0040] In some possible implementations, the semantic vector of the first log description information can be obtained, and the semantic vector of the node description information corresponding to each knowledge graph node in the knowledge graph can be obtained respectively. Based on the similarity of the semantic vectors (e.g., cosine similarity), the first knowledge graph node that matches the node description information with the first log description information can be determined.

[0041] For example, when the first log description is "APK was stopped", the first knowledge graph node can be determined to be the knowledge graph node with the node description "APK was killed" based on the similarity of semantic vectors.

[0042] In step S103, at least one relation node on the target path between the first knowledge graph node and the root node of the knowledge graph is obtained.

[0043] For example, as shown in Figure 2, after determining the first knowledge graph node as "APK killed", the target path can be determined based on the knowledge graph as "knowledge graph root node => process ANR => APK killed". This target path includes two sub-paths: "knowledge graph root node => process ANR" and "process ANR => APK killed", which correspond to 5 relation nodes and 2 relation nodes respectively. All of the above relation nodes are leaf nodes (keywords).

[0044] For example, after determining that the first knowledge graph node is "voice settings problem", the target path can be determined based on the knowledge graph as "knowledge graph root node => voice settings problem", which includes two relation nodes, "branch node A" and "branch node B". The above relation nodes are all branch nodes, each including 5 leaf nodes (keywords) and 2 leaf nodes (keywords).

[0045] In step S104, the target log is obtained from the log database based on the node information corresponding to at least one relation node.

[0046] After obtaining at least one relation node on the target path between the first knowledge graph node and the root node of the knowledge graph, the target log can be obtained from the log database based on the node information corresponding to the at least one relation node. For example, at least one log to be matched can be obtained from the log database, and the node information corresponding to the at least one relation node can be matched with the log to be matched respectively. The successfully matched log to be matched is taken as the target log. Figure 4 shows another flowchart of the log processing method provided in this embodiment of the present disclosure. As shown in Figure 4, step S104 may specifically include the following steps:

[0047] In step S1041, the sum of the matching weights corresponding to the active relation nodes is obtained.

[0048] Among them, the active relationship node is the relationship node that has successfully matched the log to be matched in the log library.

[0049] In step S1042, the matching degree between at least one relation node and the log to be matched is determined based on the sum of the matching weights corresponding to the relation nodes in the active state.

[0050] Wherein, the matching degree is the ratio of the sum of the matching weights corresponding to the active relation nodes to the sum of the activation weights corresponding to all relation nodes.

[0051] The activation weight can be a preset weight corresponding to each relation node, representing the importance of the relation node when matching with the log to be matched (e.g., using semantic cosine similarity matching).

[0052] For example, when the active relation node is a keyword, the matching weight can be the activation weight corresponding to the keyword. When the relation node is a branch node, the matching weight of the branch node is the sum of the activation weights corresponding to each active keyword under that branch node. When the branch node includes a lower-level branch node, recursive matching is required. That is, first determine the matching weight of the lower-level branch node based on the matching of the keywords included in the lower-level branch node, and then determine the matching weight of the branch node based on the matching weight of the lower-level branch node. When the leaf node is a second knowledge graph node, recursive matching is also required. That is, first determine the matching weight of the relation node corresponding to the second knowledge graph node, and then determine the matching weight of the branch node based on the matching weight of the relation node corresponding to the second knowledge graph node.

[0053] In some embodiments, the keywords corresponding to each leaf node can be matched with the logs to be matched, and the keywords that are successfully matched can be used as keywords in the active state. The specific matching method can be semantic similarity matching or keyword matching directly. This application does not limit this.

[0054] In step S1043, logs to be matched with a matching degree greater than or equal to the first threshold are taken as target logs.

[0055] Figure 5 illustrates a schematic diagram of determining the matching degree based on relation nodes in a knowledge graph according to an embodiment of this disclosure. As shown in Figure 5, assuming the first threshold is 70%, the matching weight of the active leaf node "Second Knowledge Graph Node" (represented by "√" in the figure) is 1, and its activation weight is 1. The matching weight of the active leaf node "KEYE" is 0.8, and its activation weight is 0.8. The matching weight corresponding to the active branch node C is the sum of the matching weight of "Second Knowledge Graph Node" and the matching weight of leaf node "KEYE", which is 1.8. The activation weight of branch node C is the sum of the activation weight of "Second Knowledge Graph Node" and the activation weight of leaf node "KEYE", which is 1.8. Since the ratio of the matching weight of branch node C to the total weight of relation nodes is 100%, which is greater than the first threshold, branch node C is also active. Accordingly, leaf node "KEYC" matches successfully, while "KEYD" fails to match. In other words, if relation node "KEYC" is successfully activated and "KEYD" fails to activate, the matching weight of branch node A is the sum of the matching weights of branch node C and "KEYC" (1.8 + 0.6 = 2.4). The activation weight of branch node A is the sum of the activation weights of branch node C, "KEYC", and "KEYD" (1.8 + 0.6 + 0.5 = 3.1). The ratio of the matching weight of branch node A to the total weight of relation nodes is 2.4 / 3.1 = 77%, which is greater than the first threshold. Therefore, the state of branch node A is also active. When the relation node corresponding to the target path is branch node A, it indicates that the first log description information has successfully matched the log to be matched based on the target path, and the log to be matched can be used as the target log.

[0056] It should be noted that in the example above, the activation weight of branch node C as a child node of branch node A is the sum of the activation weights of its child nodes. In some embodiments, the activation weight of branch node C as a child node of branch node A may also be different from the sum of the activation weights of its child nodes, but rather an independent preset value. This application does not impose any restrictions on this.

[0057] In some possible implementations, each relation node can correspond to its own first threshold, which can be dynamically refreshed based on statistical data such as the historical activation success rate of the relation node. When a new relation node is added, its corresponding first threshold can be a preset initial value.

[0058] By employing the above technical solution, at least one relation node in the target path can be identified through the log description information of knowledge graph nodes in a pre-defined knowledge graph. Based on the node information corresponding to each of the multi-level relation nodes, the corresponding target log is matched from the log database. This reduces the reliance on human analysis and manual fault analysis capabilities in log analysis, thereby improving the efficiency of fault handling.

[0059] In some embodiments, the matching weight can be the activation weight of the corresponding active relation node, or the product of the activation weight of the corresponding active relation node and the position weight corresponding to the matching position of the relation node in the log to be matched.

[0060] Activation weights can be preset weights for each relation node, representing the importance of that relation node when matching with the log to be matched (e.g., using semantic-based cosine similarity matching). For example, in Figure 2, if among the five keywords corresponding to the knowledge graph node "Process ANR Occurred," the keywords "1682" and "1798" are very important for log matching (e.g., these two keywords can easily distinguish it from other logs), then larger activation weights can be set for these two keywords; otherwise, smaller activation weights can be set.

[0061] In some embodiments, corresponding position weights can be set according to the different positions of the relation node in the log to be matched. For example, when the relation node is a keyword, the corresponding position weights can be set according to the order of the keywords in a log line. When the relation node is a branch node or a second knowledge graph node, the corresponding position weights can be set according to the multiple keywords corresponding to the branch node or the second knowledge graph node in different lines of a log segment, or the corresponding position weights can be set according to the multiple keywords corresponding to the branch node or the second knowledge graph node in different segments of a log file. This application does not limit this.

[0062] In some embodiments, the maximum value of the position weight can be set to 1. If the position of the relation node cannot be matched with any preset position, it can be matched with a preset "Null" position. The preset position weight of the "Null" position can be a preset value (e.g., 0.2). If the parent node of the relation node is activated, the position of the relation node can be learned.

[0063] By adopting the above technical solution, when obtaining the target log from the log to be matched in the log library through the relation node, both the activation status of the relation node and the location of the relation node are taken into account, which can further improve the accuracy of target log matching.

[0064] Figure 6 shows another schematic flowchart of the log processing method provided in this embodiment of the present disclosure. As shown in Figure 6, before step S103, the method may further include the following steps:

[0065] In step S105, when there are multiple paths between the first knowledge graph node and the root node of the knowledge graph, the pre-trained large model determines the target path from the multiple paths.

[0066] Figure 7 illustrates a schematic diagram of multiple paths in a knowledge graph provided in an embodiment of this disclosure. As shown in Figure 7, there are two paths between the first knowledge graph node "APK killed" and the root node of the knowledge graph. The first path is "Knowledge graph root node => Process ANR => APK killed", which includes two sub-paths: "Knowledge graph root node => Process ANR" and "Process ANR => APK killed". The second path is a direct path from "Knowledge graph root node => APK killed", which includes two relation nodes "Leaf node A" and "Leaf node B", where "Leaf node A" is the knowledge graph node "Process ANR" and "Leaf node B" is the knowledge graph node "XXXX".

[0067] In some embodiments, different matching strategies can be adopted based on different paths. For example, when there are multiple sub-paths in the path (i.e., the root node of the knowledge graph is connected to the first knowledge graph node through at least one knowledge graph node), matching can be performed according to the order of the sub-paths. For instance, in Figure 7, matching can be performed first based on the sub-path "knowledge graph root node => process ANR", that is, matching based on the 5 relation nodes (keywords) corresponding to the knowledge graph node "process ANR". If the match is successful, then matching can be performed based on the sub-path "process ANR => APK killed", that is, matching based on the 2 relation nodes (keywords) corresponding to the first knowledge graph node "APK killed". If the match is successful, the corresponding log to be matched is taken as the target log.

[0068] In another embodiment, when there are multiple sub-paths in the path (i.e., the root node of the knowledge graph is connected to the first knowledge graph node through at least one knowledge graph node), matching can also be performed directly according to the multiple relation nodes corresponding to the path. For example, in the matching of the first path in Figure 6, matching can also be performed directly according to the 7 relation nodes (keywords) corresponding to the sub-paths "knowledge graph root node => process ANR" and "process ANR => APK killed". If the matching is successful, the corresponding log to be matched is taken as the target log.

[0069] In another embodiment, if the relationship nodes in the path include second knowledge graph nodes, matching can be performed based on the relationship nodes corresponding to the second knowledge graph nodes. For example, in Figure 7, for the second path (the direct path from "knowledge graph root node => APK killed"), matching can be performed based on the M relationship nodes corresponding to the second knowledge graph node "process ANR occurred" and the N relationship nodes corresponding to the second knowledge graph node "XXXX", totaling M+N relationship nodes. If a match is successful, the corresponding log to be matched is taken as the target log.

[0070] In some embodiments, the matching process of the target log can be recorded, and paths can be deleted based on the success rate of matching logs across multiple paths. For example, a path can be deleted when the success rate of matching logs is lower than a preset threshold. It is understood that when deleting paths, direct paths can be deleted directly, and for paths with multiple sub-paths, sub-paths directly connected to the first knowledge graph node can be deleted. For example, for the first path in Figure 7, "Knowledge Graph Root Node => Process ANR => APK Killed", only the sub-path "Process ANR => APK Killed" can be deleted, while the decision to delete the sub-path "Knowledge Graph Root Node => Process ANR" is determined based on the success rate of the first knowledge graph node "Process ANR".

[0071] By adopting the above technical solution, multiple paths can be dynamically maintained, and a pre-trained large language model can select the target path from multiple paths, thereby further improving the accuracy of log matching.

[0072] Figure 8 shows another schematic flowchart of the log processing method provided in this embodiment of the present disclosure. As shown in Figure 8, the method may further include the following steps:

[0073] In step S106, the target log is input into a pre-trained large model, and the output of the large model is used as the log processing response to send the log processing response to the user.

[0074] The log processing response includes at least one of the following: second log description information of the target log; fault handling information corresponding to the target log.

[0075] In some embodiments, the second log description information may be further descriptive information of the target log provided by the large model, enabling users to better understand the target log corresponding to the fault information. The fault handling information may be detailed fault information provided by the large model based on the target log information, such as the location, time, and severity of the fault; it may also include fault handling suggestions, fault recovery measures, or standard operating procedures (SOPs) for fault handling. In some embodiments, a pre-trained large model may provide the corresponding fault handling information along with the second log description information of the target log, thereby providing users with more comprehensive information for fault handling.

[0076] By adopting the above technical solution, the target log corresponding to the fault can be accurately matched and the target log can be input into the large model to obtain the log processing response. It is not necessary to submit a huge number of logs to the large model for analysis, which can reduce the number of tokens in the large model, save costs, increase accuracy, and avoid the information security risk of large-scale log leakage.

[0077] Figure 9 shows another schematic flowchart of the log processing method provided in this embodiment of the present disclosure. As shown in Figure 9, the method may further include the following steps:

[0078] In step S107, user feedback information is obtained, and at least one of the activation weight, position weight, and first threshold corresponding to the relationship node is updated based on the feedback information.

[0079] It is understood that the feedback information can be the user's response to the log processing, or it can be the user's direct feedback to the target log matched based on the knowledge graph. This application does not impose any restrictions on this.

[0080] In some embodiments, the activation weight can be updated by the following steps: if the feedback information is correct, increase the activation weight of the relationship node in the active state by a first preset value; or decrease the activation weight of other relationship nodes in the relationship nodes other than the active relationship node by a second preset value; or, while increasing the activation weight of the relationship node in the active state by the first preset value, decrease the activation weight of other relationship nodes in the relationship nodes other than the active relationship node by the second preset value.

[0081] If the user's feedback on the log processing response is correct, the relation nodes in the knowledge graph can accurately match the corresponding target log. In this case, the activation weight of the active relation nodes (i.e., the relation nodes that are successfully matched during the matching process) can be appropriately increased, while the activation weight of other relation nodes (i.e., the relation nodes that are not successfully matched during the matching process) can be appropriately decreased.

[0082] Correspondingly, when the user's feedback on the log processing response is negative, it indicates that the relation nodes in the knowledge graph do not accurately match the corresponding target logs. In this case, the activation weight of the active relation nodes (i.e., the relation nodes that are successfully matched during the matching process) can be appropriately reduced, while the activation weight of other relation nodes (i.e., the relation nodes that are not successfully matched during the matching process) can be appropriately increased.

[0083] In some embodiments, the position weight can be updated by the following steps: updating the position weight of the relation node at the matching position based on the historical successful activation rate of the relation node at the matching position in the matching log.

[0084] For example, the number of times N, a relation node successfully matches at a preset position in M ​​target logs, can be counted. The ratio of N to M is taken as the historical successful activation rate of the relation node at that matching position. If the historical successful activation rate of the relation node at the matching position in the log to be matched is greater than a first preset threshold, the position weight of the relation node at that matching position can be appropriately increased. If the historical successful activation rate is less than a second preset threshold, the position weight of the relation node at that matching position can be appropriately decreased. The second preset threshold can be less than the first preset threshold.

[0085] In some embodiments, the first threshold can be updated by the following steps: if the increase in the activation success rate of at least one relation node compared to the historical activation success rate is greater than or equal to a first magnitude threshold, the first threshold is increased by a third preset value; or, if the decrease in the activation success rate of at least one relation node compared to the historical activation success rate is greater than or equal to a second magnitude threshold, the first threshold is decreased by a fourth preset value. In some embodiments, if the first threshold gradually increases to exceed a preset threshold, the updating of the first threshold can be stopped, and the updating of the activation weight and position weight can also be stopped.

[0086] It is understood that the first preset value, second preset value, third preset value, fourth preset value, first preset threshold, and second preset threshold in the above-mentioned technical solutions for updating activation weight, position weight, and first threshold can be flexibly set as needed. The above-mentioned technical solutions for updating activation weight, position weight, and first threshold can be executed individually or in any combination of different technical solutions, and this application does not impose any restrictions on this.

[0087] By adopting the above technical solution, the relevant parameters of the relation nodes in the knowledge graph can be automatically learned and adjusted based on the user's feedback information on log processing, further improving the adaptability of matching logs through the knowledge graph.

[0088] In some embodiments, after updating the activation weights corresponding to the relationship nodes based on the feedback information, the method may further include the step of updating the relationship nodes based on the updated activation weights, which may specifically include the following implementation methods.

[0089] Method 1: Delete the relation node if the activation weight of any relation node is less than the second threshold and the relation node does not include the next level child node (i.e., the relation node is a leaf node).

[0090] Method 2: If the activation weight of any relation node is less than the second threshold, and the relation node includes a next-level child node, determine whether there is a next-level child node whose activation success rate is less than the activation success rate of the relation node; if so, delete the next-level child node whose activation success rate is less than the activation success rate of the relation node; otherwise, delete the relation node.

[0091] In some embodiments, after deleting the relation node, the next-level child node of the relation node can be used as the child node of the parent node of the relation node.

[0092] For example, if the activation weight of any relation node is less than the second threshold, the relation node can be processed by prioritizing the deletion of its next-level target child nodes with lower activation success rates. Similarly, when deleting a next-level target child node, the process can also prioritize deleting its next-level child nodes. It can be understood that if a next-level child node of a relation node is deleted, and that next-level child node includes its own next-level child node, then that next-level child node can be considered the next-level child node of the relation node.

[0093] Figure 10 shows a schematic diagram of a relation node deletion provided in an embodiment of the present disclosure. As shown in Figure 10, the relation node "branch node C" is deleted because of its low activation weight. Since the relation node "branch node C" still has a lower-level child node "KEYE" and "KEYF", its lower-level child nodes "KEYE" and "KEYF" can be used as child nodes of its parent node "branch node A".

[0094] In some embodiments, when deleting a relation node, it is also necessary to consider the mutual influence between relation nodes. This can be achieved by copying and replacing the relation node to avoid affecting other relation nodes.

[0095] Figure 11 illustrates another schematic diagram of relation node deletion provided in this embodiment of the present disclosure. As shown in Figure 11, relation branch node D includes two parent nodes, analysis node A and branch node B. During the matching process of branch node A, the keyword "KEYC" as a child node of branch node D needs to be deleted. In order to avoid the impact of the deletion of "KEYC" on branch node B, branch node D can be copied as branch node E, and the relationship between branch node D and branch node B can be transferred to the copied branch node E. At this time, "KEYC" under branch node D can be deleted. In this way, when updating the node relationship according to the activation success rate of branch node A, it is possible to avoid affecting other branch nodes, such as branch node B.

[0096] In some embodiments, the target path may include multiple relation nodes, and relation nodes may be added in the following manner: when the matching degree is greater than or equal to a first threshold and less than a third threshold, a new relation node is created; the new relation node is used as the parent node of the active relation node among the multiple relation nodes, and the new relation node is used as the child node of the original parent node of the active relation node among the multiple relation nodes.

[0097] Figure 12 shows a schematic diagram of adding relation nodes according to an embodiment of this disclosure. As shown in Figure 12, the relation node "branch node A" includes four leaf nodes (keywords). When performing log matching, branch node A is activated, and some of the relation nodes among the four leaf nodes are in an active state (in Figure 10, the leaf nodes "KEYF", "KEYC", and "KEYD" are in an active state). If the matching degree is greater than or equal to the first threshold and less than the third threshold, a new relation node "branch node D" can be created, and the new relation node "branch node D" can be used as the parent node of "KEYF", "KEYC", and "KEYD" and as the child node of relation node "branch node A".

[0098] By adopting the above technical solution, the knowledge graph nodes can be continuously updated using statistical methods based on the user-submitted resolved fault test cases, thus meeting the generalization requirements of the knowledge graph.

[0099] Figure 13 shows another schematic flowchart of the log processing method provided in the present disclosure. As shown in Figure 13, step S104 may further include the following steps: in step S1044, if it fails to obtain the log to be matched with a matching degree greater than or equal to the first threshold, obtain the relation node to be expanded for matching.

[0100] Among them, the relationship nodes to be expanded for matching are those that have not been successfully activated and include at least one child node.

[0101] In step S1045, the expansion matching weight of the child node to be expanded matching that was not successfully activated in the at least one child node is determined.

[0102] In a relation node, child nodes that have not been successfully activated and are awaiting expansion matching are child nodes that have not been fully matched. Specifically, there are two cases:

[0103] Case 1: The child node to be expanded for matching is not matched if it is in the first position, but the position of the child node is matched.

[0104] For example, the relation node includes three child nodes: "APK", "is", and "ANR". When performing log matching, if the child nodes "APK" and "is" are both successfully matched, but the child node "ANR" is not successfully matched at position 3, for example, in the log to be matched, the keyword at position 3 is "Crash".

[0105] Case 2: The child node to be expanded for matching is successfully matched, but the position of the child node does not match.

[0106] For example, the relation node includes three child nodes: “APK”, “is”, and “ANR”. When performing log matching, if the child nodes “APK” and “is” are both successfully matched, but the child node “ANR” is not successfully matched in the first position (position 3), but is successfully matched in other positions, such as the second position (position 4), for example, in the log to be matched, the keyword in position 4 is “ANR”.

[0107] In some embodiments, the expansion matching weight of at least one child node that has not been successfully activated for expansion matching can be determined in the following manner:

[0108] Method 1: If the child node to be expanded and matched is not matched successfully in the first position, but the position of the child node is matched, the product of the position weight of the first position of the child node to be expanded and matched and the activation expansion weight is used as the expansion matching weight.

[0109] For example, if the child node to be expanded and matched belongs to case 1 above, the product of the position weight of the first position of the child node to be expanded and matched and the activation expansion weight can be used as the expansion matching weight.

[0110] Method 2: If the child node to be expanded and matched is successfully matched, but the position of the child node does not match, the product of the activation weight and the position expansion weight of the child node to be expanded and matched is used as the expansion matching weight.

[0111] For example, if the child node to be expanded and matched belongs to case 2 above, the product of the activation weight and the position expansion weight of the child node to be expanded and matched can be used as the expansion matching weight.

[0112] Method 3: If the child node to be expanded and matched is a child node that is not matched successfully in the first position but whose position is matched, and a child node that is matched successfully in the second position but whose position is not matched, then the larger of the following two will be used as the expanded matching weight: the product of the position weight of the child node to be expanded and matched in the first position and the activation expanded weight, and the product of the activation weight of the child node to be expanded and matched and the position expanded weight.

[0113] The child nodes to be expanded for matching can also satisfy both Case 1 and Case 2 above. For example, the relation node includes three child nodes: “APK”, “is”, and “ANR”. When performing log matching, if the child nodes “APK” and “is” are both successfully matched, and the keywords in the log to be matched are “APK”, “is”, “Crash”, and “ANR”, then when the child node “ANR” matches “Crash” in the log to be matched, it belongs to Case 1 above, and when it matches “ANR” in the log to be matched, it belongs to Case 2 above. In this case, the expanded matching weights for the two cases can be calculated separately, and the larger of the two can be used as the final expanded matching weight to update the matching degree of the relation node.

[0114] In some possible implementations, if a child node fails to expand the match successfully, the child nodes of that child node can be iterated to expand the match. If the child node's child nodes expand the match successfully, the contribution of that child node to the expanded match can be calculated as the product of the activation weight and the activation expansion weight.

[0115] In step S1046, the matching degree of the relation nodes to be expanded and matched is updated according to the expanded matching weight, and the logs to be matched with a matching degree greater than or equal to the first threshold are taken as target logs.

[0116] For example, the relation node includes three child nodes: "APK", "is", and "ANR". If the child nodes "APK" and "is" match completely, but the child node "ANR" does not match completely, the matching weight of the child nodes "APK" and "is" and the extended matching weight of the child node "ANR" can be used to update the matching degree of the relation node, and then the target log can be determined based on the updated matching degree.

[0117] In some embodiments, user feedback information may be obtained;

[0118] If the feedback is correct, perform at least one of the following:

[0119] The activation weights of child nodes that contribute to the extended matching are increased according to the fifth preset value.

[0120] The activation expansion weight corresponding to the child node that contributes to the expanded matching is increased according to the sixth preset value.

[0121] The positional expansion weights corresponding to the child nodes that contribute to the expanded matching are increased according to the seventh preset value.

[0122] The activation weights of child nodes that did not contribute to the extended matching are reduced according to the eighth preset value.

[0123] Reduce the activation expansion weights of child nodes that did not contribute to the expanded matching according to the ninth preset value.

[0124] Reduce the positional expansion weights of child nodes that did not contribute to the expanded matching according to the tenth preset value.

[0125] It is understood that when the feedback information is negative, at least one of the above activation weight, activation expansion weight and position expansion weight can be adjusted in the opposite direction. The feedback information can be the user's response to the log processing or the user's feedback information to the target log matched according to the knowledge graph. The above fifth to tenth preset values ​​can be flexibly set as needed, and the above adjustment methods can also be flexibly combined and implemented. This application does not limit this.

[0126] By adopting the above technical solution, the matching degree can be updated through the relationship nodes to be expanded and matched, the target log can be obtained, and the weight parameters of the child nodes that contribute to the expanded matching in the relationship nodes can be adjusted, thereby further improving the accuracy and adaptability of log matching using knowledge graphs.

[0127] In some embodiments, if a first knowledge graph node that matches the first log description information fails, the knowledge graph node can be updated through the following steps:

[0128] In step 10, the first log description information is input into a pre-trained large model to obtain at least one keyword associated with the first log description information.

[0129] For example, if the first log description in the log processing request entered by the user is "ANR occurred in the process", the first log description can be input into a pre-trained large model to obtain at least one keyword associated with the first log description, such as "1682", "1798", "Android Runtime", "FATAL", or "EXCEPTION".

[0130] In step 20, a temporary knowledge graph node is created, and at least one keyword is used as at least one relation node corresponding to the temporary knowledge graph node to obtain the target log from the log database.

[0131] If it fails to retrieve the first knowledge graph node corresponding to the first log description information from the knowledge graph, and also fails to retrieve similar knowledge graph nodes, a temporary knowledge graph node can be created. The first log description information can be used as the node description information of the temporary knowledge graph node, and the keywords "1682", "1798", "Android Runtime", "FATAL", and "EXCEPTION" can be used as the relation nodes corresponding to the temporary knowledge graph node to retrieve the target log from the log library.

[0132] In step 30, user feedback information is obtained. If the user feedback information is correct, the root node and the temporary knowledge graph node are connected to form the first new path.

[0133] It is understood that the feedback information can be the user's response to the log processing, or it can be the user's direct feedback to the target log matched based on the knowledge graph. This application does not impose any restrictions on this.

[0134] If the user's feedback on the log processing response is correct, the root node and the temporary knowledge graph node are connected to form the first new path. This essentially solidifies the temporary knowledge graph node into a knowledge graph node within the overall knowledge graph.

[0135] By adopting the above technical solution, the knowledge graph can be expanded based on temporary knowledge graph nodes and user feedback information on log processing responses, which facilitates the automatic learning and expansion of the knowledge graph and further enhances its scalability.

[0136] In some embodiments, the knowledge graph can also be updated using training data input by the user. Figure 14 shows a schematic flowchart of a knowledge graph update provided by an embodiment of this disclosure. As shown in Figure 14, the method includes the following steps:

[0137] In step S201, training data input by the number of users is obtained, the training data including third log description information and corresponding log details.

[0138] The training data may include third log description information and corresponding log details. For example, the format of the training data may be "third log description information: XXXX, log details: YYYY".

[0139] In some embodiments, the training data submitted by the user may also be in a tree structure, a directory structure, or a similar structure. For example, the directory structure may be as follows:

[0140] Third log description information: XXX

[0141] Third log description information: XXXX, log details: YYYY

[0142] Third log description information: XXXX, log details: YYYY

[0143] Third log description information: XXXX

[0144] Third log description information: XXXX, log details: YYYY

[0145] Third log description information: XXXX, log details: YYYY

[0146] If the training data submitted by the user adopts a tree structure, a directory structure, or a similar structure, it can be split into "Log description information: XXXX, Log details: YYYY" and processed one by one according to the above embodiments.

[0147] In step S202, if it fails to obtain a first knowledge graph node whose node description information matches the third log description information based on the third log description information, then obtain similar knowledge graph nodes whose node description information and the third log description information have a similarity greater than or equal to a fourth threshold.

[0148] In step S203, a first newly added knowledge graph node and a second newly added knowledge graph node are created in the knowledge graph. At least one keyword in the log details is used as at least one relation node corresponding to the first newly added knowledge graph node, and the third log description information is used as the node description information of the first newly added knowledge graph node.

[0149] In some possible implementations, at least one keyword in the log details can be obtained through a pre-trained large model, or the third log description information can be transformed into the fourth log description information through a pre-trained large model, and the fourth log description information can be used as the node description information of the first newly added knowledge graph node.

[0150] In step S204, a summary description is determined based on the third log description information and the node description information corresponding to similar knowledge graph nodes. This summary description information is used as the node description information of the second newly added knowledge graph node. The common relationship nodes of the first newly added knowledge graph node and the similar knowledge graph nodes are used as at least one relationship node corresponding to the second newly added knowledge graph node. The common relationship nodes are the relationship nodes among the relationship nodes corresponding to the similar knowledge graph nodes that match the log details.

[0151] In step S205, the root node of the knowledge graph, the second newly added knowledge graph node, and the first newly added knowledge graph node are connected to form a second newly added path; the root node, the second newly added knowledge graph node, and the similar knowledge graph node are connected to form a third newly added path; and the root node and the first newly added knowledge graph node are connected to form a fourth newly added path.

[0152] Figure 15 illustrates a schematic diagram of knowledge graph updating provided in this embodiment of the present disclosure. As shown in Figure 15, the original knowledge graph includes a knowledge graph node, and the corresponding relation nodes are keywords "KEYA", "KEYB", and "KEYC" (keywords are used as examples in this example, and branch nodes are similar). The training data input by the user may include third log description information and log details. For example, the log details corresponding to "process ANR" can be "1682 1798E Android Runtime:FATAL EXCEPTION". The above-mentioned training data input by the user can be used to update the knowledge graph.

[0153] In step S202 above, if it fails to obtain a first knowledge graph node whose node description information matches the first log description information based on the third log description information, and the similarity between the node description information of a certain knowledge graph node included in the original knowledge graph and the third log description information is greater than or equal to the fourth threshold, the knowledge graph node can be regarded as a similar knowledge graph node.

[0154] In step S203 above, a first newly added knowledge graph node and a second newly added knowledge graph node can be created in the knowledge graph. At least one keyword (“KEYA”, “KEYC”, and “KEYD” in Figure 15) can be obtained from the log details based on the large model. At least one keyword in the log details is used as at least one relation node corresponding to the first newly added knowledge graph node, and the third log description information is used as the node description information of the first newly added knowledge graph node. For example, if the third log description information in the log processing request input by the user is “process encountered ANR”, and the log details are “1682 1798E Android Runtime:FATAL EXCEPTION”, then the node description information of the first newly added knowledge graph node can be determined as “process encountered ANR”, corresponding to five relation nodes (keywords), namely “1682”, “1798”, “Android Runtime”, “FATAL”, and “EXCEPTION”.

[0155] In step S204 above, a generalized description can be determined based on the pre-trained large model according to the third log description information and the node description information corresponding to similar knowledge graph nodes. This generalized description information is then used as the node description information of the second newly added knowledge graph node. Next, the relation nodes corresponding to the similar knowledge graph nodes (“KEYA”, “KEYB”, “KEYC” in Figure 15) can be matched with the log details. Successfully matched relation nodes are designated as common relation nodes (“KEYA”, “KEYC” in Figure 15), and these common relation nodes are used as the relation nodes of the second newly added knowledge graph node.

[0156] In step S205 above, the root node of the knowledge graph, the second newly added knowledge graph node, and the first newly added knowledge graph node are connected to form the second newly added path; the root node, the second newly added knowledge graph node, and the similar knowledge graph node are connected to form the third newly added path; and the root node and the first newly added knowledge graph node are connected to form the fourth newly added path. After the above steps, the original knowledge graph, which had only one knowledge graph node and one path, is expanded to have three knowledge graph nodes and four paths.

[0157] In some embodiments, the activation weight and position weight of the node relationship corresponding to the newly added knowledge graph node can be set to preset initial values.

[0158] By adopting the above technical solution, similar knowledge graph nodes can be used as bridges to expand the knowledge graph based on the first log description information and log details used as input, which facilitates the automatic learning and expansion of the knowledge graph and further improves the scalability of the knowledge graph.

[0159] Figure 16 illustrates a schematic diagram of the hardware structure of an electronic device implementing the embodiments of this disclosure. As shown in Figure 16, at the hardware level, the electronic device includes at least one processor, and in one embodiment, includes an internal bus, a network interface, and a memory. The memory may include RAM, such as high-speed random-access memory (RAM), or it may also include non-volatile memory, such as at least one disk storage device. Of course, the electronic device may also include other hardware required for other services.

[0160] The processor, network interface, and memory can be interconnected via an internal bus, which can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be categorized as an address bus, data bus, control bus, etc. For ease of illustration, only a single bidirectional arrow is used in this diagram, but this does not imply that there is only one bus or one type of bus.

[0161] Memory stores programs. Specifically, the program may include program code, which includes at least one computer operation instruction. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0162] At least one processor reads a corresponding computer program from non-volatile memory into memory and then runs it, forming a device for locating a target user at the logical level. At least one processor executes the program stored in memory and specifically performs the method disclosed in the embodiments shown in the first aspect, achieving the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0163] The methods disclosed in the embodiments shown in the first aspect of this disclosure can be applied to at least one processor, or implemented by at least one processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the hardware or by instructions in the form of software within at least one processor. The processor may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0164] The electronic device can also execute the methods described in the preceding method embodiments and achieve the functions and beneficial effects of the methods described in the preceding method embodiments, which will not be repeated here.

[0165] Of course, in addition to software implementation, the electronic device disclosed herein does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0166] This disclosure also proposes a computer-readable storage medium that stores one or more programs, which, when executed by at least one processor, implement the methods disclosed in the embodiments of the first aspect and achieve the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0167] The computer-readable storage medium mentioned above includes read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc.

[0168] In one embodiment, this disclosure also provides a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, implement the following process: the method disclosed in the embodiment of the first aspect and implement the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0169] This application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the various processes of the method disclosed in the first aspect embodiment and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0170] In summary, the above description is merely a preferred embodiment of this disclosure and does not limit the scope of protection of this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

[0171] The systems, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0172] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0173] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0174] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

Claims

1. A method for log processing, comprising: receiving a log processing request input by a user, the log processing request comprising first log description information; obtaining, according to the first log description information, a first knowledge graph node from a preset knowledge graph, the first knowledge graph node matching the first log description information; obtaining at least one relationship node on a target path between the first knowledge graph node and a root node of the knowledge graph; obtaining a target log from a log library according to node information corresponding to the at least one relationship node.

2. The method of claim 1, wherein the relationship node is a branch node or a leaf node in a relationship node tree, the branch node comprising a next-level branch node and / or a leaf node, and the leaf node is a keyword and / or a second knowledge graph node.

3. The method of claim 1, further comprising: In the case that there are multiple paths between the first knowledge graph node and the root node of the knowledge graph, a pre-trained large model is used to determine the target path from the multiple paths.

4. The method of claim 1, further comprising: inputting the target log into the pre-trained large model, taking the output of the large model as a log processing response, and sending the log processing response to the user; wherein the log processing response comprises at least one of the following: second log description information of the target log; fault processing information corresponding to the target log.

5. The method of claim 1, wherein the obtaining a target log from a log library according to node information corresponding to the at least one relationship node comprises: obtaining a sum value of matching weights corresponding to active relationship nodes, the active relationship nodes being relationship nodes that successfully match a to-be-matched log in the log library; determining a matching degree of at least one relationship node and the to-be-matched log according to the sum value of the matching weights corresponding to the active relationship nodes, the matching degree being a ratio of the sum value of the matching weights corresponding to the active relationship nodes to a sum value of active weights of all relationship nodes; taking the to-be-matched log with a matching degree greater than or equal to a first threshold value as the target log.

6. The method of claim 5, wherein the matching weight is an active weight corresponding to the active relationship node, or the matching weight is a product of the active weight and a position weight corresponding to a matching position of the active relationship node in the to-be-matched log.

7. The method of claim 5, further comprising: obtaining feedback information of the user; updating at least one of the active weight, the position weight, and the first threshold value corresponding to the relationship node according to the feedback information.

8. The method of claim 7, wherein the updating at least one of the active weight, the position weight, and the first threshold value corresponding to the relationship node according to the feedback information comprises: in the case that the feedback information is correct feedback, increasing the active weight of the active relationship node by a first preset value; and / or, decreasing the active weight of relationship nodes other than the active relationship node by a second preset value.

9. The method of claim 7, wherein the updating of the at least one of the activation weight, the position weight, and the first threshold value of the sub-node according to the feedback information comprises: updating the position weight of the relationship node at the matching position in the to-be-matched log according to a historical success activation rate of the relationship node at the matching position.

10. The method of claim 7, wherein the updating of the at least one of the activation weight, the position weight, and the first threshold value of the sub-node according to the feedback information comprises: increasing the first threshold value by a third preset value in a case where an increase of the activation success rate of the at least one relationship node compared to the historical activation success rate is greater than or equal to a first amplitude threshold value; or decreasing the first threshold value by a fourth preset value in a case where a decrease of the activation success rate of the at least one relationship node compared to the historical activation success rate is greater than or equal to a second amplitude threshold value.

11. The method of claim 7, further comprising: deleting any relationship node in a case where the activation weight of the relationship node is less than a second threshold value and the relationship node does not include a next-level sub-node.

12. The method of claim 7, further comprising: determining whether there is a next-level sub-node with an activation success rate less than that of any relationship node in a case where the activation weight of the relationship node is less than a second threshold value and the relationship node includes a next-level sub-node; deleting the next-level sub-node with the activation success rate less than that of the relationship node if there is; and deleting the relationship node otherwise.

13. The method of claim 5, wherein the target path includes a plurality of relationship nodes, the method further comprising: creating a new relationship node in a case where the matching degree is greater than or equal to a first threshold value and less than a third threshold value; and setting the new relationship node as a parent node of the relationship nodes in the activated state among the plurality of relationship nodes and as a child node of the original parent node of the relationship nodes in the activated state among the plurality of relationship nodes.

14. The method of claim 5, further comprising: obtaining a to-be-extended matching relationship node in a case where the obtaining of the to-be-matched log with the matching degree greater than or equal to the first threshold value fails, the to-be-extended matching relationship node being a relationship node that has not been activated successfully and includes at least one sub-node; determining an extended matching weight of a to-be-extended matching sub-node that has not been activated successfully among the at least one sub-node; and updating the matching degree of the to-be-extended matching relationship node according to the extended matching weight, and obtaining a to-be-matched log with the matching degree greater than or equal to the first threshold value as the target log.

15. The method of claim 14, wherein the determining of the extended matching weight of the to-be-extended matching sub-node that has not been activated successfully among the at least one sub-node comprises: ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ in a case where the to-be-expanded matching child node is a child node that is not matched successfully but the position of the child node is matched, multiplying the position weight of the first position of the to-be-expanded matching child node and the activation expansion weight to obtain the expansion matching weight; in a case where the to-be-expanded matching child node is a child node that is matched successfully but the position of the child node is not matched, multiplying the activation weight of the to-be-expanded matching child node and the position expansion weight to obtain the expansion matching weight; in a case where the to-be-expanded matching child node is a child node that is not matched successfully but the position of the child node is matched at the first position and is matched successfully but the position is not matched at the second position, taking a larger one of the following two as the expansion matching weight: a product of the position weight of the first position of the to-be-expanded matching child node and the activation expansion weight, and a product of the activation weight of the to-be-expanded matching child node and the position expansion weight.

16. The method of claim 14, further comprising: obtaining feedback information of the user; in a case where the feedback information is correct feedback, performing at least one of the following: increasing, by a fifth preset value, the activation weight of a child node that contributes to expansion matching; increasing, by a sixth preset value, the activation expansion weight of a child node that contributes to expansion matching; increasing, by a seventh preset value, the position expansion weight of a child node that contributes to expansion matching; decreasing, by an eighth preset value, the activation weight of a child node that does not contribute to expansion matching; decreasing, by a ninth preset value, the activation expansion weight of a child node that does not contribute to expansion matching; decreasing, by a tenth preset value, the position expansion weight of a child node that does not contribute to expansion matching.

17. The method of claim 16, in a case where a first knowledge graph node matched with the first log description information fails, the method further comprising: inputting the first log description information into a pre-trained large model to obtain at least one keyword associated with the first log description information; creating a temporary knowledge graph node, and obtaining a target log from a log library as at least one relationship node corresponding to the temporary knowledge graph node using the at least one keyword; obtaining feedback information of the user, and in a case where the feedback information of the user is correct feedback, connecting the root node and the temporary knowledge graph node to form a first newly added path.

18. The method of any one of claims 1-17, further comprising: obtaining training data input by a user, the training data including third log description information and corresponding log detailed information; in a case where a first knowledge graph node matched with the third log description information fails to be obtained from a knowledge graph according to the third log description information, obtaining a similar knowledge graph node having a similarity greater than or equal to a fourth threshold with the third log description information. create a first new knowledge graph node and a second new knowledge graph node in the knowledge graph, take at least one keyword in the log detailed information as at least one relationship node corresponding to the first new knowledge graph node, and take the third log description information as node description information of the first new knowledge graph node; determine summary description information according to the third log description information and node description information corresponding to the similar knowledge graph node, take the summary description information as node description information of the second new knowledge graph node, and take common relationship nodes of the first new knowledge graph node and the similar knowledge graph node as at least one relationship node corresponding to the second new knowledge graph node, the common relationship nodes being relationship nodes corresponding to the similar knowledge graph node and matching the log detailed information; connect the root node of the knowledge graph, the second new knowledge graph node and the first new knowledge graph node to form a second new path, connect the root node, the second new knowledge graph node and the similar knowledge graph node to form a third new path, and connect the root node and the first new knowledge graph node to form a fourth new path.

19. An electronic device comprising: The memory, the processor and the computer program stored on the memory and executable on the processor, when the computer program is executed by the processor, implement the log processing method of any one of claims 1-18. 20.A computer readable storage medium, having stored thereon a computer program, the computer program being executed by a processor to implement the log processing method of any one of claims 1-18. 21.A computer program product, comprising a computer program, the computer program being executed by a processor to implement the steps of the log processing method of any one of claims 1-18.

Images