CN119046465A

CN119046465A - Log classification method, device, equipment, storage medium and computer program product

Info

Publication number: CN119046465A
Application number: CN202411185292.0A
Authority: CN
Inventors: 刘成宋; 徐雪梅; 姚澜
Original assignee: China Merchants Bank Co Ltd
Current assignee: China Merchants Bank Co Ltd
Priority date: 2024-08-27
Filing date: 2024-08-27
Publication date: 2024-11-29

Abstract

The application discloses a log classification method, a device, equipment, a storage medium and a computer program product, and relates to the technical field of log processing. In the application, the keyword matching algorithm is created by the business party according to the requirements, so that the problem of efficiency reduction caused by the fact that the accuracy of the current classification algorithm cannot reach hundred percent and manual intervention classification is required can be solved, and the accuracy and the efficiency of log classification are improved.

Description

Log classification method, device, equipment, storage medium and computer program product

Technical Field

The present application relates to the field of log processing technologies, and in particular, to a log classification method, apparatus, device, storage medium, and computer program product.

Background

With the popularity of computers, log monitoring systems are becoming more common. However, the log classification thought based on the machine learning algorithm or the large model cannot guarantee 100% of accuracy of the classification result, has classification errors, is greatly influenced by dirty data and deviation data, and has a scene of manually identifying error data in the process of using the classification log, so that time and labor are consumed. Meanwhile, due to the black box characteristics in the algorithm, the classification process lacks visualization, and the adjustment and configuration of the appointed direction are difficult to carry out according to the business thought.

The foregoing is provided merely for the purpose of facilitating understanding of the technical solutions of the present application and is not intended to represent an admission that the foregoing is prior art.

Disclosure of Invention

The application mainly aims to provide a log classification method, a device, equipment, a storage medium and a computer program product, and aims to solve the technical problem that the existing log classification method is low in accuracy.

In order to achieve the above object, the present application provides a log classification method, which includes:

Receiving exception log data;

and classifying the abnormal log data based on a pre-established keyword matching algorithm to obtain a log classification result.

In an embodiment, before the step of classifying the abnormal log data based on the pre-created keyword matching algorithm to obtain the log classification result, the method further includes:

Receiving a keyword priority setting instruction;

and creating the keyword matching algorithm according to the keyword priority setting instruction based on a preset priority setting strategy.

In an embodiment, the step of creating the keyword matching algorithm based on the preset priority configuration policy according to the keyword priority setting instruction includes:

analyzing the keyword priority setting instruction to obtain priority data;

based on the priority configuration strategy, performing priority setting on preset initial keyword data according to the priority data to obtain priority keyword data;

and creating the keyword matching algorithm according to the priority keyword data.

In an embodiment, the step of classifying the abnormal log data based on a pre-created keyword matching algorithm to obtain a log classification result includes:

Performing index classification on the abnormal log data based on a preset index classification algorithm to obtain time-based index data and interruption-based index data;

Performing keyword matching according to the interrupt index data based on the keyword matching algorithm to obtain a keyword matching result;

and obtaining the log classification result according to the time-lapse class index data and the keyword matching result.

In an embodiment, the keyword matching algorithm includes a plurality of parallel keywords and non-parallel keywords, and the step of obtaining a keyword matching result based on the keyword matching algorithm and according to the interrupt index data includes:

splitting the parallel keywords to obtain split keywords;

according to the keyword priority configuration data in the keyword matching algorithm, carrying out priority positive sequence sequencing on a plurality of split keywords and non-parallel keywords to obtain a keyword sequence to be matched;

and sequentially matching the interrupt index data with the keywords to be matched in the keyword sequence to be matched to obtain the keyword matching result.

In an embodiment, the log classification result includes a keyword matching result, where the keyword matching result includes classified interrupt class index data and unassigned interrupt class index data, and the step of classifying the abnormal log data based on a keyword matching algorithm created in advance to obtain a log classification result further includes:

generating a front-end log monitoring interface according to preset front-end error report log data;

Based on a preset electronic chart visual interface, generating a classified interrupt type index monitoring interface according to the classified interrupt type index data;

generating an unassigned interrupt index monitoring interface according to the unassigned interrupt index data;

And generating an abnormal log monitoring interface according to the front-end log monitoring interface, the classified interrupt index monitoring interface and the unassigned interrupt index monitoring interface so as to display and monitor the abnormal log data.

In addition, in order to achieve the above object, the present application also provides a log classifying device, including:

The receiving module is used for receiving the abnormal log data;

and the classification module is used for classifying the abnormal log data based on a pre-established keyword matching algorithm to obtain a log classification result.

In addition, in order to achieve the above object, the present application also proposes a log sorting device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the log sorting method as described above.

In addition, to achieve the above object, the present application also proposes a storage medium that is a computer-readable storage medium, on which a computer program is stored, which when executed by a processor implements the steps of the log sorting method as described above.

Furthermore, to achieve the above object, the present application also provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the log sorting method as described above.

The application provides a log classifying method, which classifies abnormal log data through a keyword matching algorithm, wherein the keyword matching algorithm is created by a service party according to requirements, so that the problem of efficiency reduction caused by the fact that the accuracy of the current classifying algorithm cannot reach hundred percent, which requires human intervention, is solved, and the accuracy and the efficiency of log classification are improved.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the application and together with the description, serve to explain the principles of the application.

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following description will briefly explain the drawings used in the embodiments or the description of the prior art, and it will be obvious to those skilled in the art that other drawings can be obtained according to these drawings without inventive effort.

FIG. 1 is a schematic flow chart of a log classification method according to an embodiment of the present application;

FIG. 2 is a schematic diagram of contents of exception log data according to a first embodiment of the present application;

FIG. 3 is a flowchart of a create priority algorithm according to a first embodiment of the present application;

FIG. 4 is a flowchart of a monitoring interface for generating an abnormal log according to a first embodiment of the present application;

FIG. 5 is a schematic flow chart of a log classification method according to a second embodiment of the present application;

Fig. 6 is a schematic flow chart of log classification based on a keyword matching algorithm according to a second embodiment of the present application;

FIG. 7 is a system architecture diagram of the log categorization method provided by the present application;

FIG. 8 is a schematic block diagram of a log classification device according to an embodiment of the present application;

Fig. 9 is a schematic device structure diagram of a hardware operating environment related to a log classification method according to an embodiment of the present application.

The achievement of the objects, functional features and advantages of the present application will be further described with reference to the accompanying drawings, in conjunction with the embodiments.

Detailed Description

It should be understood that the specific embodiments described herein are merely illustrative of the technical solution of the present application and are not intended to limit the present application.

For a better understanding of the technical solution of the present application, the following detailed description will be given with reference to the drawings and the specific embodiments.

The main solutions of the embodiments of the present application are:

Receiving exception log data;

The prior art has the following problems:

1) The log content availability is low, the existing log monitoring system only stores abnormal logs so as to facilitate the positioning and tracking of problems, the maximum value of the log is only used for positioning the problems when an error occurs, the life cycle of the log is short, and the problem induction and summarization can not be carried out by using the error abnormal logs in the subsequent stage, so that the intrinsic value of the log is ignored and wasted.

2) The log user limitation is that the existing log system mainly covers technical logs, the user focus is mostly technical logs, the users are mostly technical developers, and availability information cannot be provided for service users. The exception problem tracked from the technology log alone cannot provide higher business value to product manager and system designer.

3) The log coverage is small, the main innovation point of the existing log system is the recording of the back-end abnormal log and the processing of the data content, the front-end embedded point system cannot monitor the reporting of errors of the back-end scene, meanwhile, the back-end log system cannot record the real-time reporting errors of a front-end user in the operation process, the problems of monitoring the logic errors of the system and recording the experience of the front-end user cannot be achieved, and the reporting errors of all scenes cannot be covered, so that the problem analysis and the summary of part of key scenes are omitted when the summary of the follow-up problems is caused.

4) The log personalized configuration is lacking, the existing log system is mostly matched with the log category according to the established mode, the classification category is fixed and single, the classification of the error log cannot be reclassified and classified after the experience summary is carried out on the basis of the existing data, and the user personalized configuration is not supported.

5) The log classification accuracy is low, 100% of accuracy of classification results cannot be guaranteed based on a machine learning algorithm or a large model log classification thought, classification errors exist, the influence of dirty data and deviation data is large, and a scene of manually identifying error data exists in the process of classifying logs, so that time and labor are consumed. Meanwhile, due to the black box characteristics in the algorithm, the classification process lacks visualization, and the adjustment and configuration of the appointed direction are difficult to carry out according to the business thought.

The application provides a solution, which classifies abnormal log data through a keyword matching algorithm, wherein the keyword matching algorithm is created by a business party according to requirements, so that the problem that the accuracy of the current classification algorithm cannot reach hundred percent, and the efficiency is reduced because the manual intervention classification is required is solved, and the accuracy and the efficiency of log classification are improved.

It should be noted that, the execution body of the embodiment may be a computing service device with functions of data processing, network communication and program running, such as a tablet computer, a personal computer, a mobile phone, or an electronic device, a log classification system, or the like, which can implement the above functions. The present embodiment and the following embodiments will be described below by taking a log classification system as an example.

Based on this, an embodiment of the present application provides a log classification method, referring to fig. 1, fig. 1 is a schematic flow chart of a first embodiment of the log classification method of the present application.

In this embodiment, the log classification method includes steps S10 to S20:

step S10, receiving abnormal log data;

it should be noted that, the abnormal log data refers to a log record that does not expect to occur or does not conform to the normal operation mode, and may involve an error, a warning, or other abnormal behavior.

Referring to fig. 2, fig. 2 is a schematic diagram illustrating contents of exception log data according to a first embodiment of the present application.

The log content of the abnormal log data covers the business logic errors of all transaction modules in the system group besides technical errors, and relates to signing, ordering, payment and other contents, and abnormal information is pushed according to a uniform format.

And step S20, classifying the abnormal log data based on a pre-established keyword matching algorithm to obtain a log classification result.

In a possible implementation manner, before step S20, steps S301 to S302 may further include:

step S301, receiving a keyword priority setting instruction;

step S302, based on a preset priority configuration strategy, the keyword matching algorithm is created according to the keyword priority setting instruction.

The log classification system receives keyword priority setting instructions, which may include keyword priority definition, priority order, special case processing, and the like, so that the efficiency and accuracy of the log classification system can be optimized, the fact that the keyword log information can be timely detected and processed by the system is ensured, and then a keyword matching algorithm is created according to the keyword priority setting instructions based on a preset priority configuration strategy, wherein the creation of the keyword matching algorithm may involve the aspects of keyword priority mapping, algorithm optimization and adjustment, real-time updating and monitoring, testing and verification, and the like.

In this embodiment, based on a preset priority configuration policy, a keyword matching algorithm is created and obtained according to a keyword priority setting instruction, and a key early-stage preparation and configuration are provided, so that it is ensured that the log classification system can accurately identify and classify abnormal log data according to priorities and set keywords.

In another possible embodiment, step S302 may include steps S3021 to S3023:

step S3021, analyzing the keyword priority setting instruction to obtain priority data;

step S3022, based on the priority configuration policy, performing priority setting on preset initial keyword data according to the priority data, to obtain priority keyword data;

Step S3023, creating the keyword matching algorithm according to the priority keyword data.

The log classification system parses received priority setting instructions, which may be transmitted in a specific format or protocol, the system parses the instructions into an operable data structure according to a specified format, extracts keywords and their corresponding priority data from the parsed instructions, the data may include strings of the keywords and priority values or identifiers associated therewith, and then adjusts and marks the preset initial keyword data according to the priority data based on a priority configuration policy. This may involve associating each keyword with its corresponding priority data to obtain priority keyword data, and the priority configuration policy may include determining which keywords need to be prioritized, how to assign weights or identifiers of different priorities, etc., and finally creating a keyword matching algorithm based on the priority keyword data.

Referring to fig. 3, fig. 3 is a schematic flow chart of a create priority algorithm according to a first embodiment of the present application.

In order to solve the scenario that the same error log may be matched with a plurality of keywords and thus be distributed to a plurality of index influencing factors, a priority matching strategy is introduced in the embodiment. The concrete explanation is as follows:

1) Defaulting to 0 level without taking into account interrupt statistics, and preferentially matching;

2) The inclusion interrupt statistics index is divided into 1-10 levels, 1 is the highest level, and 10 is the lowest level;

3) The priority can be repeatedly selected, if a plurality of index influence factors are set to be 1 level, the priority is ordered according to the creation time of the index influence factors, and the priority is firstly created and firstly hit;

4) If the priority is not required to be set, the default is 10.

In the embodiment, the log classification system can effectively realize the creation and optimization of the keyword matching algorithm according to the set priority configuration strategy, so that the efficiency and accuracy of log classification processing are improved.

In another possible implementation manner, the log classification result includes a keyword matching result, where the keyword matching result includes classified interrupt indicator data and unassigned interrupt indicator data, and after step S20, steps S401 to S404 may further include:

step S401, generating a front-end log monitoring interface according to preset front-end error report log data;

step S402, based on a preset electronic chart visualization interface, generating a classified interrupt class index monitoring interface according to the classified interrupt class index data;

Step S403, generating an unassigned interrupt index monitoring interface according to the unassigned interrupt index data;

and step S404, generating an abnormal log monitoring interface according to the front-end log monitoring interface, the classified interrupt index monitoring interface and the unassigned interrupt index monitoring interface so as to display and monitor the abnormal log data.

The log classification result comprises a keyword matching result, wherein the keyword matching result comprises classified interrupt index data and unassigned interrupt index data, a log classification system generates a front-end log monitoring interface according to preset front-end error report log data, generates a classified interrupt index monitoring interface according to the classified interrupt index data based on a preset electronic chart visualization interface, generates an unassigned interrupt index monitoring interface according to the unassigned interrupt index data, and generates an abnormal log monitoring interface according to the front-end log monitoring interface, the classified interrupt index monitoring interface and the unassigned interrupt index monitoring interface so as to display and monitor the abnormal log data, wherein the electronic chart visualization interface generally comprises various charts and graphs, such as a broken line chart, a columnar chart, a cake chart and the like, and is used for displaying various statistical information and trends of the classified interrupt index data.

Referring to fig. 4, fig. 4 is a schematic flow chart of an abnormality log monitoring interface according to an embodiment of the present application.

In order to facilitate statistics of service users, the embodiment is provided with a data visualization link and a policeman embedding mechanism aiming at front and rear end log classification results. Providing E-Chart visual interface for classified data and not logs without index, counting the number of accumulation times of the month and month in the form of histogram and accumulated line graph according to the index name dimension, increasing the drill-down granularity, counting the index influence factor composition and the duty ratio of each index in the form of ring graph for each index, providing interface detail data display for unassigned index, providing entrance for analyzing unassigned error report for service user, thereby monitoring error report full scene in real time, updating the configuration of the monitored index influence factors, and forming a link closed loop. Aiming at the front-end log, a front-end real-time error report log is obtained in a micro-embedded point form, and a front-end embedded point system is built through a nerve system to form a full-link monitoring system.

In the embodiment, the abnormal log monitoring system can effectively collect, classify and display abnormal events and logs in the system operation, provide real-time monitoring and analysis capability for a working team, be conductive to quick response and problem solving, and improve the reliability and stability of the system.

The embodiment provides a log classifying method, which classifies abnormal log data through a keyword matching algorithm, wherein the keyword matching algorithm is created by a service party according to requirements, so that the problem that the accuracy of the current classifying algorithm cannot reach hundred percent, and therefore the efficiency is reduced due to the fact that manual intervention classification is required, and the accuracy and the efficiency of log classification are improved.

In the second embodiment of the present application, the same or similar content as in the first embodiment of the present application may be referred to the above description, and will not be repeated. On this basis, referring to fig. 5, step S20 may further include steps S201 to S203:

Step S201, performing index classification on the abnormal log data based on a preset index classification algorithm to obtain time-effect type index data and interruption type index data;

step S202, keyword matching is carried out according to the interrupt index data based on the keyword matching algorithm, and a keyword matching result is obtained;

and step S203, obtaining the log classification result according to the time-lapse class index data and the keyword matching result.

It should be noted that, the time-efficient index data may indicate a general health state of system performance, such as request response time, resource utilization rate, etc., for example, count a processing residence time of a critical service, so as to analyze a processing link consuming more time and a processing time of an operator in a complete transaction link, thereby pertinently eliminating a service blocking point, improving transaction completion efficiency, where the interrupt index data generally indicates abnormal situations that need immediate attention and response, such as service interrupt, critical functional error, etc., for example, record information about a fault reporting of a critical service interrupt, where the information does not include an index, and the index is manually ignored by the service and is not used as data for subsequent problem analysis and refinement.

The log classification system classifies the abnormal log data based on a preset index classification algorithm to obtain time-lapse type index data and interrupt type index data, a keyword matching algorithm is used for checking each interrupt type index data, the algorithm can adopt a regular expression, character string matching or other text processing technology to ensure that the occurrence of a target keyword is accurately identified, and finally, the analysis of the time-lapse type index data and keyword matching results are combined to generate a final log classification result, wherein the log classification result usually classifies log events into different categories or priorities such as normal, warning, error and the like, and specific abnormal types or problem descriptions.

In one possible embodiment, step S202 may include steps S2021 to S2023:

step S2021, splitting a plurality of parallel keywords to obtain a plurality of split keywords;

Step S2022, according to the keyword priority configuration data in the keyword matching algorithm, performing priority positive sequence ordering on the plurality of split keywords and non-parallel keywords to obtain a keyword sequence to be matched;

Step S2023, matching the interrupt index data with the keywords to be matched in the keyword sequence to be matched in sequence, so as to obtain the keyword matching result.

The log classification system splits the already parallel keywords to obtain more split keywords, wherein the split keywords may be the processing performed by the diversity of specific terms or phrases or for more accurately matching different conditions in the log, the splitting of the keywords may comprise phrase splitting, synonym processing, technical term processing, variant processing and the like, then according to keyword priority configuration data in a keyword matching algorithm, the priority positive sequence ordering is performed on a plurality of split keywords and non-parallel keywords to obtain a keyword sequence to be matched, the priority configuration is usually based on specific requirements of business requirements or technical implementation, the most important or most relevant keywords can be preferentially processed during keyword matching, finally interrupt index data and the keywords to be matched in the keyword sequence to be matched are sequentially matched to obtain keyword matching results, and the process ensures that each log event passes through a detailed and ordered keyword matching process to determine whether any predefined keywords or phrases are contained.

Referring to fig. 6, fig. 6 is a schematic flow chart of log classification based on a keyword matching algorithm according to a second embodiment of the present application.

The key words are defined elements for matching the interrupt error reporting information sent by the service system, the service side defines according to the error reporting information of each system, and aiming at the configuration of the key words, the user still needs to define the error reporting system to which the key words belong and index influence factors and priorities to be matched. The risk of matching the same keyword to a plurality of business scenes can be reduced through double matching of the keyword and the error reporting system.

Because of the inexhaustibility of error reporting scenes, the index supports manual configuration, can be updated according to the change of service scenes, and has higher flexibility. Meanwhile, in order to enhance the data readability and facilitate the service users to understand the log data, the system complements the key fields of the log in a redis cache complement mode so as to further analyze key clients and key scenes.

The log classification algorithm analyzes all keywords of the system, sequentially and circularly traverses, and if the logs can be hit according to the keyword matching rule, the logs are successfully classified. The method comprises the steps of 1) classifying the message, namely classifying the message successfully, and having definite index influence factor attribution, 2) not including error reporting, namely classifying the message successfully but not having definite index influence factor attribution, 3) not distributing the message, namely classifying the message as 'not distributed' if the log fails to be matched with any index influence factor after the cycle traversal is finished, and then analyzing the unallocated log intensively by service personnel, wherein whether new error reporting indexes exist in the current service process or new interrupt reasons exist in the existing indexes to hinder the progress of the transaction process, so that the optimization of the system service transaction process is carried out aiming at specific error reporting. Specifically, the flow steps are as follows:

1) Circularly traversing the system configuration keywords;

2) Carrying out "+" splitting analysis on the keywords to form a plurality of "and" conditions;

3) Combining the result of the step 2) with an error reporting system to form a plurality of parallel judgment conditions;

4) The keywords are ordered in a priority positive sequence according to the dimension of the index influence factor;

5) Matching the log message with the keyword result sequence of the 4);

6) Matching hit, classifying the hit as an index influence factor, and outputting a result;

7) If 1) ends, the output result is "unassigned".

In the embodiment, the interrupt index data and the keywords to be matched in the keyword sequence to be matched are sequentially matched, so that a large amount of interrupt index data can be efficiently processed, key abnormal conditions in the system can be rapidly identified and responded, and the stability and reliability of the system are maintained.

The embodiment provides a log classifying method, which classifies abnormal log data through an index classifying algorithm and a keyword matching algorithm, not only can monitor the occurrence of the abnormal log data, but also can further analyze the content of the abnormal log data and provide more specific classification and key information, thereby being beneficial to a working team to manage and respond to the abnormal conditions of a system more effectively.

For an example, to facilitate understanding of the implementation flow of the log classification method obtained by combining the present embodiment with the first embodiment, please refer to fig. 7, fig. 7 provides a system architecture diagram of the log classification method, specifically:

the log classification system is divided into four parts, namely a business system pushes logs, data consumption analysis, log classification processing and user visualization.

In addition, in the business transaction process, part of error reporting log classification logic may change along with business logic change, in order to solve the problem of historical data classification updating, a daily final running mechanism is introduced in the embodiment of the application, if index maintenance change occurs on the index configuration table T, the processing state of a message is reset to a to-be-executed state, and a timing task is started to reclassify historical data when the daily final 03:00 is reached, so that the log classification result is ensured to meet the latest business logic requirement.

The embodiment of the application designs a log classification system based on keyword matching, wherein each service system triggers an error log to report to the system, the log information is received in quasi-real time through kafka, the complement of a key service field is carried out by utilizing a redis cache, and index influence factor classification on log content is completed in T+1 day. The index factors are divided into interrupt indexes and time-lapse indexes, wherein the interrupt indexes are convenient for service users to count interrupt times in the transaction process, analyze specific interrupt reasons to propose system product improvement suggestions and promote customer transaction fluency, and the time-lapse indexes are used for counting the completion time of key services so as to comb services which are not completed for a long time and work timeliness of operators, and find out service flow blocking points and issue medicines for symptoms.

Compared with the prior art, the method has the following advantages:

1. and fully mining available information of the logs, namely, monitoring key business scenes of banking transactions in a key way except for the technical logs, classifying the visual logs, knowing interrupt information and transaction efficiency in the process of client transactions, and solving the problems in an oriented way so as to improve the smoothness of the client transactions.

2. And covering front-end and back-end full-link monitoring scenes, namely establishing an abnormal monitoring system covering the front-end, the back-end, the full scene of the docking system and the full flow, carrying out abnormal information classification processing on the basis, timely finding out the defects of the system, providing a visual interface and analysis processing results, and improving the user friendliness.

3. The method for classifying the logs based on the keywords and the priority can accurately meet the requirements of service classification logs, and meanwhile, the method is high in interpretation and easy to understand for service users.

4. The user is supported to customize the configuration classification based on the artificial experience, namely, a configurable interface is supported to configure the user-defined index according to the existing log analysis result and the service scene, and the user is supported to configure according to the priority according to a plurality of influencing factors under the same index name.

It should be noted that the foregoing examples are only for understanding the present application, and are not meant to limit the log classification method of the present application, and more forms of simple transformation based on the technical concept are all within the scope of the present application.

The present application also provides a log classification device, please refer to fig. 8, which includes:

The receiving module is used for receiving the abnormal log data;

The log classifying device provided by the application can solve the technical problem of low accuracy of the existing log classifying method by adopting the log classifying method in the embodiment. Compared with the prior art, the log classifying device has the same beneficial effects as the log classifying method provided by the embodiment, and other technical features in the log classifying device are the same as the features disclosed by the method of the embodiment, and are not repeated herein.

The application provides log classifying equipment which comprises at least one processor and a memory in communication connection with the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the log classifying method in the first embodiment.

Referring now to FIG. 9, a schematic diagram of a log classification device suitable for use in implementing embodiments of the present application is shown. The log classifying device in the embodiment of the present application may include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (Personal DIGITAL ASSISTANT: personal digital assistant), a PAD (Portable Application Description: tablet computer), a PMP (Portable MEDIA PLAYER: portable multimedia player), an in-vehicle terminal (e.g., an in-vehicle navigation terminal), and the like, and a fixed terminal such as a digital TV, a desktop computer, and the like. The log classification apparatus shown in fig. 9 is only one example, and should not impose any limitation on the functions and the scope of use of the embodiment of the present application.

As shown in fig. 9, the log sorting apparatus may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which may perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access Memory (RAM: random Access Memory) 1004. In the RAM1004, various programs and data required for the operation of the log classification apparatus are also stored. The processing device 1001, the ROM1002, and the RAM1004 are connected to each other by a bus 1005. An input/output (I/O) interface 1006 is also connected to the bus. In general, a system including an input device 1007 such as a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc., an output device 1008 including a Liquid crystal display (LCD: liquid CRYSTAL DISPLAY), a speaker, a vibrator, etc., a storage device 1003 including a magnetic tape, a hard disk, etc., and a communication device 1009 may be connected to the I/O interface 1006. The communication means 1009 may allow the log classification device to communicate wirelessly or wired with other devices to exchange data. While log classification devices with various systems are shown in the figures, it should be understood that not all of the illustrated systems are required to be implemented or provided. More or fewer systems may alternatively be implemented or provided.

In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through a communication device, or installed from the storage device 1003, or installed from the ROM 1002. The above-described functions defined in the method of the disclosed embodiment of the application are performed when the computer program is executed by the processing device 1001.

The log classifying equipment provided by the application adopts the log classifying method in the embodiment, and can solve the technical problem of low accuracy of the existing log classifying method. Compared with the prior art, the log classifying device provided by the application has the same beneficial effects as the log classifying method provided by the embodiment, and other technical features in the log classifying device are the same as the features disclosed by the method of the previous embodiment, and are not repeated herein.

It is to be understood that portions of the present disclosure may be implemented in hardware, software, firmware, or a combination thereof. In the description of the above embodiments, particular features, structures, materials, or characteristics may be combined in any suitable manner in any one or more embodiments or examples.

The foregoing is merely illustrative of the present application, and the present application is not limited thereto, and any person skilled in the art will readily recognize that variations or substitutions are within the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

The present application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon for performing the log classification method in the above-described embodiments.

The computer readable storage medium provided by the present application may be, for example, a U disk, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, or device, or a combination of any of the foregoing. More specific examples of a computer-readable storage medium may include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access Memory (RAM: random Access Memory), a Read-Only Memory (ROM), an erasable programmable Read-Only Memory (EPROM: erasable Programmable Read Only Memory or flash Memory), an optical fiber, a portable compact disc Read-Only Memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In this embodiment, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, or device. Program code embodied on a computer readable storage medium may be transmitted using any appropriate medium, including but not limited to electrical wiring, fiber optic cable, RF (Radio Frequency) and the like, or any suitable combination of the foregoing.

The computer readable storage medium may be included in the log classification device or may exist alone without being incorporated in the log classification device.

The computer-readable storage medium carries one or more programs that, when executed by the log classification device, cause the log classification device to:

Receiving exception log data;

Computer program code for carrying out operations of the present application may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of remote computers, the remote computer may be connected to the user's computer through any kind of network, including a local area network (LAN: local Area Network) or a wide area network (WAN: wide Area Network), or may be connected to an external computer (for example, through the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The modules involved in the embodiments of the present application may be implemented in software or in hardware. Wherein the name of the module does not constitute a limitation of the unit itself in some cases.

The readable storage medium provided by the application is a computer readable storage medium, and the computer readable storage medium stores computer readable program instructions (namely computer programs) for executing the log classification method, so that the technical problem of low accuracy of the existing log classification method can be solved. Compared with the prior art, the beneficial effects of the computer readable storage medium provided by the application are the same as those of the log classification method provided by the above embodiment, and are not described herein.

The application also provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the log classification method as described above.

The computer program product provided by the application can solve the technical problem of low accuracy of the existing log classification method. Compared with the prior art, the beneficial effects of the computer program product provided by the application are the same as those of the log classification method provided by the above embodiment, and are not described herein.

The foregoing description is only a partial embodiment of the present application, and is not intended to limit the scope of the present application, and all the equivalent structural changes made by the description and the accompanying drawings under the technical concept of the present application, or the direct/indirect application in other related technical fields are included in the scope of the present application.

Claims

1. A log classification method, characterized in that the method comprises:

Receive abnormal log data;

Based on a pre-created keyword matching algorithm, the abnormal log data is classified to obtain a log classification result.

2. The method according to claim 1, characterized in that before the step of classifying the abnormal log data based on a pre-created keyword matching algorithm and obtaining the log classification result, it also includes:

receiving a keyword priority setting instruction;

Based on a preset priority configuration strategy, the keyword matching algorithm is created according to the keyword priority setting instruction.

3. The method according to claim 2, wherein the step of creating the keyword matching algorithm based on the preset priority configuration strategy and according to the keyword priority setting instruction comprises:

Parsing the keyword priority setting instruction to obtain priority data;

Based on the priority configuration strategy, according to the priority data, priority is set for the preset initial keyword data to obtain priority keyword data;

Based on the priority keyword data, the keyword matching algorithm is created.

4. The method according to claim 1, characterized in that the step of classifying the abnormal log data based on a pre-created keyword matching algorithm to obtain a log classification result comprises:

Based on a preset indicator classification algorithm, the abnormal log data is classified by indicators to obtain timeliness indicator data and interruption indicator data;

Based on the keyword matching algorithm, keyword matching is performed according to the interruption indicator data to obtain a keyword matching result;

The log classification result is obtained according to the timeliness indicator data and the keyword matching result.

5. The method according to claim 4, wherein the keyword matching algorithm includes a plurality of parallel keywords and non-parallel keywords, and the step of performing keyword matching based on the keyword matching algorithm and the interruption indicator data to obtain the keyword matching result comprises:

Splitting the plurality of parallel keywords to obtain a plurality of split keywords;

According to the keyword priority configuration data in the keyword matching algorithm, a plurality of the split keywords and the non-parallel keywords are sorted in positive order of priority to obtain a sequence of keywords to be matched;

The interruption indicator data is matched with the keywords to be matched in the keyword sequence to be matched in sequence to obtain the keyword matching result.

6. The method according to claim 1, wherein the log classification result includes a keyword matching result, the keyword matching result includes classified interruption indicator data and unassigned interruption indicator data, and after the step of classifying the abnormal log data based on a pre-created keyword matching algorithm and obtaining the log classification result, the method further includes:

Generate a front-end log monitoring interface based on the preset front-end error log data;

Based on a preset electronic chart visualization interface, generating a classified interruption indicator monitoring interface according to the classified interruption indicator data;

Generate an unallocated interruption indicator monitoring interface according to the unallocated interruption indicator data;

An abnormal log monitoring interface is generated according to the front-end log monitoring interface, the classified interruption indicator monitoring interface and the unassigned interruption indicator monitoring interface to display and monitor the abnormal log data.

7. A log classification device, characterized in that the device comprises:

A receiving module, used for receiving abnormal log data;

The classification module is used to classify the abnormal log data based on a pre-created keyword matching algorithm to obtain a log classification result.

8. A log classification device, characterized in that the device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the log classification method according to any one of claims 1 to 6.

9. A storage medium, characterized in that the storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium, and when the computer program is executed by a processor, the steps of the log classification method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the log classification method according to any one of claims 1 to 6 are implemented.