CN114595363A

CN114595363A - Business log processing method, system, storage medium and terminal based on lightweight architecture

Info

Publication number: CN114595363A
Application number: CN202210122718.2A
Authority: CN
Inventors: 甄诚; 田猛; 夏曙东; 石四平; 张志平; 孙智彬
Original assignee: Beijing Transwiseway Information Technology Co Ltd
Current assignee: Beijing Transwiseway Information Technology Co Ltd
Priority date: 2022-02-09
Filing date: 2022-02-09
Publication date: 2022-06-07

Abstract

The invention discloses a service log processing method, a system, a storage medium and a terminal based on a lightweight architecture, wherein the lightweight architecture comprises a proxy log component, a loki log component and a grafana log component, and the method comprises the following steps: collecting the service log preprocessed in the current system through a promtail log component for labeling, and generating a labeled service log; storing the labeled service logs according to the loki log component, associating the stored service logs to the grafana log component for log classification statistics, and generating a statistical result; and feeding back the statistical result to the corresponding client for displaying. According to the method and the device, the service logs of the system are processed through the proxy log component, the loki log component and the grafana log component, so that the complexity of log arrangement and analysis is reduced, and the log analysis efficiency is improved.

Description

Business log processing method, system, storage medium and terminal based on lightweight architecture

Technical Field

The invention relates to the technical field of computers, in particular to a method, a system, a storage medium and a terminal for processing a service log based on a lightweight architecture.

Background

The logs are important carriers for recording the running state and events of the computer system, how to better analyze the logs is the key for checking the running state of the system and tracing the problems, and as the application scenes of the computer system continuously increase, the number and the types of the logs generated by each system start to exceed the online processing capacity of the human brain. The existing log analysis technology is usually realized by keyword search, the search result may contain a plurality of different types of logs, and the observation and analysis difficulty is large.

In the prior art, the current journal management method of the kubernets cluster mainly performs journal screening through a fixed tag, and performs corresponding processing on screened journals, so that the search performance is limited, the difficulty of journal arrangement and analysis is high, the journal availability is low, and the analysis efficiency of service journals is reduced.

Disclosure of Invention

The embodiment of the application provides a method, a system, a storage medium and a terminal for processing a service log based on a lightweight architecture. The following presents a simplified summary in order to provide a basic understanding of some aspects of the disclosed embodiments. This summary is not an extensive overview and is intended to neither identify key/critical elements nor delineate the scope of such embodiments. Its sole purpose is to present some concepts in a simplified form as a prelude to the more detailed description that is presented later.

In a first aspect, an embodiment of the present application provides a method for processing a service log based on a lightweight framework, where the method includes:

collecting the service log preprocessed in the current system through a promtail log component, and performing labeling processing to generate a labeled service log;

storing the labeled service logs according to the loki log component, associating the stored service logs to the grafana log component for log classification statistics, and generating a statistical result;

and feeding back the statistical result to the corresponding client for displaying.

Optionally, before collecting, by the promtail log component, the service log preprocessed in the current system and performing tagging processing, the method further includes:

acquiring access requests aiming at different domain names in a system in real time;

recording access requests aiming at different domain names in a system in a log mode to generate a service log;

performing word segmentation processing on the service log according to a preset word segmentation dictionary to generate a plurality of character strings to be matched;

calculating the similarity between each character string to be matched in the plurality of character strings to be matched and each standard character string in a preset character string library to obtain a plurality of similarities corresponding to each character string to be matched;

determining a standard character string corresponding to the highest similarity in the multiple similarities corresponding to each character string to be matched as a final character string of each character string to be matched;

and generating a preprocessed service log according to the final character string of each character string to be matched.

Optionally, collecting, by a promtail log component, a service log preprocessed in a current system to perform tagging processing, and generating a tagged service log, where the tagging processing includes:

collecting a service log after preprocessing in the current system through a promtail log component;

loading a label library set for the preprocessed service log;

determining a plurality of target labels corresponding to the preprocessed service log according to a label library;

and setting labels for the preprocessed service logs according to the plurality of target labels, and generating labeled service logs.

Optionally, determining a plurality of target tags corresponding to the preprocessed service log according to the tag library includes:

analyzing the preprocessed service log, and determining a plurality of service attribute values contained in the preprocessed service log;

and mapping a plurality of target labels corresponding to the plurality of service attribute values from the label library according to the plurality of service attribute values.

Optionally, storing the tagged service log according to the loki log component includes:

determining a plurality of labels contained in the labeled service log and log data of each label;

compressing the log data of each label into chunks blocks to obtain the chunks blocks of each label;

adopting a relation extraction algorithm to construct a mapping relation between each label and the corresponding chunks block, and generating a mapping relation table;

optimizing the mapping relation table to obtain an optimized mapping relation table;

and storing the chunks blocks of each label and the optimized mapping relation table.

Optionally, optimizing the mapping relationship table to obtain an optimized mapping relationship table includes:

identifying the same relation and the relation with the quantity smaller than a preset threshold value in the mapping relation table;

merging the same relations, and removing the relations of which the number is less than a preset threshold value to obtain an optimized mapping relation table.

Optionally, the step of associating the stored service log to a grafana log component for log classification statistics, and generating a statistical result includes:

and associating the chunks of each label and the optimized mapping relation table to the grafana log component, so that the grafana log component performs log classification statistics based on the optimized mapping relation table to generate a statistical result.

In a second aspect, an embodiment of the present application provides a service log processing system based on a lightweight framework, where the lightweight framework includes a proatal log component, a loki log component, and a grafana log component, and the system includes:

the service log labeling module is used for collecting the service logs preprocessed in the current system through the promtail log component to perform labeling processing, and generating labeled service logs;

the statistical result generation module is used for storing the labeled service logs according to the loki log component, associating the stored service logs to the grafana log component for log classification statistics, and generating statistical results;

and the statistical result display module is used for feeding back the statistical result to the corresponding client for display.

In a third aspect, embodiments of the present application provide a computer storage medium having stored thereon a plurality of instructions adapted to be loaded by a processor and to perform the above-mentioned method steps.

In a fourth aspect, an embodiment of the present application provides a terminal, which may include: a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to perform the above-mentioned method steps.

The technical scheme provided by the embodiment of the application can have the following beneficial effects:

in the embodiment of the application, the service log processing system based on the lightweight architecture firstly collects the service logs preprocessed in the current system through the proxy log component for labeling processing, generates labeled service logs, then stores the labeled service logs according to the loki log component, associates the stored service logs to the grafana log component for log classification statistics, generates statistical results, and finally feeds the statistical results back to the corresponding client for display. According to the method and the device, the service logs of the system are processed through the proxy log component, the loki log component and the grafana log component, so that the complexity of log arrangement and analysis is reduced, and the log analysis efficiency is improved.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and together with the description, serve to explain the principles of the invention.

Fig. 1 is a schematic flowchart of a method for processing a service log based on a lightweight architecture according to an embodiment of the present application;

fig. 2 is a service log processing architecture diagram based on a lightweight architecture according to an embodiment of the present application;

fig. 3 is a schematic structural diagram of a service log processing system based on a lightweight architecture according to an embodiment of the present application;

fig. 4 is a schematic structural diagram of a terminal according to an embodiment of the present application.

Detailed Description

The following description and the drawings sufficiently illustrate specific embodiments of the invention to enable those skilled in the art to practice them.

It should be understood that the described embodiments are only some embodiments of the invention, and not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of systems and methods consistent with certain aspects of the invention, as detailed in the appended claims.

In the description of the present invention, it is to be understood that the terms "first," "second," and the like are used for descriptive purposes only and are not to be construed as indicating or implying relative importance. The specific meanings of the above terms in the present invention can be understood in specific cases to those skilled in the art. In addition, in the description of the present invention, "a plurality" means two or more unless otherwise specified. "and/or" describes the association relationship of the associated objects, meaning that there may be three relationships, e.g., a and/or B, which may mean: a exists alone, A and B exist simultaneously, and B exists alone. The character "/" generally indicates that the former and latter associated objects are in an "or" relationship.

The application provides a method, a system, a storage medium and a terminal for processing a service log based on a lightweight architecture, so as to solve the problems in the related technical problems. In the technical scheme provided by the application, because the service logs of the system are processed by the proxy log component, the loki log component and the grafana log component, the complexity of log sorting and analysis is reduced, and the log analysis efficiency is improved, which is described in detail by adopting an exemplary embodiment.

The method for processing a service log based on a lightweight architecture according to the embodiment of the present application will be described in detail below with reference to fig. 1 to fig. 2. The method may be implemented in dependence on a computer program, operable on a lightweight architecture based traffic log processing system based on the von neumann architecture. The computer program may be integrated into the application or may run as a separate tool-like application.

Referring to fig. 1, a flow diagram of a service log processing method based on a lightweight framework is provided for an embodiment of the present application. As shown in fig. 1, the method of the embodiment of the present application may include the following steps:

s101, collecting the service log preprocessed in the current system through a promtail log component, performing tagging processing, and generating a tagged service log;

the lightweight architecture comprises a proall log component, a Loki log component and a Grafana log component, wherein the proall log component, the Loki log component and the Grafana log component are components in a Loki log system, the Loki log system is an open source project of a Grafana Labs team, and the log aggregation system is horizontally extensible, high in availability and multi-tenant.

Generally, the proxy log component is an agent, the loki log component is a main server, and the grafana log component is used for processing logs for visualization display.

In the embodiment of the present application, before collecting the service log preprocessed in the current system by the promtail log component and performing tagging processing, the preprocessed service log is also required to be generated.

Specifically, when a preprocessed service log is generated, firstly, access requests for different domain names in a system are obtained in real time, then, the access requests for the different domain names in the system are recorded in the form of a log to generate the service log, then, word segmentation processing is performed on the service log according to a preset word segmentation dictionary to generate a plurality of character strings to be matched, similarity between each character string to be matched in the plurality of character strings to be matched and each standard character string in a preset character string library is calculated to obtain a plurality of similarities corresponding to each character string to be matched, then, the standard character string corresponding to the highest similarity in the plurality of similarities corresponding to each character string to be matched is determined as a final character string of each character string to be matched, and finally, the preprocessed service log is generated according to the final character string of each character string to be matched.

In a possible implementation manner, when generating a tagged service log, a preprocessed service log in a current system is collected by a promtail log component, a tag library set for the preprocessed service log is loaded, a plurality of target tags corresponding to the preprocessed service log are determined according to the tag library, and finally, tags are set for the preprocessed service log according to the target tags to generate the tagged service log.

Further, when a plurality of target tags corresponding to the preprocessed service log are determined according to the tag library, the preprocessed service log is firstly analyzed, a plurality of service attribute values contained in the preprocessed service log are determined, and then a plurality of target tags corresponding to a plurality of service attribute values are mapped from the tag library according to the plurality of service attribute values.

For example, when a user performs a related operation, the operation of the user accessing different domain names is recorded in the form of a log, and data formatting is performed in the log to obtain a preprocessed service log, for example: the preprocessed service log is, for example, a status code, url, time of access, region where the access is located, and the like. And automatically capturing logs from a series of targets according to a promtail log component for classified (synchronous/asynchronous) transmission. And automatically generates a label. And an effective data base and dimensionality are provided for post-analysis filtering. For example: the jobtag can be used for customizing the attribute of the transmission log, so that the nginx service, the application service, the system service and the like can be distinguished. And customizing the ip of the server by using a host label, thereby quickly locating the server where the data is located.

It should be noted that, according to the automatic fetching mode of the promtail log component, the rapid automatic extension can be performed according to the matching.

S102, storing the labeled service logs according to the loki log component, associating the stored service logs to the grafana log component for log classification statistics, and generating a statistical result;

in the embodiment of the application, when the tagged service log is stored according to the loki log component, a plurality of tags contained in the tagged service log and log data of each tag are firstly determined, then the log data of each tag is compressed into a chunks block to obtain the chunks block of each tag, a mapping relation between each tag and the corresponding chunks block is established by adopting a relation extraction algorithm to generate a mapping relation table, then the mapping relation table is optimized to obtain the optimized mapping relation table, and finally the chunks block of each tag and the optimized mapping relation table are stored.

Specifically, when the mapping relationship table is optimized to obtain the optimized mapping relationship table, the same relationships and the relationships with the relationship quantity smaller than the preset threshold in the mapping relationship table are firstly identified, then the same relationships are merged, and the relationships with the relationship quantity smaller than the preset threshold are eliminated to obtain the optimized mapping relationship table.

It should be noted that, in the storage manner using the loki log component, the most important advantage compared with the prior art is to lighten the storage service. The loki service will only index the log metadata (tags) and will not index the original log data in full text. The log data itself is then compressed and stored in chunks for storage. Therefore, the query speed is increased, and the cost is reduced.

Further, when the stored service logs are associated to the grafana log component for log classification statistics, and a statistical result is generated, firstly, the chunks of each label and the optimized mapping relation table are associated to the grafana log component, so that the grafana log component performs log classification statistics based on the optimized mapping relation table, and a statistical result is generated.

It should be noted that, by using the grafana log component, templated display and tagged query can be realized. The expansion can be fast and the dimension can be increased.

In one possible implementation, the loki Log component stores the log in the form of a tag, a timestamp, or text. The user operation data in the loki is configured in the granfana data source, and classified statistical display is carried out through the page, so that the performance bottleneck under the distributed application architecture can be rapidly analyzed and diagnosed, and the user source, the access area, the user behavior and the like can be subjected to statistical analysis.

And S103, feeding back the statistical result to the corresponding client for displaying.

In one possible implementation, the analysis process may be performed for the following scenarios:

1) carrying out classification statistics according to the state codes:

the implementation mode is as follows: and filtering the tag logs according to unit time, then performing json string conversion through a json parser in logql language, and counting through status code fields, wherein the sum of the status codes is +1 if the status codes are the same.

The advantages are that: the request quantity of each state can be analyzed quickly, and data support is provided for the optimization service.

2) Request statistics above state 500:

the implementation mode is as follows: and filtering the tag logs according to unit time, then performing json string conversion through a json parser in logql language, judging a request with status greater than 500, and if the request is + 1.

The advantages are that: whether the current domain name is abnormal or not can be quickly located, and when the value is increased, service delay or blocking can occur.

3) Accessing domain name client statistics:

the implementation mode is as follows: and filtering the tag log according to unit time, then performing json string conversion through a json parser in logql language, performing duplicate removal statistics through a remote _ addr field, and accumulating all the results.

The method is characterized in that: and counting the number uv of users quickly.

4) The url and the request amount of the top 10 are counted:

the implementation mode is as follows: and filtering the tag log according to unit time, then performing json string conversion through a json parser in logql language, removing null data and junk fields, and performing statistical sequencing through an http _ referrer field.

The method is characterized in that: the method can quickly analyze the access condition of the user, know the degree of dependence of the user on certain functions, and adjust and optimize the corresponding service according to url analysis.

5) Counting the top 10 user browsers and request amount:

the implementation mode is as follows: and filtering the tag log according to unit time, then performing json string conversion through a json parser in logql language, and performing sequencing statistics through an http _ user _ agent field.

The method is characterized in that: first, corresponding front-end compatibility optimization can be performed according to statistical conditions, and some abnormal access modes can be found, for example: discovery python script probes, etc.

6) Counting the access ip address and the request quantity of the first 10:

the implementation mode is as follows: and filtering the tag logs according to unit time, then performing json string conversion through a json parser in a logql language, and performing sequencing statistics through a remote _ addr and a geo _ country _ code field.

The method is characterized in that: whether the access of the user is normal or not can be quickly positioned, and the condition of the active user is analyzed according to the ip access amount.

7) The access area and the request amount of the top 10 are counted:

the implementation mode is as follows: and filtering the tag logs according to unit time, then performing json string conversion through a json parser in a logql language, and performing ordering statistics through a field of a geo _ city and a field of a geo _ country _ code.

The method is characterized in that: the access condition of the user in the city can be analyzed, and a data basis is provided for business expansion. Some foreign abnormal requests can be found, and timely protection is promoted.

8) The total line number of the service log and the line number of the appearing keywords:

the implementation mode is as follows: and filtering the label log according to unit time, and counting the total line number and the keyword line number.

The method is characterized in that: the occurrence condition of log keywords under multiple service nodes can be quickly analyzed, and data support is provided for troubleshooting of research, development, operation and maintenance

9) Service log keyword occurrence ratio:

the implementation mode is as follows: the percentage display is performed by dividing the number of rows of occurrences keys by the total number of rows, multiplied by 100.

The method is characterized in that: the occurrence frequency of keywords, such as error, can be quickly and intuitively found, and once the ratio margin is high, problems can be quickly found.

For example, fig. 2 is a service log processing architecture diagram based on a lightweight architecture, provided by the present application, and (1) the data acquisition module is mainly composed of nginx log formatting (the service log does not need to be formatted), and promtail custom transmission. (2) The data storage module mainly comprises loki storage. (3) The data analysis display module mainly comprises grfana data analysis and custom data display.

The following are embodiments of systems of the present invention that may be used to perform embodiments of methods of the present invention. For details which are not disclosed in the embodiments of the system of the present invention, reference is made to the embodiments of the method of the present invention.

Referring to fig. 3, a schematic structural diagram of a service log processing system based on a lightweight architecture according to an exemplary embodiment of the present invention is shown, where the lightweight architecture includes a proatall log component, a loki log component, and a grafana log component. The traffic log processing system based on the lightweight architecture can be realized by software, hardware or a combination of the software and the hardware to be all or part of the terminal. The system 1 comprises a service log labeling module 10, a statistical result generating module 20 and a statistical result display module 30.

The service log labeling module 10 is configured to collect, by a promtail log component, a service log preprocessed in a current system for labeling, and generate a labeled service log;

a statistical result generating module 20, configured to store the tagged service log according to the loki log component, associate the stored service log with the grafana log component to perform log classification statistics, and generate a statistical result;

and the statistical result display module 30 is configured to feed back the statistical result to the corresponding client for display.

It should be noted that, when the service log processing system based on the lightweight architecture provided in the foregoing embodiment executes the service log processing method based on the lightweight architecture, only the division of the functional modules is used for illustration, and in practical applications, the function distribution may be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules, so as to complete all or part of the functions described above. In addition, the service log processing system based on the lightweight architecture and the service log processing method based on the lightweight architecture provided by the embodiment belong to the same concept, and details of the implementation process are referred to in the method embodiment and are not described herein again.

The above-mentioned serial numbers of the embodiments of the present application are merely for description and do not represent the merits of the embodiments.

In the embodiment of the application, the service log processing system based on the lightweight architecture firstly collects the service logs preprocessed in the current system through the proxy log component for labeling processing, generates labeled service logs, then stores the labeled service logs according to the loki log component, associates the stored service logs to the grafana log component for log classification statistics, generates statistical results, and finally feeds the statistical results back to the corresponding client for displaying. According to the method and the device, the service logs of the system are processed through the proxy log component, the loki log component and the grafana log component, so that the complexity of log arrangement and analysis is reduced, and the log analysis efficiency is improved.

The present invention also provides a computer readable medium, on which program instructions are stored, and when the program instructions are executed by a processor, the method for processing a service log based on a lightweight architecture provided by the above method embodiments is implemented.

The present invention also provides a computer program product containing instructions, which when run on a computer, causes the computer to execute the method for processing a service log based on a lightweight architecture of the above-mentioned method embodiments.

Please refer to fig. 4, which provides a schematic structural diagram of a terminal according to an embodiment of the present application. As shown in fig. 4, terminal 1000 can include: at least one processor 1001, at least one network interface 1004, a user interface 1003, memory 1005, at least one communication bus 1002.

Wherein a communication bus 1002 is used to enable connective communication between these components.

The user interface 1003 may include a Display screen (Display) and a Camera (Camera), and the optional user interface 1003 may also include a standard wired interface and a wireless interface.

The network interface 1004 may optionally include a standard wired interface, a wireless interface (e.g., WI-FI interface), among others.

Processor 1001 may include one or more processing cores, among other things. The processor 1001, which is connected to various parts throughout the electronic device 1000 using various interfaces and lines, performs various functions of the electronic device 1000 and processes data by executing or executing instructions, programs, code sets, or instruction sets stored in the memory 1005 and calling data stored in the memory 1005. Alternatively, the processor 1001 may be implemented in at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 1001 may integrate one or more of a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), a modem, and the like. Wherein, the CPU mainly processes an operating system, a user interface, an application program and the like; the GPU is used for rendering and drawing the content required to be displayed by the display screen; the modem is used to handle wireless communications. It is understood that the modem may not be integrated into the processor 1001, but may be implemented by a single chip.

The Memory 1005 may include a Random Access Memory (RAM) or a Read-Only Memory (Read-Only Memory). Optionally, the memory 1005 includes a non-transitory computer-readable medium. The memory 1005 may be used to store an instruction, a program, code, a set of codes, or a set of instructions. The memory 1005 may include a stored program area and a stored data area, wherein the stored program area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playing function, an image playing function, etc.), instructions for implementing the various method embodiments described above, and the like; the storage data area may store data and the like referred to in the above respective method embodiments. The memory 1005 may optionally be at least one memory system located remotely from the processor 1001. As shown in fig. 4, a memory 1005, which is a kind of computer storage medium, may include therein an operating system, a network communication module, a user interface module, and a lightweight architecture-based service log processing application program.

In the terminal 1000 shown in fig. 4, the user interface 1003 is mainly used as an interface for providing input for a user, and acquiring data input by the user; and the processor 1001 may be configured to invoke the lightweight architecture based service log processing application stored in the memory 1005, and specifically perform the following operations:

In one embodiment, the processor 1001, before performing the labeling process by collecting the service logs preprocessed in the current system by the promtail log component, further performs the following operations:

recording access requests aiming at different domain names in the system in a log mode to generate a service log;

In an embodiment, when the processor 1001 performs the tagging processing by collecting the service log preprocessed in the current system through the promtail log component, and generates a tagged service log, the following operations are specifically performed:

loading a label library set for the preprocessed service log;

In an embodiment, when the processor 1001 determines, according to the tag library, a plurality of target tags corresponding to the preprocessed service log, the following operations are specifically performed:

and mapping a plurality of target labels corresponding to the service attribute values from the label library according to the service attribute values.

In an embodiment, when the processor 1001 stores the tagged service log according to the loki log component, the following operations are specifically performed:

In an embodiment, when the processor 1001 executes the optimized mapping relationship table to obtain the optimized mapping relationship table, the following operations are specifically executed:

merging the same relations, and removing the relations of which the number of the relations is smaller than a preset threshold value to obtain an optimized mapping relation table.

In an embodiment, when the processor 1001 associates the stored service log with the grafana log component to perform log classification statistics, and generates a statistical result, the following operations are specifically performed:

It will be understood by those skilled in the art that all or part of the processes in the methods of the embodiments described above may be implemented by a computer program to instruct related hardware, and a program for processing a service log based on a lightweight architecture may be stored in a computer-readable storage medium, and when executed, the program may include the processes of the embodiments of the methods described above. The storage medium may be a magnetic disk, an optical disk, a read-only memory or a random access memory.

The above disclosure is only for the purpose of illustrating the preferred embodiments of the present application and is not to be construed as limiting the scope of the present application, so that the present application is not limited thereto, and all equivalent variations and modifications can be made to the present application.

Claims

1. A business log processing method based on a lightweight architecture is characterized in that the lightweight architecture comprises a proxy log component, a loki log component and a grafana log component, and the method comprises the following steps:

collecting the service log preprocessed in the current system through the promtail log component, and performing labeling processing to generate a labeled service log;

and feeding back the statistical result to a corresponding client for displaying.

2. The method of claim 1, wherein before the collecting, by the promtail log component, the pre-processed service log in the current system for tagging, further comprises:

recording the access requests aiming at different domain names in the system in a log mode to generate a service log;

3. The method according to claim 1, wherein the collecting, by the promtail log component, the service log preprocessed in the current system for tagging to generate a tagged service log comprises:

collecting a service log preprocessed in the current system through the promtail log component;

loading a label library set for the preprocessed service log;

determining a plurality of target labels corresponding to the preprocessed service logs according to the label library;

4. The method of claim 3, wherein the determining a plurality of target tags corresponding to the preprocessed service logs according to the tag library comprises:

5. The method of claim 1, wherein storing the tagged business log according to the loki log component comprises:

adopting a relation extraction algorithm to construct a mapping relation between each label and the chunks blocks corresponding to the label, and generating a mapping relation table;

6. The method of claim 5, wherein optimizing the mapping table to obtain an optimized mapping table comprises:

7. The method of claim 5, wherein the associating the stored service log to the grafana log component for log classification statistics, and generating statistics comprises:

8. A business log processing system based on a lightweight architecture, wherein the lightweight architecture comprises a proxy log component, a loki log component and a grafana log component, and the system comprises:

the service log labeling module is used for collecting the service logs preprocessed in the current system through the promtail log component for labeling processing to generate labeled service logs;

the statistical result generating module is used for storing the labeled service logs according to the loki log component, associating the stored service logs to the grafana log component for log classification statistics, and generating a statistical result;

9. A computer storage medium, characterized in that it stores a plurality of instructions adapted to be loaded by a processor and to perform the method steps according to any of claims 1-7.

10. A terminal, comprising: a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to perform the method steps of any of claims 1-7.