CN117435568A

CN117435568A - Log processing method and device and electronic equipment

Info

Publication number: CN117435568A
Application number: CN202210816991.5A
Authority: CN
Inventors: 许宏业
Original assignee: Beijing Zitiao Network Technology Co Ltd
Current assignee: Beijing Zitiao Network Technology Co Ltd
Priority date: 2022-07-12
Filing date: 2022-07-12
Publication date: 2024-01-23

Abstract

The present disclosure provides a log processing method, apparatus, electronic device, and computer-readable storage medium, the method comprising: determining the dependency relationship of the index field and the display field according to the log event; storing the index field and the display field according to the dependency relationship; and responding to the search request, and determining a search result according to the stored index field and the presentation field with the dependency relationship with the index field. Therefore, the log processing efficiency is greatly improved.

Description

Log processing method and device and electronic equipment

Technical Field

The disclosure relates to the technical field of computers, and in particular relates to a log processing method, a log processing device and electronic equipment.

Background

With the development of internet related technologies, various computer application systems are widely used, and accordingly various problems and demands on the applications are generated, so that a large number of problem logs are generated. When the problem logs are issued more, a certain pressure is caused on a server of the application system, meanwhile, inconvenience is brought to inquiry of the problem logs, and great pressure is caused on operation and maintenance work of the system.

At present, a certain proportion of the reporting problems are not system bugs, but hit certain rules or settings, and the SDK (software development kit) log currently needs research and development personnel to verify by looking at a system background or calling related interfaces, wherein the used tool technology threshold is higher, and the query speed is reduced with the increase of the log quantity.

Disclosure of Invention

In order to at least partially solve the above technical problems, the present disclosure provides a method, an apparatus, and an electronic device for log processing.

According to a first aspect of the present disclosure, an embodiment of the present disclosure provides a log processing method, including:

determining the dependency relationship of the index field and the display field according to the log event;

storing the index field and the display field according to the dependency relationship;

and responding to the search request, and determining a search result according to the stored index field and the presentation field with the dependency relationship with the index field.

Further, determining the dependency relationship between the index field and the presentation field according to the log event includes:

acquiring event identification and keywords according to the log event;

and determining the dependency relationship of the index field and the display field according to the event identification and the keywords.

Further, the method further comprises the following steps: and determining the index field and the display field according to the service scene.

Further, before storing, the method further comprises: and asynchronously reporting the index field and the display field with the dependency relationship with the index field.

Further, the asynchronous reporting of the index field and the presentation field having a dependency relationship with the index field includes:

and asynchronously reporting the index field and the display field with the dependency relationship with the index field through a full-link server reporting interface.

Further, in response to a field configuration request, field configuration information is obtained, and the index field and/or the display field are configured according to the field configuration information.

Further, in response to a field configuration request, obtaining field configuration information, and configuring the index field and/or the presentation field according to the field configuration information, including:

responding to the field configuration request, and displaying a configuration interface;

and responding to input operation acted on the configuration interface, acquiring field configuration information corresponding to the input operation, and configuring the index field and/or the display field according to the field configuration information.

Further, the storing the index field and the presentation field according to the dependency relationship includes:

establishing an index structure according to the index field;

and carrying out structured storage on the index field and the display field according to the index structure in a message queue mode.

Further, the index structure is an ES index structure.

Further, in response to a search request, determining a search result according to the stored index field and a presentation field having a dependency relationship with the index field, including:

receiving a search field input for a search interface;

determining an index field corresponding to the search field in response to a search request for the search field;

and determining a display field corresponding to the search field according to the index field corresponding to the search field, and taking the display field as the search result.

Further, determining a presentation field corresponding to the search field according to the index field corresponding to the search field, as the search result, includes:

determining a plurality of display fields corresponding to the search field according to the index field corresponding to the search field; filtering and/or grouping the plurality of display fields to obtain the search result;

And displaying the search result.

In a second aspect, another embodiment of the present disclosure provides a log processing apparatus, including:

the dependence module is used for determining the dependence relationship of the index field and the display field according to the log event;

the storage module is used for storing the index field and the display field according to the dependency relationship;

and the retrieval display module is used for responding to the retrieval request and determining a retrieval result according to the stored index field and the display field with the dependency relationship with the index field.

In a third aspect, another embodiment of the present disclosure provides an electronic device, including:

a memory for storing computer readable instructions; and

a processor configured to execute the computer readable instructions to cause the electronic device to implement the method of any one of the first aspect.

In a fourth aspect, another embodiment of the present disclosure provides a non-transitory computer-readable storage medium storing computer-readable instructions that, when executed by a computer, cause the computer to implement the method of any one of the first aspects.

The embodiment of the disclosure discloses a log processing method, a log processing device, electronic equipment and a computer readable storage medium, wherein the method comprises the following steps: determining the dependency relationship of the index field and the display field according to the log event; storing the index field and the display field according to the dependency relationship; and responding to the search request, and determining a search result according to the stored index field and the presentation field with the dependency relationship with the index field. Therefore, the log processing efficiency is greatly improved.

The foregoing description is only an overview of the disclosed technology, and may be implemented in accordance with the disclosure of the present disclosure, so that the above-mentioned and other objects, features and advantages of the present disclosure can be more clearly understood, and the following detailed description of the preferred embodiments is given with reference to the accompanying drawings.

Drawings

FIG. 1 is a schematic flow chart of a log processing method according to an embodiment of the disclosure;

FIG. 2 is a schematic diagram of a log processing system according to an embodiment of the disclosure;

FIG. 3 is a schematic diagram of a log processing device according to another embodiment of the disclosure;

fig. 4 is a schematic structural diagram of an electronic device according to another embodiment of the present disclosure.

Detailed Description

In order that the technical contents of the present disclosure may be more clearly described, further description is made below in connection with specific embodiments.

The implementations described in the following exemplary examples are not representative of all implementations consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with some aspects of the present application as detailed in the accompanying claims.

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure have been shown in the accompanying drawings, it is to be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustration purposes only and are not intended to limit the scope of the present disclosure.

It should be understood that the various steps recited in the method embodiments of the present disclosure may be performed in a different order and/or performed in parallel. Furthermore, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present disclosure is not limited in this respect.

The term "including" and variations thereof as used herein are intended to be open-ended, i.e., including, but not limited to. The term "based on" is based at least in part on. The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments. Related definitions of other terms will be given in the description below.

It should be noted that the terms "first," "second," and the like in this disclosure are merely used to distinguish between different devices, modules, or units and are not used to define an order or interdependence of functions performed by the devices, modules, or units.

It should be noted that references to "one", "a plurality" and "a plurality" in this disclosure are intended to be illustrative rather than limiting, and those of ordinary skill in the art will appreciate that "one or more" is intended to be understood as "one or more" unless the context clearly indicates otherwise.

The terminology used in the present disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this disclosure and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. The embodiments disclosed are described in detail below with reference to the accompanying drawings.

Fig. 1 is a schematic flow chart of a log processing method according to an embodiment of the present disclosure, where the log processing method provided by the embodiment may be implemented by a log processing device, and the device may be implemented as software, or a combination of software and hardware, and the device may be integrally provided in an electronic device, and implemented by a processor of the electronic device. As shown in fig. 1, the method comprises the steps of:

step S101: and determining the dependency relationship of the index field and the display field according to the log event.

The log processing process of the present disclosure may include three parts: reporting, storing and inquiring. In the reporting stage, the log can be acquired in an SDK manner and the SDK is packaged, so as to generate a packaged SDK. And establishing an index field and a presentation field for the log SDK, and associating the index field and the presentation field to form a dependency relationship (also called a mapping relationship) of the index field and the presentation field. Wherein, the index field generally comprises fields such as Identification (ID), time, category, keyword, inclusion relation, upper and lower relation, storage structure, storage relation, association characteristic and distinguishing characteristic of each log event and the like of the log event. The presentation field typically includes: topic, identification (ID), time, category, keyword, summary, primary content, etc. of the log event. A dependency relationship (also referred to as a mapping relationship) is established between the index field and the presentation field through a common field, such as, but not limited to, an Identification (ID) of a log event, time, category, keyword, and the like.

In an embodiment, determining the dependency relationship between the index field and the presentation field according to the log event, specifically, determining the dependency relationship (or called mapping relationship) according to the common field of the log event in the index field and the presentation field includes: acquiring event identification and keywords according to the log event; and determining the dependency relationship of the index field and the display field according to the event identification and the keywords. That is, the event identifier and the keyword in the log event constitute a common field of the index field and the presentation field, and of course, the dependency relationship may be established by using other fields as the common field. Specifically, a corresponding service log SDK is generated according to the log event; acquiring event identification and keywords of the service log SDK; and establishing a corresponding relation between the index field and the display field through the event identification and the keywords.

Further, the index field and the presentation field may be determined according to the traffic scenario. Different service scenes can have different index fields and display fields, the number of the index fields can be the same under different scenes, and the number of the display fields can be selectively displayed according to service requirements. The reported log SDKs can be classified or grouped according to categories, sequences, demands and the like, and a user or a system can arbitrarily formulate an index field and a corresponding display field according to service scenes, and can customize a service custom index field with high expansion flexibility. Specifically, training and learning can be performed on the formulated index fields and presentation fields according to a training model, and corresponding log SDK documents are generated.

Step S102: and storing the index field and the display field according to the dependency relationship.

In the storage stage, the storage use ES (Elasticsearch) index structure can be dynamically increased according to the Message Queue (MQ) mode, so that different index field requirements for different services can be better supported.

Specifically, the storing the index field and the presentation field according to the dependency relationship includes: establishing an index structure according to the index field; and carrying out structured storage on the index field and the display field according to the index structure in a message queue mode. The index structure is a ES (Elasticsearch) index structure, and the ES index structure can increase or decrease index fields in a message queue mode according to service requirements.

The present disclosure employs the infrastructure of the elastiscearch to structure the storage log package SDK. The index in the elastic search is a logical space (like a database) that organizes the data. The index of 1 elastic search has 1 or more slices (5 by default). The shard corresponds to the Lucene index of the actual stored data, and the shard itself is a search engine. There are 0 or more copies per tile (1 by default). The index of the elastomer search also contains a "type" (just like a table in a database) for logically isolating the data in the index. In the index of the elastomer search, given a type, all its documents will have the same properties (similar to the schema of the table). These tiles constitute an elastomer search index, each tile itself being a Lucene index.

The document is a data unit of an elastic search, and in the present disclosure, corresponding to a log document, terms in the log document are segmented, an ordered list of duplicate terms is created, and the terms are associated with a list of locations in the document where they appear, forming an inverted index. The following description, in conjunction with the examples, describes how to reverse index for 2 documents.

Log document 1 (Doc 1): insight Data Engineering Fellows Program

Log document 2 (Doc 2): insight Data Science Fellows Program

In the case of a requirement to find a log document containing the term "insight", this (word ordered) inverted index may be scanned for "insight" and the log document ID containing the reform returned, in the example Doc 1 and Doc 2.

In order to improve retrievability and make the returned results more comprehensive and accurate, it is necessary to analyze the log document before indexing it.

In this disclosure, the format of the structured storage log SDK document is as follows: standard field + service custom field, any combination query. For example:

event_module "common" APP environmental event

event_module "ktv": k song

event_module "muti_linker": multi-person connecting line

event_module "multi_audio": voice connection

event_module "event_room": enter house

extra{"refuse_details":"xxx"}

An elastic search instance is a node, a group of nodes forming a cluster. Nodes in an elastic search cluster can be configured in 3 different roles:

1. and (3) a master node: the control elastic search cluster is responsible for operations in the cluster, such as creating/deleting an index, tracking nodes in the cluster, and distributing slices to the nodes. The master node processes the status of the cluster and broadcasts to other nodes and receives acknowledgement responses from other nodes.

Each node can become the master node by setting the node master attribute in the profile elastsearch. For large production clusters, it is recommended to use one dedicated master node to control the cluster, which node will not handle any user requests.

2. Data node: holding data and inverted index. By default, each node can become a data node by setting the node data attribute in the profile elastiscearch. Yml to true (default). If a special master node is to be used, its node.data attribute should be set to false.

3. Client node: if both the node master attribute and the node data attribute are set to false, then the node is a client node, playing a role of load balancing, routing incoming requests to the various nodes in the cluster.

In addition, the elastic search cluster also comprises a coordination node which is used as a node accessed by the client. The coordinator node will route the client request to the appropriate partition in the cluster. For read requests, the coordinator node will choose a different tile to handle the request each time to achieve load balancing.

In the method, the message queue is used in the elastic search structured storage, so that big data statistics and analysis can be processed better and in real time.

In addition, in the present embodiment, before storing, the method further includes: and asynchronously reporting the index field and the display field with the dependency relationship with the index field. And calling the encapsulation SDK to asynchronously report according to the customized index field and the presentation field.

In the reporting stage, a user customizes corresponding index fields and display fields of the reporting log SDK according to service requirements and characteristics, and the user can conveniently access a service end through an API interface to provide the full-link reporting log SDK, support the service custom display fields and index fields, automatically inject necessary fields, use a cooperative pool and specific reporting receiving service, and realize high-efficiency asynchronous access to the SDK. By adopting asynchronous reporting, an access party can select a reporting mode and a corresponding index field according to the characteristics of a specific service scene, and the asynchronous reporting is carried out by using a convenient SDK, so that the reporting process has no interference to the main flow of the original system.

In an embodiment of the present disclosure, the index field and the presentation field having a dependency relationship with the index field may be reported asynchronously through a full link server reporting interface. The step of calling the encapsulation SDK to carry out asynchronous report according to the customized index field and the presentation field comprises the following steps: providing a reporting interface of a full-link service end; establishing a mapping relation between the customized index field and the display field and the log SDK; encapsulating the log SDK according to the mapping relation; invoking the encapsulation SDK corresponding to the customized index field and the presentation field; and asynchronously reporting the encapsulation SDK through the reporting interface.

In an embodiment of the present disclosure, field configuration information is obtained in response to a field configuration request, and the index field and/or the presentation field are configured according to the field configuration information; the method specifically comprises the following steps: responding to the field configuration request, and displaying a configuration interface; and responding to input operation acted on the configuration interface, acquiring field configuration information corresponding to the input operation, and configuring the index field and/or the display field according to the field configuration information. The customized index field and the presentation field support service custom index field and presentation field, and extract necessary fields of the custom index field and presentation field to automatically inject into the encapsulation SDK. According to the method and the device, the configuration interface is displayed, the field configuration information corresponding to the input operation is obtained in response to the input operation acting on the configuration interface, and the index field and/or the display field are configured according to the field configuration information. The configuration can be to delete the existing field, add the new field, modify the name, the identification and the corresponding relation with the display field of the existing field, the effect is convenient and quick to adjust, the user experience is improved, the configuration field is convenient to flexibly adjust according to the actual requirement, and the efficiency is improved.

Step S103: and responding to the search request, and determining a search result according to the stored index field and the presentation field with the dependency relationship with the index field.

Further, in this step, according to the search request, a presentation field having the dependency relationship with the index field is displayed.

In the present disclosure, visual display is performed on the reported information according to the reported structured information. Under the default view, each frame represents one report, and the reports are arranged according to the time sequence, so that the front-back relationship can be clearly seen. And presents the two most important pieces of information on the box: action and time. When the mouse moves to a certain reporting point, the corresponding associated information can be automatically popped up. If more associated information needs to be checked, a reporting point can be clicked, and the complete associated information is checked in the popped right side sidebar. And provides the functions of quick copying and jumping to log platform inquiry. For example, cards including actions and time are presented chronologically at the time of presentation, and a click-on-card support detailed view.

Specifically, the determining, in response to the search request, a search result according to the stored index field and a presentation field having a dependency relationship with the index field includes: receiving a search field input for a search interface; determining an index field corresponding to the search field in response to a search request for the search field; and determining a display field corresponding to the search field according to the index field corresponding to the search field, and taking the display field as the search result. Wherein, the determining the display field corresponding to the search field according to the index field corresponding to the search field, as the search result, includes: determining a plurality of display fields corresponding to the search field according to the index field corresponding to the search field; filtering and/or grouping the plurality of display fields to obtain the search result; and displaying the search result.

In response to a search request for the search field, determining an index field corresponding to the search field: because the search field and the index field have a first mapping relation, the index field corresponding to the search field can be determined according to the currently input search field and the first mapping relation.

In an embodiment of the present disclosure, the search field may be a field input by a user, and the search field is a field for performing a search to obtain a search result corresponding to the input. The search field may be selected or determined according to the content of the log and the needs of the user, and may include, for example, an Identification (ID) of the log event, a time, a category, a keyword, etc., where the most important search field is the keyword. The index field may be a stored field for indexing. The index field and the search field have a mapping relation, and the index field and the display field also have a mapping relation. By way of example, the index field may include fields for Identification (ID) of the log event, time, category, keyword, containment relationship, context, storage structure, storage relationship, each log event association feature and distinguishing feature, etc. And determining a display field corresponding to the search field according to the index field corresponding to the search field, wherein the display field corresponds to the search result and can be a field for displaying the search result. Illustratively, the presentation field may include: topic, identification (ID), time, category, keyword, summary, primary content, etc. of the log event. The second mapping relationship is established between the index field and the presentation field through a common field, such as an Identification (ID), time, category, keyword, etc., of the log event, and is not limited thereto. As the search result: since the index field and the presentation field have a second mapping relationship; and according to the determined index field and the second mapping relation, determining a display field, and displaying the display field of the encapsulation SDK in a visual interface.

In addition, the display fields can be grouped and/or filtered, and the key information in the service scene can be displayed according to a certain sequence.

Fig. 2 shows a schematic diagram of a log SDK processing system architecture according to an embodiment of the disclosure. As shown in fig. 2, in connection with the flowchart description of fig. 1, in the log SDK processing system, firstly, a log SDK document is generated through field inspection and field injection, one-step reporting is performed in connection with server SDK reporting, reporting service is generated on a server, the same data processing service is performed on a message queue in a reporting party according to existing messages and the reporting end (end reporting) in a Message Queue (MQ) mode, different MQ fields are subjected to cleaning and current limiting configuration, structured data storage is performed according to an elastic search index structure, a full-link query platform is formed, a user searches the log SDK on the platform according to service scenes or requirements, and a search result is visually displayed in the platform.

The disclosed system may have platform visualization functionality, and in a search interface, a search field may have a variety of search terms: event module, event ID, keywords, time (start time, end time), unlimited PSM information, device ID, custom (error point, client, server), etc. The presentation field typically includes: topic, identification (ID), time, category, keyword, summary, primary content, etc. of the log event. The index field and the display field have a mapping relation through a shared field.

The specific retrieval process is as follows:

1. opening the platform, and viewing the search term;

2. the input search field can be selected input or filled input directly aiming at the existing search term;

3. if the service has a special search field, selecting a corresponding field in a last drop-down box for input or filling;

4. after clicking the search, the search direction of the expected attention of the service can be further screened by using post-filtering or sorting;

5. and generating a search result.

Fig. 3 shows a schematic diagram of a log processing apparatus according to another embodiment of the disclosure. The device comprises: a dependency module 301, a storage module 302 and a retrieval presentation module 303. Wherein:

the dependency module 301 is configured to determine a dependency relationship between the index field and the presentation field according to the log event.

In the present disclosure, the log processing system of the present disclosure is entirely divided into three parts: the system comprises a reporting part, a storage part and a query part. In the reporting stage of the log processing system, the problem log has a plurality of acquisition modes, and the method adopts an SDK mode to acquire and package the SDK to generate the packaged SDK. And establishing an index field and a presentation field for the log SDK, and associating the index field and the presentation field to form a dependency relationship of the index field and the presentation field. The dependency relationship is established, firstly, the event identification and the keywords of the service log SDK are obtained, and then the corresponding relationship between the index field and the display field is established through the event identification and the keywords.

Specifically, the dependency module is specifically configured to: generating a corresponding service log SDK according to the log event; acquiring event identification and keywords of the service log SDK; and establishing a corresponding relation between the index field and the display field through the event identification and the keywords.

The log processing apparatus further includes: and the field module is used for customizing the index field and the display field according to the service scene.

In the reporting stage of the log processing system, different service scenes have different index fields and display fields, and the number of the index fields is different in different scenes, so that the number of the display fields can be selectively displayed according to service requirements. The reported log SDKs can be classified or grouped according to categories, sequences, demands and the like, and a user or a system can arbitrarily formulate an index field and a corresponding display field according to service scenes, and can customize a service custom index field with high expansion flexibility. And the log processing system carries out training and learning on the formulated index fields and the presentation fields according to a training model to generate a corresponding log SDK document.

The field module is specifically configured to: acquiring a service scene according to service characteristics; and customizing an index field and a display field according to the service scene, wherein the index field represents the structural relation of the SDK, and the display field represents a visual retrieval interface for user retrieval.

The log processing apparatus further includes: and the reporting module is used for calling the encapsulation SDK to carry out asynchronous reporting according to the customized index field and the display field.

The reporting module is specifically configured to: providing a reporting interface of a full-link service end; establishing a mapping relation between the customized index field and the display field and the log SDK; encapsulating the log SDK according to the mapping relation; invoking the encapsulation SDK corresponding to the customized index field and the presentation field; and asynchronously reporting the encapsulation SDK through the reporting interface. Responding to a field configuration request, acquiring field configuration information, and configuring the index field and/or the display field according to the field configuration information; comprising the following steps: responding to the field configuration request, and displaying a configuration interface; and responding to input operation acted on the configuration interface, acquiring field configuration information corresponding to the input operation, and configuring the index field and/or the display field according to the field configuration information. The customized index field and the presentation field support service custom index field and presentation field, and extract necessary fields of the custom index field and presentation field to automatically inject into the encapsulation SDK.

The storage module 302 is configured to store the index field and the presentation field according to the dependency relationship.

In the storage phase of the log processing system, the storage uses a ES (Elasticsearch) index structure, which can be dynamically increased according to a Message Queue (MQ) mode, and the structured and prioritized key fields visually exhibit capabilities according to time sequence. Therefore, the field support is good for different index requirements for different services.

The storage module is specifically used for: the storing the index field and the presentation field according to the dependency relationship includes: establishing an index structure according to the index field; and carrying out structured storage on the index field and the display field according to the index structure in a message queue mode. In this embodiment, an index structure of the encapsulation SDK is established according to an index field of the log SDK; and carrying out structural storage on the encapsulation SDK according to the index structure in a Message Queue (MQ) mode. The index structure is a ES (Elasticsearch) index structure, and the ES index structure can increase or decrease index fields through a message queue according to service requirements.

The search presentation module 303 is configured to determine, in response to a search request, a search result according to the stored index field and a presentation field having a dependency relationship with the index field.

Specifically, the search display module is specifically configured to: receiving a search field input for a search interface; determining an index field corresponding to the search field in response to a search request for the search field; and determining a display field corresponding to the search field according to the index field corresponding to the search field, and taking the display field as the search result. Wherein, the determining the display field corresponding to the search field according to the index field corresponding to the search field, as the search result, includes: determining a plurality of display fields corresponding to the search field according to the index field corresponding to the search field; filtering and/or grouping the plurality of display fields to obtain the search result; and displaying the search result.

The search presentation module further comprises: and the retrieval module is used for retrieving the reported encapsulation SDK.

The search presentation module further comprises: and a presentation module 306, configured to display a presentation field having the dependency relationship with the index field according to the search.

And visually displaying the reported information according to the structural information reported by the user. Under the default view, each frame represents one report, and the reports are arranged according to the time sequence, so that the front-back relationship can be clearly seen. And presents the two most important pieces of information on the box: action and time. When the mouse moves to a certain reporting point, other important information can be automatically popped up. If more detailed information needs to be checked, a reporting point can be clicked, and the complete reporting information is checked in the popped right side sidebar. And provides the functions of quick copying and jumping to log platform inquiry.

The display module is specifically used for: inputting a search field to search in a search interface, wherein the search field and the index field have a first mapping relation; and according to the second mapping relation between the index field and the display field, displaying the display field of the packaged SDK in a visual interface according to the input search field, the first mapping relation and the second mapping relation. And grouping and/or filtering the display fields, and displaying the key information in the service scene according to a certain sequence.

The apparatus shown in fig. 3 may perform the method of the embodiment shown in fig. 1, and reference is made to the relevant description of the embodiment shown in fig. 1 for parts of this embodiment not described in detail. The implementation process and the technical effect of this technical solution refer to the description in the embodiment shown in fig. 1, and are not repeated here.

A schematic structural diagram of an electronic device 400 suitable for use in implementing another embodiment of the present disclosure is shown below with reference to fig. 4. The terminal devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and the like, and stationary terminals such as digital TVs, desktop computers, and the like.

As shown in fig. 4, the electronic device 400 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 401, which may perform various suitable actions and processes according to a program stored in a Read Only Memory (ROM) 402 or a program loaded from a storage means 408 into a Random Access Memory (RAM) 403. In the RAM 403, various programs and data necessary for the operation of the electronic device 400 are also stored. The processing device 401, the ROM 402, and the RAM 403 are connected to each other by a communication line 404. An input/output (I/O) interface 405 is also connected to the communication line 404.

In general, the following devices may be connected to the I/O interface 405: input devices 406 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; an output device 407 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 408 including, for example, magnetic tape, hard disk, etc.; and a communication device 409. The communication means 409 may allow the electronic device 400 to communicate with other devices wirelessly or by wire to exchange data. While fig. 4 shows an electronic device 400 having various means, it is to be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may be implemented or provided instead.

In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a non-transitory computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network via communications device 409, or from storage 408, or from ROM 402. The above-described functions defined in the methods of the embodiments of the present disclosure are performed when the computer program is executed by the processing device 401.

It should be noted that the computer readable medium described in the present disclosure may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present disclosure, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.

In some implementations, the clients, servers may communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol ), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the internet (e.g., the internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed networks.

The computer readable medium may be contained in the electronic device; or may exist alone without being incorporated into the electronic device.

The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: the interaction method in the above embodiment is performed.

Computer program code for carrying out operations of the present disclosure may be written in one or more programming languages, including, but not limited to, an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units involved in the embodiments of the present disclosure may be implemented by means of software, or may be implemented by means of hardware. Wherein the names of the units do not constitute a limitation of the units themselves in some cases.

The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a system on a chip (SOC), a Complex Programmable Logic Device (CPLD), and the like.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

According to one or more embodiments of the present disclosure, there is provided an electronic device including: at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform any one of the methods of the first aspect.

According to one or more embodiments of the present disclosure, there is provided a non-transitory computer-readable storage medium, characterized in that the non-transitory computer-readable storage medium stores computer instructions for causing a computer to perform any of the methods of the foregoing first aspect.

The foregoing description is only of the preferred embodiments of the present disclosure and description of the principles of the technology being employed. It will be appreciated by persons skilled in the art that the scope of the disclosure referred to in this disclosure is not limited to the specific combinations of features described above, but also covers other embodiments which may be formed by any combination of features described above or equivalents thereof without departing from the spirit of the disclosure. Such as those described above, are mutually substituted with the technical features having similar functions disclosed in the present disclosure (but not limited thereto).

Claims

1. A log processing method, comprising:

2. The method of claim 1, wherein determining the dependency of the index field and the presentation field based on the log event comprises:

acquiring event identification and keywords according to the log event;

3. The method as recited in claim 1, further comprising: and determining the index field and the display field according to the service scene.

4. The method of claim 1, further comprising, prior to storing: and asynchronously reporting the index field and the display field with the dependency relationship with the index field.

5. The method of claim 4, wherein asynchronously reporting the index field and the presentation field having a dependency relationship with the index field comprises:

6. Method according to claim 1, characterized in that in response to a field configuration request, field configuration information is obtained, according to which the index field and/or presentation field are configured.

7. The method of claim 6, wherein obtaining field configuration information in response to a field configuration request, configuring the index field and/or the presentation field according to the field configuration information, comprises:

8. The method of claim 1, wherein storing the index field and the presentation field according to the dependency relationship comprises:

establishing an index structure according to the index field;

9. The method of claim 8, wherein the index structure is an ES index structure.

10. The method of claim 1, wherein determining, in response to a search request, a search result from the stored index field and a presentation field having a dependency relationship with the index field, comprises:

receiving a search field input for a search interface;

11. The method according to claim 10, wherein determining a presentation field corresponding to the search field according to an index field corresponding to the search field, as the search result, comprises:

and displaying the search result.

12. A log processing apparatus, comprising:

13. An electronic device, comprising:

a memory for storing computer readable instructions; and

a processor for executing the computer readable instructions to cause the electronic device to implement the method according to any one of claims 1-11.

14. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the log processing method of any one of claims 1 to 11.