JP2018180979A - Log structure visualization device, log structure visualization method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To generate a display screen that makes it easy to understand the structure of logs.SOLUTION: A log structure visualization device including an acquisition unit configured to acquire log definition information written in text, and a generation unit configured to generate information for visualizing and displaying the structure of logs to be defined by the log definition information with reference to the log definition information acquired by the acquisition unit.SELECTED DRAWING: Figure 17

Description

  The present invention relates to a log structure visualization apparatus, a log structure visualization method, and a program.

  Various logs are collected on the network (see, for example, Patent Document 1). In addition, in the computer device, its own action log is stored.

JP, 2016-163140, A

  The logs can take on various structures. Although log definition information may be described in text, the definition information described in text may not be such that the structure can be understood at a glance when viewed by a person.

  The present invention has been made in consideration of such circumstances, and an object thereof is to generate a display screen with which the log structure can be easily understood.

  According to one aspect of the present invention, there is provided an acquisition unit for acquiring log definition information described in text, and a log structure defined by the log definition information based on the log definition information acquired by the acquisition unit. And a generation unit that generates information for visualizing and displaying the information.

  According to one aspect of the present invention, it is possible to generate a display screen with which the log structure can be easily understood.

It is a figure which shows an example of use environment of a log structure visualization apparatus. It is a figure which shows an example of the log 110. FIG. FIG. 6 is a diagram showing an example of schema definition information 120. It is a functional block diagram of the terminal device 10 in the case of functioning as a log structure visualization apparatus. It is a figure which shows an example of Screen IM based on the web page downloaded from the 2nd server 200. FIG. It is a figure which shows a mode that the structure of a log is visualized and displayed on Screen IM. It is a figure (the 1) showing an example of schema definition information containing an element difficult to be analyzed automatically. It is a figure which shows an example of the content of result display column A4 which the visualization information production | generation part 22 outputs based on the schema definition information shown in FIG. It is a figure which shows an example of the log corresponding to the schema definition information shown in FIG. It is a figure (1) which shows an example of the contents of result display column A4 by which a user performs addition and edit. It is a figure (the 2) showing an example of schema definition information containing an element difficult to be analyzed automatically. It is a figure which shows an example of the log corresponding to the schema definition information shown in FIG. It is a figure (the 2) showing an example of the contents of result display column A4 by which a user performs addition and edit. It is a figure (the 3) showing an example of schema definition information containing an element which can not be analyzed automatically. It is a figure which shows an example of the log corresponding to the schema definition information shown in FIG. It is a figure (the 3) showing an example of the contents of result display column A4 by which a user performs addition and edit. It is a flowchart which shows an example of the flow of the process performed by a log structure visualization apparatus.

  Hereinafter, embodiments of a log structure visualization device, a log structure visualization method, and a program of the present invention will be described with reference to the drawings. The log structure visualization device is realized by a program being installed on a computer having a processor. Here, installation includes not only permanent storage in a non-volatile storage device, but also a state in which a program (plug-in) attached to a web page is downloaded to a terminal device and temporarily executed. . In another aspect, the log structure visualization device may be a server device that provides a cloud service. In the following description, it is assumed that the terminal device that has downloaded the plug-in operates as a log structure visualization device. Moreover, although a terminal device shall be a personal computer provided with a keyboard and a mouse, it may be a smart phone or a tablet terminal operated by a touch panel.

  FIG. 1 is a diagram illustrating an example of a use environment of a log structure visualization device. For example, one or more terminal devices 10, a first server 100, and a second server 200 are connected to the illustrated network NW. The network NW includes, for example, a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, and the like.

  The terminal device 10 is a computer device used by a user, and includes a central processing unit (CPU) or other processor for executing a program.

  The first server 100 stores the log 110 in the storage unit. The first server 100 is, for example, a web server, and collects user logs, access logs, and the like as the logs 110. Further, the first server 100 stores, in the storage unit, schema definition information 120 which is definition information of the log 110 described in text. In the following description, the term “storage unit” refers to a part or all of various storage devices such as a hard disk drive (HDD), a flash memory, a random access memory (RAM), and a read only memory (ROM). It refers to the storage unit to be

FIG. 2 shows an example of the log 110. As shown in FIG. The first line of the log 110 shown in FIG. 2 is data updated to “timestamp” = “1”, that is, time “1” for a user with a user ID of “userid” = “a”, that is, “a”. Yes, “value” = “C ⁺⁺ ”, that is, the data of interest is “C ⁺⁺ ”. The log 110 shown in FIG. 2 is a log in which each user's favorite program language is collected.

  FIG. 3 is a diagram showing an example of the schema definition information 120. As shown in FIG. The schema definition information 120 is described in text. The schema definition information 120 shown in FIG. 3 includes “namespace” indicating the name of one schema definition information, “type” indicating the format of the target log 110, “name” indicating the name of the schema, and the structure of the log 110. It defines "fields" etc. shown by text string.

  Returning to FIG. 1, the second server 200 provides a web page 210 including a plug-in. Also, the second server 200 stores the log structure information 220 created by executing the plug-in in the storage unit.

  FIG. 4 is a functional configuration diagram of the terminal device 10 when functioning as a log structure visualization device. For example, the terminal device 10 includes a communication unit 12, an input unit 14, a display unit 16, a browser function unit 18, a schema definition information acquisition unit 20, a visualization information generation unit 22, an information management unit 24, and storage. And a unit 26.

  The communication unit 12 is a communication interface such as a network interface card (NIC) or a wireless communication module. The input unit 14 includes a keyboard, a mouse and the like. The display unit 16 is a liquid crystal display (LCD), an organic electroluminescence (EL) display device, or the like.

  The browser function unit 18 is realized by the processor executing a browser program stored in the storage unit 26. The browser function unit 18 acquires the web page from the link destination designated by the user, and causes the display unit 16 to display a screen based on the web page.

  The schema definition information acquisition unit 20, the visualization information generation unit 22, and the information management unit 24 are realized by the processor executing a plug-in attached to the web page. Hereinafter, these functions will be described by exemplifying a screen displayed by the display unit 16.

  FIG. 5 is a diagram showing an example of the screen IM based on the web page downloaded from the second server 200. As shown in FIG.

  On the screen IM, for example, as an input element for instructing a new analysis, a first input field A1 for directly inputting a reference destination of the schema definition information 120, and a reference destination of the schema definition information 120 are displayed in a selectable manner. A first reference specification switch S1 for the purpose, a log type specification switch S2 for specifying the type of log to be analyzed, and an analysis execution command switch S3 for instructing analysis execution are included. The type of log may not be specified by the user, but may be automatically determined by the visualization information generation unit 22. In this case, the visualization information generation unit 22 automatically determines the type of log based on a specific symbol or text string included in the schema definition information 120, or schema definition information or meta information embedded in the log. .

  Further, on the screen IM, for example, as an input element for instructing acquisition of the existing result, the second input field A2 for directly inputting the reference destination of the analysis result, and the reference destination of the analysis result are displayed in a selectable manner. A second reference specification switch S4 for importing the data and an import specification switch S5 for specifying import of the analysis result are included.

  The screen IM further includes a text box A3 and a result display field A4 for displaying the analysis result. In addition, since the state of FIG. 5 has shown the state before new analysis or existing result acquisition is performed, result display column A4 is blank.

New Analysis
The schema definition information 120 of the log for which the structure is to be analyzed (hereinafter referred to as the target log) is (1) by inputting the identification information of the storage destination folder of the first server 100 in the first input field A1, or (2) It is acquired by selecting one folder from list information of storage destination folders of the first server 100 displayed by operating the first reference designation switch S1. When any of the above operations is performed, the schema definition information acquisition unit 20 requests the first server 100 to transmit the corresponding schema definition information 120 and an example of the log 110 corresponding thereto. When the schema definition information 120 is acquired, the acquired log 110 and the schema definition information 120 are displayed in the text box A3.

  Note that, instead of such processing, the log and schema definition information (not acquired from the first server 100) may be directly input to the text box A3 by copy and paste or the like. Hereinafter, in order not to distinguish these, it is simply described as a log or schema definition information.

  When the analysis execution switch S3 is operated with the schema definition information displayed in the text box A3, the visualization information generation unit 22 visualizes the log structure defined by the schema definition information based on the schema definition information. Generate information for display. Specifically, the visualization information generation unit 22 generates information to be displayed in the result display field A4, and adds the information to the screen IM.

  In the case of the schema definition information illustrated in FIG. 3, for example, the visualization information generation unit 22 focuses on the portion below “fields”, and the area surrounded by “{}” indicates one item set, “,” The structure of the log is recognized according to the known rule that before and after indicate the item name and type, before “:” is a label and after is an entity of information. That is, the visualization information generation unit 22 recognizes the structure of the log on the basis of the position of a specific symbol such as “{}”, “,”, “:”.

  FIG. 6 is a diagram showing how the log structure is visualized and displayed on the screen IM. As shown in the figure, the visualization information generation unit 22 adds the “field name” corresponding to “name” grasped from the part subordinate to “fields” of the schema definition information and the “type” corresponding to “type”. Then, the logs are structured and displayed on the display unit 16. The type is, for example, information indicating whether it is a string type (string type) or a long type (numeric type).

[Add, Edit]
The item of "field description" in FIG. 6 may not be automatically generated by the visualization information generation unit 22, but may be input by the user. The user inputs the information corresponding to each field of the result display field A4 while looking at the text box A3. Also, as indicated by string (100) in the figure, when the maximum length of the item is known, the parenthesis and its contents may be added by the user. In the following description of FIG. 6, those underlined in the result display field A4 indicate information input by the user, not automatically generated by the visualization information generation unit 22. It shall be.

  Further, a result storage instruction switch S6 and the like are set around the result display field A4. When the result storage switch S6 is operated, the information management unit 24 uploads the content (stored in the RAM at any time) displayed in the result display field A4 at that time to the second server 200. The uploaded information is the log structure information 220.

[Obtain existing result]
Returning to FIG. 5, the log structure information 220 is (1) the identification information of the storage destination folder of the second server 200 is input to the second input field A2, or (2) the second reference designation switch S4 is operated It is acquired by selecting one folder from the list information of the storage destination folder of the second server 200 displayed. When any of the above operations is performed, the information management unit 24 requests the second server 200 to transmit the corresponding log structure information 220. When the log structure information 220 is acquired, the log structure information 220 is displayed in the result display field A4. Such a function allows another user to view log structure information 220 edited by a certain user.

[Applied example]
Hereinafter, further applied examples will be described. FIG. 7 is a diagram (part 1) illustrating an example of schema definition information including an element difficult to be automatically analyzed. According to the log rules exemplified so far, among the types, those described as map indicate that the items in the further lower hierarchy are included therein. FIG. 8 is a diagram showing an example of the content of the result display field A4 output by the visualization information generation unit 22 based on the schema definition information shown in FIG. As for the map, since the maximum number of items is defined, the visualization information generation unit 22 causes the display unit 16 to display map {} in order to prompt the maximum number of inputs in the braces.

  FIG. 9 is a diagram showing an example of a log corresponding to the schema definition information shown in FIG. The user adds and edits the result display field A4 while looking at this log. FIG. 10 is a diagram (part 1) showing an example of the contents of the result display field A4 to be added and edited by the user. First, the user recognizes that there are two items like like and dislike in the value, and enters "2" in the braces of map {}. Then, the visualization information generation unit 22 automatically adds two lines for inputting the lower hierarchy of value. Note that a switch for instructing addition of a row may be provided on the screen IM. In addition, the visualization information generation unit 22 automatically determines that the two items of like and dislike exist in the value based on the presence of “,” in {} immediately after the value, etc. 2) may be displayed automatically, and two lines for inputting the lower hierarchy of value may be automatically added.

  Then, the user completes the contents of the result display field A4 by adding the information of the underlined part other than "2". Note that for the types of items value.like and value.dislike, it is defined that the type of the upper-level map is string in the schema definition information, so visualization information is generated at the stage when the row is automatically added. A process of automatically adding and displaying is performed by the unit 22 (automatic replenishment of the content described later).

  FIG. 11 is a diagram (part 2) illustrating an example of schema definition information including an element difficult to be automatically analyzed. FIG. 12 is a diagram showing an example of a log corresponding to the schema definition information shown in FIG. This schema definition information further includes map in the hierarchy below map. The addition and editing procedure of the result display field A4 in this case is performed in the flow as shown in FIG. FIG. 13 is a diagram (part 2) illustrating an example of the content of the result display field A4 to be added and edited by the user. In this case, the result display field A4 is completed by repeating the operation as described with reference to FIG. 10 twice.

  FIG. 14 is a diagram (part 3) illustrating an example of schema definition information including an element that is difficult to automatically analyze. FIG. 15 is a diagram showing an example of a log corresponding to the schema definition information shown in FIG. This schema definition information contains array in the type. The array indicates a structure including a plurality of arrays having different labels. The addition / editing procedure of the result display field A4 in this case is performed in the flow as shown in FIG. FIG. 16 is a diagram (part 3) showing an example of the content of the result display field A4 to be added and edited by the user. In this log structure, "a favorite object" has a plurality of different data series, which is represented by an array. Therefore, when a numerical value is input in the braces of array {}, only one line may be added.

  FIG. 17 is a flowchart showing an example of the flow of processing executed by the log structure visualization device. First, the log structure visualization device acquires schema definition information and a log (S100), and displays them in a text box (S102). Next, the log structure visualization device determines whether analysis execution has been instructed (S104).

  When analysis execution is instructed, the log structure visualization device recognizes the structure of the log based on the schema definition information (S106), and the structure of the log in the result display field A4 within the automatically recognizable range Is displayed (S108).

  Next, the log structure visualization device determines whether the user has performed an addition / editing operation (S110). When the user performs an addition / editing operation, the log structure visualization device reflects the contents of the addition / editing operation in the result display field A4 (S112), and determines whether it is necessary to add a line (S114) ). When it is necessary to add a line, the log structure visualization device performs the line addition and performs automatic replenishment of contents (S116).

  If a negative determination is obtained in S110 or S114, or after the process of S116, the log structure visualization device determines whether an instruction to save the result has been issued (S120). The log structure visualization device returns the process to S110 if the result save instruction is not issued, and uploads the data if the result save instruction is issued (S120), and ends the process of this flowchart.

  According to the log structure visualization apparatus, the log structure visualization method, or the program of the first embodiment described above, the schema definition information acquisition unit 20 acquires schema definition information which is definition information of a log described in text, and a schema By providing the visualization information generation unit 22 that generates information for visualizing and displaying the structure of the log defined by the schema definition information based on the schema definition information acquired by the definition information acquisition unit 20, A display screen can be generated so that the log structure can be easily understood.

  As mentioned above, although the form for carrying out the present invention was explained using an embodiment, the present invention is not limited at all by such an embodiment, and various modification and substitution within the range which does not deviate from the gist of the present invention Can be added.

Reference Signs List 10 terminal device 12 communication unit 14 input unit 16 display unit 18 browser function unit 20 schema definition information acquisition unit 22 visualization information generation unit 24 information management unit 26 storage unit 100 first server 200 second server

Claims (9)

An acquisition unit for acquiring log definition information described in text;
A generation unit that generates information for visualizing and displaying the structure of the log defined by the definition information of the log based on the definition information of the log acquired by the acquisition unit;
Log structure visualization device comprising: The generation unit recognizes the structure of the log on the basis of the position of a specific symbol included in the definition information of the log.
The log structure visualization device according to claim 1. The generation unit further performs addition or editing on the generated information based on an input operation performed on the input unit.
The log structure visualization device according to claim 1 or 2. The generation unit is further capable of automatically replenishing the content based on the input operation performed on the input unit and the definition information of the log, in response to the input operation performed on the input unit. Is added to the generated information,
The log structure visualization device according to claim 3. The generation unit automatically determines the type of the log defined by the definition information of the log based on the definition information of the log acquired by the acquisition unit, and the structure of the log is determined based on the determination result. Generate information for visualization and display,
The log structure visualization device according to any one of claims 1 to 4. The generation unit determines the type of the log defined by the definition information of the log based on the input operation performed on the input unit, and visualizes and displays the structure of the log based on the determination result. Generate information for
The log structure visualization device according to any one of claims 1 to 4. The information generation unit further includes an information management unit which stores the information generated by the generation unit in the storage unit together with the identification information, reads out information from the storage unit in response to the request specifying the identification information, and returns the information.
The log structure visualization device according to any one of claims 1 to 6. The computer is
Get log definition information described in text,
The information for visualizing and displaying the structure of the log defined by the definition information of the log is generated based on the acquired definition information of the log,
Log structure visualization method. On the computer
Get the log definition information described in text,
Based on the acquired definition information of the log, generate information for visualizing and displaying the structure of the log defined by the definition information of the log,
program.

Images