CN112162905A

CN112162905A - Log processing method and device, electronic equipment and storage medium

Info

Publication number: CN112162905A
Application number: CN202011045326.8A
Authority: CN
Inventors: 尹久盼
Original assignee: Beijing Zitiao Network Technology Co Ltd
Current assignee: Beijing Zitiao Network Technology Co Ltd
Priority date: 2020-09-28
Filing date: 2020-09-28
Publication date: 2021-01-01

Abstract

The embodiment of the disclosure discloses a log processing method, a log processing device, an electronic device and a storage medium, wherein the method comprises the following steps: responding to the received log searching condition, and performing log searching on the log to be processed based on the log searching condition, wherein the log to be processed is imported through a first interface; and displaying the search result by using the graphical control in the second interface, and controlling the graphical control to perform interactive action according to the interactive instruction. Searching the to-be-processed log imported from the first interface according to the log searching condition to obtain a demand log hitting the searching condition; and compared with the traditional method for checking abnormal logs from plain texts, the log obtained by searching is displayed and interacted through the graphical control in the second interface, so that the log searching efficiency can be improved, and the user experience is improved.

Description

Log processing method and device, electronic equipment and storage medium

Technical Field

The embodiment of the disclosure relates to the technical field of computers, and in particular, to a log processing method, system, device, electronic device and storage medium.

Background

When an application program is developed, a technician usually deploys codes with a function of recording an operation log in the application program, so as to record a program operation key node log, a program operation exception log and the like through the codes, which can help to perform vulnerability investigation and targeted repair after the application program is online.

The more complex the application, the greater the amount of logs generated by the running, and the amount of logs is generally calculated in ten thousand rows. The method searches and checks the logs required by the user from massive log files, and has huge workload and low efficiency. Therefore, a log processing method is needed to assist the user in locating the demand log conveniently and efficiently.

Disclosure of Invention

The embodiment of the disclosure provides a log processing method and device, electronic equipment and a storage medium, which can assist a user in conveniently and efficiently positioning a demand log.

In a first aspect, an embodiment of the present disclosure provides a log processing method, including:

responding to a received log searching condition, and performing log searching on a log to be processed based on the log searching condition, wherein the log to be processed is imported through a first interface;

and displaying the search result by using the graphical control in the second interface, and controlling the graphical control to perform interactive action according to the interactive instruction.

In a second aspect, an embodiment of the present disclosure further provides a log processing apparatus, including:

the log searching module is used for responding to the received log searching condition and searching logs to be processed based on the log searching condition, wherein the logs to be processed are imported through a first interface;

and the display interaction module is used for displaying the search result by using the graphical control in the second interface and controlling the graphical control to perform interaction action according to the interaction instruction.

In a third aspect, an embodiment of the present disclosure further provides an electronic device, where the electronic device includes:

one or more processors;

a storage device for storing one or more programs,

when the one or more programs are executed by the one or more processors, the one or more processors implement the log processing method according to any one of the embodiments of the present disclosure.

In a fourth aspect, the embodiments of the present disclosure further provide a storage medium containing computer-executable instructions, which when executed by a computer processor, are used for executing the log processing method according to any one of the embodiments of the present disclosure.

According to the technical scheme of the embodiment of the disclosure, log search is carried out on the log to be processed based on the received log search condition, wherein the log to be processed is imported through a first interface; and displaying the search result by using the graphical control in the second interface, and controlling the graphical control to perform interactive action according to the interactive instruction. Searching the to-be-processed log imported from the first interface according to the log searching condition to obtain a demand log hitting the searching condition; and compared with the traditional method for checking abnormal logs from plain texts, the log obtained by searching is displayed and interacted through the graphical control in the second interface, so that the log searching efficiency can be improved, and the user experience is improved.

Drawings

The above and other features, advantages and aspects of various embodiments of the present disclosure will become more apparent by referring to the following detailed description when taken in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numbers refer to the same or similar elements. It should be understood that the drawings are schematic and that elements and features are not necessarily drawn to scale.

Fig. 1 is a schematic flowchart of a log processing method according to a first embodiment of the present disclosure;

fig. 2 is a schematic diagram of a first interface in a log processing method according to a first embodiment of the disclosure.

Fig. 3 is a schematic diagram of a second interface in a log processing method according to a first embodiment of the disclosure.

Fig. 4 is a schematic diagram illustrating syntax tree generation in a log processing method according to a second embodiment of the disclosure.

Fig. 5 is a schematic diagram of a communication architecture in a log processing method according to a second embodiment of the disclosure.

Fig. 6 is an interaction diagram of a line graph control in a log processing method according to a third embodiment of the present disclosure;

fig. 7 is a schematic structural diagram of a log processing apparatus according to a fourth embodiment of the disclosure;

fig. 8 is a schematic structural diagram of an electronic device according to a fifth embodiment of the disclosure.

Detailed Description

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure are shown in the drawings, it is to be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but rather are provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the disclosure are for illustration purposes only and are not intended to limit the scope of the disclosure.

It should be understood that the various steps recited in the method embodiments of the present disclosure may be performed in a different order, and/or performed in parallel. Moreover, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present disclosure is not limited in this respect.

The term "include" and variations thereof as used herein are open-ended, i.e., "including but not limited to". The term "based on" is "based, at least in part, on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions for other terms will be given in the following description.

It should be noted that the terms "first", "second", and the like in the present disclosure are only used for distinguishing different devices, modules or units, and are not used for limiting the order or interdependence relationship of the functions performed by the devices, modules or units.

It is noted that references to "a", "an", and "the" modifications in this disclosure are intended to be illustrative rather than limiting, and that those skilled in the art will recognize that "one or more" may be used unless the context clearly dictates otherwise.

Example one

Fig. 1 is a schematic flowchart of a log processing method provided in a first embodiment of the present disclosure, and the first embodiment of the present disclosure is applicable to a situation where a demand log is searched from a large amount of logs. The method may be performed by a log processing apparatus, which may be implemented in the form of software and/or hardware, which may be configured in an electronic device, such as a computer.

As shown in fig. 1, the log processing method provided in this embodiment includes:

s110, responding to the received log searching condition, performing log searching on the log to be processed based on the log searching condition, wherein the log to be processed is imported through a first interface.

In the embodiment of the present disclosure, the log processing method may be applied to a log processing application program, that is, the log processing application program may implement processing of the log to be processed, for example, implement searching of a demand log in the log to be processed.

After the log processing application program is started, a to-be-processed log can be imported through a first interface of the log processing application program, wherein the to-be-processed log includes but is not limited to an operation log of the target application program and/or an interaction log between the target application program and a server corresponding to the target application program. The target application may be, for example, an application under development or an application that is already online.

The log to be processed is imported through a first interface of the log processing application program, for example, a log adding control in the first interface is triggered, a window interface containing a storage path is popped up, and the log to be processed is selected from the window interface so as to import the log to be processed; and for another example, the log file of the log to be processed can be directly dragged into the first interface to realize the import of the log to be processed. The log search condition may be received, for example, by receiving the log search condition input by the user through a search condition input control in the first interface. In addition, other ways of importing the log to be processed and ways of receiving the search condition may also be applied, and are not exhaustive here.

And searching the log to be processed imported by the first interface according to the received log searching condition, so as to obtain a demand log hitting the searching condition.

In some optional implementation manners of the embodiment of the present disclosure, performing log search on a log to be processed based on a log search condition includes: and performing log search on the log to be processed based on the keyword search condition and/or the time period search condition.

Wherein the keyword search condition may be at least one of: characters, words, semantic combinations of characters and semantic combinations of words. The semantic combination may be a combination including an element, not including an element, and a logical relationship such as "and", "or", for example, a semantic combination including the character 1 and not including the character 2.

The time period search condition is usually a time range, i.e. may include a start time and an end time. Generally, each line of log output is written with the output time, and the format of the output time is 2020-08-21T16:13:19.790177225+08:00, wherein T is a separator; +08:00 is the time of eight east regions, namely the time of Beijing, added with 8 hours on the basis of the world standard time of 2020-08-21T16:13: 19.790177225; the world standard time 2020-08-21T16:13:19.790177225 is characterized in that the world standard time is 8, 21 and 16 points are 13 minutes and 19.790177225 seconds in 2020. The year, month, day, hour, minute and second of the output time representation of each row of the logs in the log to be processed can be determined according to the format of the output time, and are converted into the time stamps, so that the time stamps of each row of the logs in the log to be processed can be compared with the time stamps in the time range represented by the time period searching condition.

Any one of the keyword search condition and the time period search condition or all the search conditions can be selected according to the requirement of the search precision to search the logs to be processed; in addition, the log to be processed can be searched by setting elements related to the "and" logic and/or "logic in the keyword search condition and/or setting a time range in the time period search condition according to the requirement of search precision. The searching precision can be determined according to the proportion of the number of the required logs to the total number of the logs, and the searching precision can be determined to be higher when the proportion is smaller.

Illustratively, when a certain abnormal log needs to be checked, the proportion of the number of the required logs to the total number of the logs is small, the search precision requirement is high, and the logs to be processed can be searched by selecting a keyword search condition and a time period search condition. Moreover, more elements related to the "and" logic may be set in the keyword search condition, and a smaller time range may also be set in the time period search condition.

When a specific abnormal log is not checked but a comprehensive abnormal log is checked, the requirement on the search precision is relaxed, and the log to be processed can be searched by selecting any one of the keyword search condition and the time period search condition. Also, fewer elements that are logically related to "and" may be set in the keyword search condition, more elements that are logically related to "or" may be set in the keyword search condition, or a larger time range may be set in the time period search condition.

When the log line in the log to be processed contains characters and characters in the keyword search condition, or accords with the semantic combination of the characters and the semantic combination of the characters, the log line in the log to be processed can be considered to hit the keyword search condition. When the time stamp of the log line in the log to be processed falls into the time stamp range corresponding to the time range, the search condition of the log line hit time period can be considered. And the log lines of the hit search condition can be output to the target log to lay a foundation for displaying the search result in the second interface.

And S120, displaying the search result by using the graphical control in the second interface, and controlling the graphical control to perform interactive action according to the interactive instruction.

The graphical control can be, for example, a line-shaped, column-shaped, pie-shaped, or three-dimensional stereo type graphical control. The graphical control can be controlled to perform interaction actions such as zooming, moving and detail displaying according to the interaction instruction. Generally, log files are all pure text files, and the efficiency of processing characters by human brain is not as high as that of processing patterns, so that the log files are displayed graphically and interacted with a graphical control, a user is facilitated to quickly locate the log position with abnormal suspicion according to morphological characteristics of the graphical control, and the purpose of improving log searching efficiency is achieved.

In some optional implementation manners of the embodiments of the present disclosure, the graphical control includes a point, the point is mapped to a horizontal axis of the graphical control as a first time period, the point is mapped to a vertical axis of the graphical control as a first numerical value, and the number of logs corresponding to the point representation in the first time period is the first numerical value.

After the logs to be processed are searched based on the search condition, the number value of the corresponding logs in each time period can be counted according to the search result. In addition, the time period can be represented by an abscissa, the number of logs obtained by searching can be represented by an ordinate, and some discrete points are drawn in a coordinate system where the graphical control is located, so that the graphical control is obtained. The horizontal axis coordinate of the point on the graphical control element may include the first time period corresponding to the point, for example, the start time, the end time, or the middle time of the first time period.

In some optional implementations, in order to more clearly present the trend of discrete points, the points may be connected, the obtained line graph control is used as a graphical control, or fitting is performed according to the discrete points, the obtained line graph control is used as a graphical control, and the graphical control is not specifically limited herein.

In the optional implementation modes, the log is aggregated to generate the graph by taking the time of the log as a core, the search result display in a graphical control mode can be realized, and when the first numerical value corresponding to the point in the graph is abnormal, the probability that the abnormal log exists in the log corresponding to the point is considered to be higher, so that the search efficiency of the required log is greatly improved.

Referring to fig. 2, the first interface may include the following regions: a log processing application title bar area 210, a log processing page title bar area 220, a log operation bar area 230, a log details bar area 250, and a log search setting area composed of a mode setting control group 241, a time setting control group 242, a history search condition control 243, and a search control 244.

In the area 210, the title "logFilter" of the journal processing application is displayed, and in the actual application scenario, the title of the journal processing application is not limited to this title.

In the area 220, titles "X. log" of 4 log processing pages of X1-X4 are displayed, and the title of each log processing page may be generated by default or by customization. Here, the title of the current log processing page may be displayed differently from the titles of the other log processing pages, and for example, the background color of the title bar of the current log processing page X3 may be displayed differently from the background of the title bar of the other log processing pages. When the "+" control on the rightmost side of the area 220 is triggered, a log processing page can be newly created, and when the "×" control on the left side of each processing page title bar is triggered, the corresponding log processing page can be closed.

In the area 230, an add log control "Select log here or log in log" may be set, and the add log control may be in a folder style or in another style. By clicking the log adding control, the log to be processed which needs to be imported can be selected in the pop-up interface, so that the import of the log to be processed is realized; or the log to be processed can be dragged to any area of the first interface, so that the log to be processed can be imported. In addition, in addition to the log adding control, other log operation controls may be provided in the area 230, which is not an example here.

After importing the pending log, the text content of the pending log may be displayed in area 250. In some optional implementation manners, the analysis result of the log to be processed may also be displayed or labeled, for example, the total number of rows of the log to be processed is displayed, or the analysis result such as a keyword and an event name of each row of the log is labeled.

In the log search setting area, when a selection control before the Pattern "in the Pattern setting control group 241 is selected, a keyword search condition may be input in an input field control after the Pattern; when the selection control before the Time period "Time" in the Time setting control group 242 is selected, the start Time in the Time period search condition may be input at the input field control after "From", and the end Time of the Time period search condition may be input at the input field control after "To".

The selection controls in the mode setting control group 241 and the time setting control group 242 may be a type with a number added in a square grid when selected, or a square grid type when not selected, and other types of the selected controls may also be applied thereto. Any one or all of the selection controls in the mode setting control group 241 and the time setting control group 242 may be selected, and after the selection of the selection controls is completed, the log search operation of the log to be processed may be triggered by clicking the search control 244 based on the input keyword search condition and/or the time period search condition. In addition, the historical search condition can be selected by clicking the historical search condition control 243, so that log search can be performed on the log to be processed according to the historical search condition.

Fig. 3 is a schematic diagram of a second interface in a log processing method according to a first embodiment of the disclosure. Referring to fig. 3, the second interface may include the following regions: a graphical control's associated information presentation area 310 and a graphical control presentation area 320.

In the area 310, the title "Frequencytrace" of the second interface may be displayed on the top, and in the actual application scenario, the title of the second interface is not limited to the title.

The "selected time from to x" at the bottom of the area 310 may characterize a first time period that the selected point in the line drawing control is mapped to the horizontal axis, e.g., "selected time from 15: 53: 20.000to 15: 54: 20.000 "may characterize that the first period of time that the selected point in the line drawing control maps to the horizontal axis is from 15: 53: 20.000to 15: 54: a time period of between 20.000. The first time period may be considered as a time interval between two adjacent time points on the left and right of the selected point among the plurality of time points displayed on the horizontal axis of the line drawing control.

"frequency count at the bottom of region 310: xxx "may characterize a first numerical value of the line graph control that maps the selected point to the vertical axis, such as" frequency count: 192 "may characterize that the first numerical value mapped to the vertical axis by the selected point in the line drawing control is 192.

The "Aggregation time interval" at the bottom of the area 310 may represent a time interval between two adjacent time points in the horizontal axis of the current line graph control, and the time interval may be preset to any one of a plurality of values, for example, may be preset to any one of 100ms, 1s, 20s, 1min, 10min, 30min, and 1hour, and the number of the preset plurality of values and a specific size of each value are not limited herein.

In some implementation manners, when the time interval is too small, in order to avoid overlapping of time points marked on the horizontal axis of the graphical control, only a part of the time points can be selected and marked on the horizontal axis, so as to realize clear display of the horizontal axis of the graphical control. However, in this case, the corresponding point in each time interval needs to remain in the graphical control, so that the user can know the number of logs corresponding to each time interval.

The time interval displayed in the input control after the "Aggregation time interval" may be linked with the time interval between two adjacent time points in the horizontal axis in the line graph control, that is, may be increased or decreased simultaneously. For example, when the time interval set in the input control after the "Aggregation time interval" is adjusted up to 10min from 1min in the figure, the time interval between two adjacent time points in the horizontal axis of the line graph control may be changed to 10min, and the line graph control may be redrawn according to the number of logs in the changed time interval. For another example, when a certain point in the polyline control is subjected to focus refinement, the time interval between two adjacent time points in the horizontal axis of the polyline control can be reduced from 1min in the figure to 20s, and the time interval input into the control after "Aggregation time interval" can be automatically adjusted to 20 s.

The "Time-range from × to ×" at the bottom of the area 310 may represent a Time period range corresponding to the Time period search condition, and generally the Time period range is included in the range from the leftmost Time point to the rightmost Time point of the horizontal axis in the current line drawing control. After the values in the input controls in the "Aggregation Time interval" and the "Time-range from × to ×" are reset, the "Done" control is triggered, the line graph control can be drawn according to the reset values, so that the Time-range search condition is input again on the second interface, the step of returning to the first interface to set the search condition is saved, and the user experience is improved.

In the area 320, a line graph control, a horizontal axis Time of the line graph control, and a vertical axis Count of the line graph control are displayed. The line graph control comprises a plurality of points, each point can be mapped to a horizontal axis as a first time period and mapped to a vertical axis as a first numerical value, and each point can represent that the number of logs searched in the corresponding first time period is the corresponding first numerical value.

According to the technical scheme of the embodiment of the disclosure, log search is carried out on the log to be processed based on the received log search condition, wherein the log to be processed is imported through a first interface; and displaying the search result by using the graphical control in the second interface, and controlling the graphical control to perform interactive action according to the interactive instruction. According to the search condition, searching the log to be processed imported from the first interface, and obtaining a demand log hitting the search condition; and compared with the traditional method for checking abnormal logs from plain texts, the log obtained by searching is displayed and interacted through the graphical control in the second interface, so that the log searching efficiency can be improved, and the user experience is improved.

Example two

The embodiments of the present disclosure and various alternatives in the log processing method provided in the above embodiments may be combined. The log processing method provided by the embodiment optimizes the scheme that the search condition is the keyword search condition, can search the log to be processed according to the search statement or the event name of the log, and enriches the log search mode.

In some optional implementation manners of the embodiment of the present disclosure, performing log search on a log to be processed based on a keyword search condition includes: and organizing the keywords according to a preset search grammar, and performing log search on the log to be processed according to the obtained search statement.

In the log search, the search sentences can be supported in the first interface to be organized with & & (semantic: and) and | (semantic: or) and English parenthesis () indicating priority and the like as preset search syntax.

The log search of the log to be processed according to the obtained search statement may include, for example: analyzing the search statement into lexical units, wherein the lexical units comprise operational characters and keywords; and generating a syntax tree according to the operational characters and the keywords, and performing log search on the log to be processed based on the syntax tree.

For example, assuming that the log to be searched contains log lines of both character 1 and character 2, and character 1 and character 3, the search statement may be: 1& (2| | 3). Fig. 4 is a schematic diagram illustrating syntax tree generation in a log processing method according to a second embodiment of the disclosure. In fig. 4, the steps of parsing a search sentence input by a user and generating a syntax tree are explained by taking the search sentence 1& & (2| |3) as an example.

First, the search sentence is parsed into a set of lexical units, i.e., 1& (2| |3) will be parsed into a set of 7 lexical units of '1', '&', '(', '2', '|', '3', ')'.

And then, respectively acquiring lexical units from left to right, and pressing the acquired grammar units into corresponding keyword stacks or operator stacks. Referring to fig. 4, after the lexical unit is pushed, 1, 2, and 3 are sequentially pushed into the keyword stack; the operator stack pushes &, (, |,) in turn. In addition, in the process of pushing, if a left bracket is pressed in the operator stack, when the stack is continuously pushed to a right bracket, brackets in the operator stack and the operator in the brackets can be popped out, meanwhile, because the brackets do not participate in the construction of the syntax tree, and the binary property of the operator | |, two

numbers

3 and 2 can be popped out from the key stack in sequence, and according to the construction principle of the syntax tree, the popped-out 3 can be set as the right value of the operator | | |, and the popped-out 2 is set as the left value of the operator | | |, so that a small syntax tree is generated.

The generated small grammar number may then be pushed onto the key stack and the push may proceed.

And finally, when the stack pushing is finished, performing final stack popping, namely popping all the operators, the keywords and the small syntax trees, and constructing a final syntax tree. Referring to fig. 4, the operator & & pops up in the operator stack, small syntax trees and 1 are sequentially popped up from the key stack, and according to the construction principle of the syntax trees, the small syntax tree popped up first may be set as a right value of the operator & & and the 1 popped up later may be set as a left value of the operator & & to generate a final syntax tree.

Wherein each operator may be set with a priority, e.g., the priority of & & is greater than | |. In the process of pushing the lexical units, when an operator stack is not provided with brackets, the priority of the operator stack is ensured to be increased from bottom to top every time the operator is pushed into the operator stack, if the priority of a newly pushed operator is smaller than the priority of an existing operator in the operator stack, all high-priority operators in all the operator stacks need to be popped up, and finally the current operator is pushed into the operator stack, so that the accuracy of constructing the syntax tree is ensured. In the process of pushing lexical units, when the operators are in brackets in the operator stack, the operators in the brackets can not be compared with the pushed operators in priority.

After the syntax tree is generated, when the logs are searched, all log lines can be traversed, whether the semantics of each log line are met is checked according to the semantics of the syntax tree, and if the semantics of each log line are met, the log lines can be written into the target log, so that the log search of hit search sentences is realized.

In these further implementations, direct searching of the log to be processed can be achieved by performing a log search on the log to be processed according to the obtained search statement.

In some optional implementation manners of the embodiment of the present disclosure, based on the keyword search condition, performing log search on the log to be processed, which may further include: and classifying the logs to be processed according to the event names, and searching classification results according to the target event names.

The first interface may also be an interface that presents automated analysis log results when searching for logs. The automatic analysis log may be a log obtained by classifying and sorting all logs according to service types (i.e., event names) by taking a protocol agreed between a cross-platform layer and an upstream and a downstream (client and server) as a core, so as to search a classification result according to a target event name input by a user, thereby assisting the user in efficiently locating a demand log.

The classifying of the log to be processed according to the event name may include: according to the preset communication format of the communication layer, analyzing the communication content of the log to be processed belonging to the communication layer; and determining event names according to the analyzed communication contents, and classifying the logs to be processed with the same event name into one class.

For example, fig. 5 is a schematic diagram of a communication architecture in a log processing method according to a second embodiment of the disclosure. The communication architecture shown in fig. 5 is a three-stage architecture, and includes three layers, i.e., a client, an intermediate layer and a server, where each two layers includes a communication layer therebetween, and each two layers communicates according to a communication format agreed by the communication layers between the two layers, e.g., the client communicates with the intermediate layer according to a protocol a of the communication layers between the two layers, and the intermediate layer communicates with the server according to a protocol B of the communication layers between the two layers.

The method comprises the steps of analyzing logs with fixed formats left by each communication layer, automatically analyzing communication contents between each two layers, then performing aggregation classification on all logs according to unique identification (which can be called as event names or commands) of communication types corresponding to the communication contents, and finally generating a list with the commands as a core. The communication log between the client and the middle layer can be used for generating a command list, and the communication log between the middle layer and the server can be used for generating another command list, so that log searching is further facilitated. Furthermore, the classification result can be searched according to the input target event name, namely, the current command list can be searched by the command input by the user so as to find the log of the corresponding service.

When the corresponding service log is found, the log can be directly opened by clicking the found command entry, a graphical control can be generated according to the found log, and the log is opened according to the interaction with the graphical control, so that the log searching mode is more flexible.

In the further implementation modes, the classification result is searched according to the target event name, so that indirect search of the log to be processed can be realized, log search modes are enriched, and log search under more scenes is met.

According to the technical scheme of the embodiment of the disclosure, the scheme that the search condition is the keyword search condition is optimized, the log to be processed can be searched according to the search grammar or the event name of the log, and the log search mode is enriched. In addition, the log processing method provided by the embodiment of the present disclosure and the log processing method provided by the above embodiment belong to the same technical concept, and the technical details that are not described in detail in the embodiment can be referred to the above embodiment, and the same technical features have the same beneficial effects in the embodiment and the above embodiment.

EXAMPLE III

The embodiments of the present disclosure and various alternatives in the log processing method provided in the above embodiments may be combined. The log processing method provided by the embodiment optimizes the interaction action of the graphical control controlled according to the interaction instruction, can realize the interaction of focusing, returning, log opening and the like with the graphical control, and can greatly improve the positioning and troubleshooting efficiency of abnormal logs based on a graphical interaction mode.

Fig. 6 is an interaction diagram of a line graph control in a log processing method according to a third embodiment of the present disclosure. The interfaces shown in fig. 6 (a) and (b) are both second interfaces, and the graphical control in the second interface is, for example, a line graph control.

Referring to fig. 6, controlling the graphical control to perform an interactive action according to the interactive instruction may include: in the (a) diagram interface, a mouse arrow clicks a Focus on operation entry of a point a on a line diagram control, so that a focusing instruction of the point a can be generated, and in response to the focusing instruction of the point a on the line diagram control, a first time period [ 15: 53: 20.000, 15: 54: 20.000] is subdivided into (b) a plurality of second time periods in the graph interface [ 15: 53: 20.000, 15: 53: 40.000], [ 15: 53: 40.000, 15: 54: 00.000] and [ 15: 54: 00.000, 15: 54: 20.000], in order to clearly display the line graph control corresponding to each second time period and optimize the display effect of the line graph control, the first time period can be amplified; and (c) redrawing the line drawing control in the first time period according to the logs obtained by searching based on the search condition and the corresponding number of the logs in each second time period to obtain the line drawing control in the graph interface (b).

In addition, the focusing instruction of the point B in the graph interface can be continuously responded to (B), and the second time period corresponding to the point B is taken as a new first time period to be subdivided into a new plurality of second time periods; and redrawing the line drawing control in the new first time period according to the corresponding log number in each new second time period until the time interval between two adjacent time points in the horizontal axis in the line drawing control reaches the minimum interval.

The points (such as the points with the obviously larger Count value) with obvious abnormality in the polyline graph control are selected, and after specific points are selected, the selected points are subjected to Focus on operation, namely, the time period corresponding to the points is further subdivided, so that the method is favorable for quickly positioning and checking the abnormal logs.

Referring to fig. 6 again, controlling the graphical control to perform an interactive action according to the interactive instruction may also include: in the (B) diagram interface, clicking the Go back operation item of the point B on the line diagram control by a mouse arrow to generate a return instruction of the point B, and responding to the return instruction of the point on the redrawn line diagram to restore the redrawn line diagram control to the line diagram control in the (a) diagram interface before redrawing.

The operation of "Go Back" may be regarded as an inverse operation of the operation of "Focus on", and accordingly, the redrawn line graph control is restored to the line graph control before redrawing, and the plurality of second time periods in the graph (b) may be merged into the first time period in the graph (a), and the points on the line graph control are redrawn according to the number of logs corresponding to each first time period. The control of the line graph in the previous step can be quickly returned through the operation of 'Go Back', and the repeated log checking operation is facilitated.

Referring to fig. 6 again, controlling the graphical control to perform an interactive action according to the interactive instruction may further include: (a) in the graph or (B), a mouse arrow clicks an Open log operation entry of a point a or a point B on a line graph control, a log opening instruction of the point a or the point B can be generated, in response to the log opening instruction of the point a on the line graph control, log information corresponding to the point a is presented on a third interface, in response to the log opening instruction of the point B on the line graph control, the log information corresponding to the point B is presented on the third interface. The log information includes, for example, text content of the log, and may further include displaying an analysis result of the log, for example, a total line number of the log, or labeling an analysis result such as a keyword and an event name of each line of the log. The log information of each log text corresponding to the selected point in the line graph control can be presented through Open log operation, and abnormal logs can be checked.

For convenience of description, the embodiments of the present disclosure take a line graph control as an example, and describe the control of the interaction action of the line graph control according to the interaction instruction. However, it should be understood that other graphical elements besides the above may be used, and are not limited to the line drawing control.

According to the technical scheme of the embodiment of the invention, the interaction action of controlling the line graph control according to the interaction instruction is optimized, the interaction such as focusing, returning, log opening and the like with the line graph control can be realized, and the positioning and troubleshooting efficiency of the abnormal log can be greatly improved based on a graph interaction mode. In addition, the log processing method provided by the embodiment of the present disclosure and the log processing method provided by the above embodiment belong to the same technical concept, and the technical details that are not described in detail in the embodiment can be referred to the above embodiment, and the same technical features have the same beneficial effects in the embodiment and the above embodiment.

Example four

Fig. 7 is a schematic structural diagram of a log processing apparatus according to a fourth embodiment of the disclosure. The log processing device provided by the embodiment is suitable for the condition of searching the demand log from a large amount of logs.

As shown in fig. 7, the log processing apparatus includes:

the searching module 710 is configured to, in response to receiving a log searching condition, perform log searching on a log to be processed based on the log searching condition, where the log to be processed is imported through a first interface;

and the display interaction module 720 is configured to display the search result by using the graphical control in the second interface, and control the graphical control to perform an interaction action according to the interaction instruction.

In some optional implementations of the embodiments of the present disclosure, the search module may be specifically configured to: and performing log search on the log to be processed based on the keyword search condition and/or the time period search condition.

In some optional implementations of the embodiments of the present disclosure, the search module includes:

the keyword search submodule is used for performing log search on the logs to be processed based on the keyword search condition;

the keyword search sub-module may further include:

and the first keyword searching unit is used for organizing keywords according to preset searching grammar and carrying out log searching on the log to be processed according to the obtained searching sentence.

In some further implementation manners of the embodiments of the present disclosure, the first keyword search unit may be specifically configured to parse the search statement into lexical units, where the lexical units include operators and keywords; and generating a syntax tree according to the operational characters and the keywords, and performing log search on the log to be processed based on the syntax tree.

In some optional implementation manners of the embodiment of the present disclosure, the keyword search sub-module may further include:

and the second keyword searching unit is used for classifying the logs to be processed according to the event names and searching the classified results according to the target event names.

In some further implementation manners of the embodiments of the present disclosure, the second keyword search unit may be specifically configured to perform communication content analysis on a log to be processed belonging to a communication layer according to a preset communication format of the communication layer; and determining event names according to the analyzed communication contents, and classifying the logs to be processed with the same event name into one class.

In some optional implementations of embodiments of the present disclosure, the presentation interaction module includes:

the interaction submodule is used for responding to a focusing instruction of a point on the graphical control element and subdividing a corresponding first time period into a plurality of second time periods; and redrawing the graphical control in the first time period according to the number of the logs corresponding to each second time period.

In some optional implementations of the embodiment of the present disclosure, the interaction submodule may be further configured to restore the redrawn graphical control to the graphical control before redrawing in response to a return instruction of the point on the redrawn graphical control.

In some optional implementation manners of the embodiment of the present disclosure, the interaction sub-module may be further configured to present, on the third interface, corresponding log information in response to a log opening instruction of a point on the graphical control element.

In some optional implementation manners of the embodiments of the present disclosure, the log processing apparatus is applied to a log processing application program, and the log to be processed includes an operation log of the target application program and/or an interaction log between the target application program and a server corresponding to the target application program.

The log processing device provided by the embodiment of the disclosure can execute the log processing method provided by any embodiment of the disclosure, and has corresponding functional modules and beneficial effects of the execution method.

It should be noted that, the units and modules included in the apparatus are merely divided according to functional logic, but are not limited to the above division as long as the corresponding functions can be implemented; in addition, specific names of the functional units are only used for distinguishing one functional unit from another, and are not used for limiting the protection scope of the embodiments of the present disclosure.

EXAMPLE five

Referring now to fig. 8, a schematic diagram of an electronic device (e.g., a terminal device or a server in fig. 8) 800 suitable for implementing embodiments of the present disclosure is shown. The terminal device in the embodiments of the present disclosure may include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a vehicle terminal (e.g., a car navigation terminal), and the like, and a stationary terminal such as a digital TV, a desktop computer, and the like. The electronic device shown in fig. 8 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present disclosure.

As shown in fig. 8, electronic device 800 may include a processing device (e.g., central processing unit, graphics processor, etc.) 801 that may perform various appropriate actions and processes in accordance with a program stored in a Read-Only Memory (ROM) 802 or a program loaded from a storage device 808 into a Random Access Memory (RAM) 803. In the RAM 803, various programs and data necessary for the operation of the electronic apparatus 800 are also stored. The processing apparatus 801, the ROM802, and the RAM 803 are connected to each other by a bus 804. An input/output (I/O) interface 805 is also connected to bus 804.

Generally, the following devices may be connected to the I/O interface 805: input devices 806 including, for example, a touch screen, touch pad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; output devices 807 including, for example, a Liquid Crystal Display (LCD), speakers, vibrators, and the like; storage 808 including, for example, magnetic tape, hard disk, etc.; and a communication device 809. The communication means 809 may allow the electronic device 800 to communicate wirelessly or by wire with other devices to exchange data. While fig. 8 illustrates an electronic device 800 having various means, it is to be understood that not all illustrated means are required to be implemented or provided. More or fewer devices may alternatively be implemented or provided.

In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a non-transitory computer readable medium, the computer program containing program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication means 809, or installed from the storage means 808, or installed from the ROM 802. The computer program performs the above-described functions defined in the log processing method of the embodiment of the present disclosure when executed by the processing apparatus 801.

The electronic device provided by the embodiment of the present disclosure and the log processing method provided by the embodiment of the present disclosure belong to the same disclosure concept, and technical details that are not described in detail in the embodiment of the present disclosure may be referred to the embodiment of the present disclosure, and the embodiment of the present disclosure have the same beneficial effects.

EXAMPLE six

The disclosed embodiments provide a computer storage medium having stored thereon a computer program that, when executed by a processor, implements the log processing method provided by the above-described embodiments.

It should be noted that the computer readable medium in the present disclosure can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a Read-Only Memory (ROM), an Erasable Programmable Read-Only Memory (EPROM) or FLASH Memory (FLASH), an optical fiber, a portable compact disc Read-Only Memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In contrast, in the present disclosure, a computer readable signal medium may comprise a propagated data signal with computer readable program code embodied therein, either in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, optical cables, RF (radio frequency), etc., or any suitable combination of the foregoing.

In some embodiments, the clients, servers may communicate using any currently known or future developed network Protocol, such as HTTP (Hyper Text Transfer Protocol), and may interconnect with any form or medium of digital data communication (e.g., a communications network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the Internet (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed network.

The computer readable medium may be embodied in the electronic device; or may exist separately without being assembled into the electronic device.

The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to:

responding to the received log searching condition, and performing log searching on the log to be processed based on the log searching condition, wherein the log to be processed is imported through a first interface; and displaying the search result by using the graphical control in the second interface, and controlling the graphical control to perform interactive action according to the interactive instruction.

Computer program code for carrying out operations for the present disclosure may be written in any combination of one or more programming languages, including but not limited to an object oriented programming language such as Java, Smalltalk, C + +, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units described in the embodiments of the present disclosure may be implemented by software or hardware. The names of the units and modules do not limit the units and modules in some cases, and for example, the data generation module may be described as a "video data generation module".

The functions described herein above may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), an Application Specific Standard Part (ASSP), a System On Chip (SOC), a Complex Programmable Logic Device (CPLD), and the like.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

According to one or more embodiments of the present disclosure, [ example one ] there is provided a log processing method, the method including:

According to one or more embodiments of the present disclosure, [ example two ] there is provided a log processing method, further comprising:

in some optional implementation manners of the embodiment of the present disclosure, the performing log search on the to-be-processed log based on the log search condition includes:

and performing log search on the log to be processed based on the keyword search condition and/or the time period search condition.

According to one or more embodiments of the present disclosure, [ example three ] there is provided a log processing method, further comprising:

in some optional implementation manners of the embodiment of the present disclosure, performing log search on the to-be-processed log based on a keyword search condition includes:

and organizing keywords according to a preset search grammar, and performing log search on the log to be processed according to the obtained search statement.

According to one or more embodiments of the present disclosure, [ example four ] there is provided a log processing method, further comprising:

in some optional implementation manners of the embodiment of the present disclosure, the performing log search on the log to be processed according to the search statement includes:

analyzing the search statement into lexical units, wherein the lexical units comprise operational characters and keywords;

and generating a syntax tree according to the operational characters and the keywords, and performing log search on the log to be processed based on the syntax tree.

According to one or more embodiments of the present disclosure, [ example five ] there is provided a log processing method, further comprising:

in some optional implementation manners of the embodiments of the present disclosure, the performing log search on the to-be-processed log based on a keyword search condition further includes:

and classifying the logs to be processed according to the event names, and searching classification results according to the target event names.

According to one or more embodiments of the present disclosure, [ example six ] there is provided a log processing method, further comprising:

in some optional implementation manners of the embodiments of the present disclosure, the classifying the to-be-processed log according to the event name includes:

according to a preset communication format of a communication layer, analyzing the communication content of the log to be processed belonging to the communication layer;

and determining event names according to the analyzed communication contents, and classifying the logs to be processed with the same event name into one class.

According to one or more embodiments of the present disclosure, [ example seven ] there is provided a log processing method, further comprising:

in some optional implementations of the embodiment of the present disclosure, the graphical control includes a point, the point is mapped to a horizontal axis of the graphical control as a first time period, and is mapped to a vertical axis of the graphical control as a first numerical value, and the point represents that the number of logs corresponding to the point in the first time period is the first numerical value.

According to one or more embodiments of the present disclosure, [ example eight ] there is provided a log processing method, further comprising:

in some optional implementation manners of the embodiment of the present disclosure, controlling the graphical control to perform an interactive action according to the interactive instruction includes:

in response to a focusing instruction of a point on the graphical control, subdividing a first time period corresponding to the point into a plurality of second time periods;

and redrawing the graphical control in the first time period according to the number of the logs corresponding to each second time period.

According to one or more embodiments of the present disclosure, [ example nine ] there is provided a log processing method, further comprising:

and responding to a return instruction of the point on the redrawn graphical control, and restoring the redrawn graphical control into the graphical control before redrawing.

According to one or more embodiments of the present disclosure, [ example ten ] there is provided a log processing method, further comprising:

and responding to a log opening instruction of a point on the graphical control, and presenting log information corresponding to the point on a third interface.

According to one or more embodiments of the present disclosure, [ example eleven ] there is provided a log processing method, further comprising:

in some optional implementation manners of the embodiments of the present disclosure, the log processing application is applied to a log processing application, where the log to be processed includes an operation log of a target application and/or an interaction log between the target application and a server corresponding to the target application.

The foregoing description is only exemplary of the preferred embodiments of the disclosure and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the disclosure herein is not limited to the particular combination of features described above, but also encompasses other embodiments in which any combination of the features described above or their equivalents does not depart from the spirit of the disclosure. For example, the above features and (but not limited to) the features disclosed in this disclosure having similar functions are replaced with each other to form the technical solution.

Further, while operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while several specific implementation details are included in the above discussion, these should not be construed as limitations on the scope of the disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A log processing method, comprising:

2. The method according to claim 1, wherein the performing a log search on the to-be-processed log based on the log search condition comprises:

3. The method of claim 2, wherein performing a log search on the to-be-processed log based on a keyword search condition comprises:

4. The method of claim 3, wherein the performing a log search on the log to be processed according to the obtained search statement comprises:

5. The method of claim 2, wherein the log search is performed on the to-be-processed log based on a keyword search condition, and further comprising:

6. The method according to claim 5, wherein the classifying the to-be-processed log according to event name comprises:

7. The method of claim 1, wherein the graphical control comprises points, the points are mapped to a horizontal axis of the graphical control as a first time period and mapped to a vertical axis of the graphical control as a first numerical value, and the points represent a corresponding log number in the first time period as the first numerical value.

8. The method of claim 7, wherein controlling the graphical control to perform an interactive action according to the interactive instruction comprises:

and redrawing the points on the graphical control in the first time period according to the number of the logs corresponding to each second time period.

9. The method of claim 8, wherein controlling the graphical control to perform an interactive action according to the interactive instruction comprises:

10. The method of claim 7, wherein controlling the graphical control to perform an interactive action according to the interactive instruction comprises:

11. The method according to any one of claims 1 to 10, wherein the method is applied to a log processing application program, and the log to be processed comprises an operation log of a target application program and/or an interaction log between the target application program and a server corresponding to the target application program.

12. A log processing apparatus, comprising:

13. An electronic device, characterized in that the electronic device comprises:

one or more processors;

a storage device for storing one or more programs,

when executed by the one or more processors, cause the one or more processors to implement the log processing method of any of claims 1-11.

14. A storage medium containing computer-executable instructions for performing the method of log processing as claimed in any one of claims 1 to 11 when executed by a computer processor.