JP7023612B2 - Log structure visualization device, log structure visualization method, and program - Google Patents

Description

The present invention relates to a log structure visualization device, a log structure visualization method, and a program.

Various logs are collected on the network (see, for example, Patent Document 1). In addition, the computer device stores its own action log.

Japanese Unexamined Patent Publication No. 2016-163140

Logs can take various structures. The definition information of the log may be described in text, but the definition information described in text may not be such that the structure can be understood at a glance when a person visually recognizes it.

The present invention has been made in consideration of such circumstances, and one of the objects of the present invention is to generate a display screen in which the structure of a log can be easily understood.

One aspect of the present invention is an acquisition unit that acquires log definition information described in text, and a log structure defined by the log definition information based on the log definition information acquired by the acquisition unit. It is a log structure visualization device including a generation unit for generating information for visualizing and displaying.

According to one aspect of the present invention, it is possible to generate a display screen in which the structure of the log can be easily understood.

It is a figure which shows an example of the use environment of a log structure visualization apparatus. It is a figure which shows an example of the log 110. It is a figure which shows an example of the schema definition information 120. It is a functional block diagram of the terminal apparatus 10 when it functions as a log structure visualization apparatus. It is a figure which shows an example of the screen IM based on the web page downloaded from the 2nd server 200. It is a figure which shows how the structure of a log is visualized and displayed on the screen IM. It is a figure (the 1) which shows an example of the schema definition information including the element which is difficult to perform automatic analysis. It is a figure which shows an example of the contents of the result display column A4 output by the visualization information generation unit 22 based on the schema definition information shown in FIG. 7. It is a figure which shows an example of the log corresponding to the schema definition information shown in FIG. 7. It is a figure (the 1) which shows an example of the contents of the result display column A4 which is added / edited by a user. It is a figure (the 2) which shows an example of the schema definition information including the element which is difficult to perform automatic analysis. It is a figure which shows an example of the log corresponding to the schema definition information shown in FIG. It is a figure (No. 2) which shows an example of the contents of the result display column A4 which is added / edited by a user. It is a figure (3) which shows an example of the schema definition information including the element which is difficult to perform automatic analysis. It is a figure which shows an example of the log corresponding to the schema definition information shown in FIG. It is a figure (3) which shows an example of the contents of the result display column A4 which is added / edited by a user. It is a flowchart which shows an example of the flow of processing executed by a log structure visualization apparatus.

Hereinafter, an embodiment of the log structure visualization device, the log structure visualization method, and the program of the present invention will be described with reference to the drawings. The log structure visualization device is realized by installing the program on a computer having a processor. Here, the installation includes not only the state of being permanently stored in the non-volatile storage device but also the state in which the program (plug-in) attached to the web page is downloaded to the terminal device and temporarily executed. .. As another aspect, the log structure visualization device may be a server device that provides a cloud service. In the following description, it is assumed that the terminal device from which the plug-in is downloaded operates as a log structure visualization device. Further, the terminal device is a personal computer provided with a keyboard and a mouse, but may be a smartphone or a tablet terminal operated by a touch panel.

FIG. 1 is a diagram showing an example of the usage environment of the log structure visualization device. For example, one or more terminal devices 10, a first server 100, and a second server 200 are connected to the illustrated network NW. The network NW includes, for example, a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, and the like.

The terminal device 10 is a computer device used by a user, and has a CPU (Central Processing Unit) and other processors for executing a program.

The first server 100 stores the log 110 in the storage unit. The first server 100 is, for example, a web server, and collects user logs, access logs, and the like as logs 110. Further, the first server 100 stores the schema definition information 120, which is the definition information of the log 110 described in text, in the storage unit. In the following description, when the term "storage unit" is used, it is realized by some or all of various storage devices such as HDD (Hard Disk Drive), flash memory, RAM (Random Access Memory), and ROM (Read Only Memory). It shall refer to the storage part to be stored.

FIG. 2 is a diagram showing an example of the log 110. The first line of the log 110 shown in FIG. 2 is the data updated to "timestamp" = "1", that is, the time "1" for the user with the user ID "userid" = "a", that is, "a". Yes, it indicates that "value" = "C ⁺⁺ ", that is, the data of interest is "C ⁺⁺ ". The log 110 shown in FIG. 2 is a log in which the programming languages preferred by each user are collected.

FIG. 3 is a diagram showing an example of the schema definition information 120. The schema definition information 120 is described in text. The schema definition information 120 shown in FIG. 3 has a “namespace” indicating the name of one schema definition information, a “type” indicating the format of the target log 110, a “name” indicating the name of the schema, and a structure of the log 110. It defines "fields" etc. shown in the text string.

Returning to FIG. 1, the second server 200 provides a web page 210 containing a plug-in. Further, the second server 200 stores the log structure information 220 created by executing the plug-in in the storage unit.

FIG. 4 is a functional configuration diagram of the terminal device 10 when functioning as a log structure visualization device. The terminal device 10 includes, for example, a communication unit 12, an input unit 14, a display unit 16, a browser function unit 18, a schema definition information acquisition unit 20, a visualization information generation unit 22, an information management unit 24, and storage. A unit 26 is provided.

The communication unit 12 is a communication interface such as a NIC (Network Interface Card) or a wireless communication module. The input unit 14 includes a keyboard, a mouse, and the like. The display unit 16 is an LCD (Liquid Crystal Display), an organic EL (Electroluminescence) display device, or the like.

The browser function unit 18 is realized by executing the browser program stored in the storage unit 26 by the processor. The browser function unit 18 acquires a web page from a link destination designated by the user, and causes the display unit 16 to display a screen based on the web page.

The schema definition information acquisition unit 20, the visualization information generation unit 22, and the information management unit 24 are realized by executing a plug-in attached to a web page by a processor. Hereinafter, these functions will be described with reference to the screen displayed by the display unit 16.

FIG. 5 is a diagram showing an example of a screen IM based on a web page downloaded from the second server 200.

On the screen IM, for example, as an input element for instructing a new analysis, the first input field A1 for directly inputting the reference destination of the schema definition information 120 and the reference destination of the schema definition information 120 are displayed so as to be selectable. The first reference instruction switch S1 for instructing the analysis, the log type specification switch S2 for designating the type of the log to be analyzed, and the analysis execution instruction switch S3 for instructing the analysis execution are included. The type of log may not be specified by the user, but may be automatically determined by the visualization information generation unit 22. In this case, the visualization information generation unit 22 automatically determines the type of the log based on the specific symbol or text string included in the schema definition information 120, the schema definition information, or the meta information embedded in the log. ..

Further, on the screen IM, for example, as an input element for instructing the acquisition of the existing result, the second input field A2 for directly inputting the reference destination of the analysis result and the reference destination of the analysis result are displayed in a selectable manner. The second reference instruction switch S4 for instructing the import of the analysis result and the import instruction switch S5 for instructing the import of the analysis result are included.

Further, the screen IM includes a text box A3 and a result display column A4 for displaying the analysis result. Since the state of FIG. 5 shows the state before the new analysis or the acquisition of the existing result is performed, the result display column A4 is blank.

[New analysis]
The schema definition information 120 of the target log (hereinafter referred to as the target log) for which the structure is to be analyzed may be obtained by (1) inputting the identification information of the storage destination folder of the first server 100 in the first input field A1. (2) Obtained by selecting one folder from the list information of the storage destination folders of the first server 100 displayed by operating the first reference instruction switch S1. When any of the above operations is performed, the schema definition information acquisition unit 20 requests the first server 100 to send an example of the corresponding schema definition information 120 and the corresponding log 110. When the schema definition information 120 is acquired, the acquired log 110 and the schema definition information 120 are displayed in the text box A3.

Instead of such processing, the log and schema definition information (those not acquired from the first server 100) may be directly input to the text box A3 by copy and paste or the like. Hereinafter, in order not to distinguish between them, they are simply referred to as log or schema definition information.

When the analysis execution switch S3 is operated while the schema definition information is displayed in the text box A3, the visualization information generation unit 22 visualizes the log structure defined by the schema definition information based on the schema definition information. Generate information for display. Specifically, the visualization information generation unit 22 generates information to be displayed in the result display column A4 and adds it to the screen IM.

In the case of the schema definition information illustrated in FIG. 3, the visualization information generation unit 22 pays attention to the part below “fields”, for example, the area surrounded by “{}” indicates one item set, and “,”. The structure of the log is recognized according to the known rule that the item name and type are shown before and after, and the label is before the ":" and the information is after the ":". That is, the visualization information generation unit 22 recognizes the log structure with reference to the positions of specific symbols such as “{}”, “,”, and “:”.

FIG. 6 is a diagram showing how the log structure is visualized and displayed on the screen IM. As shown in the figure, the visualization information generation unit 22 has a "field name" corresponding to "name" and a "type" corresponding to "type" grasped from the part dependent on "fields" of the schema definition information. Separately, the log is structured and displayed on the display unit 16. The type is, for example, information indicating whether it is a string type (character string type) or a long type (numeric type).

[Add, Edit]
The item of "field explanation" in FIG. 6 is not automatically generated by the visualization information generation unit 22, but may be input by the user. The user inputs the corresponding information in each field of the result display field A4 while looking at the text box A3. Also, as shown by string (100) in the figure, if the maximum length of the item is known, the user may add parentheses and their contents. In the following description of FIG. 6, the underlined items in the result display column A4 indicate information input by the user, not automatically generated by the visualization information generation unit 22. It shall be.

Further, a result storage instruction switch S6 or the like is set around the result display column A4. When the result storage switch S6 is operated, the information management unit 24 uploads the content (stored in the RAM at any time) displayed in the result display field A4 at that time to the second server 200. This uploaded information becomes the log structure information 220.

[Get existing results]
Returning to FIG. 5, the log structure information 220 is operated by (1) inputting the identification information of the storage destination folder of the second server 200 in the second input field A2, or (2) the second reference instruction switch S4. It is acquired by selecting one folder from the list information of the storage destination folders of the second server 200 displayed. When any of the above operations is performed, the information management unit 24 requests the second server 200 to transmit the corresponding log structure information 220. When the log structure information 220 is acquired, the log structure information 220 is displayed in the result display column A4. With such a function, the log structure information 220 edited by one user can be viewed by another user.

[Applied example]
Hereinafter, more applied examples will be described. FIG. 7 is a diagram (No. 1) showing an example of schema definition information including elements that are difficult to analyze automatically. According to the log rules exemplified so far, the type described as map indicates that the item in the lower hierarchy is included in the type. FIG. 8 is a diagram showing an example of the contents of the result display column A4 output by the visualization information generation unit 22 based on the schema definition information shown in FIG. 7. Since the maximum number of items is specified for the map, the visualization information generation unit 22 causes the display unit 16 to display the map {} in order to prompt the input of the maximum number in the curly braces.

FIG. 9 is a diagram showing an example of a log corresponding to the schema definition information shown in FIG. 7. While looking at this log, the user adds / edits to the result display column A4. FIG. 10 is a diagram (No. 1) showing an example of the contents of the result display column A4 that is added / edited by the user. First, the user recognizes that there are two items like and dislike in the value, and inputs "2" in the curly braces of map {}. Then, the visualization information generation unit 22 automatically adds two lines for inputting the lower hierarchy of value. A switch for instructing the addition of a line may be provided on the screen IM. In addition, the visualization information generation unit 22 automatically determines that two items, like and dislike, exist in the value based on the existence of "," in the {} immediately after the value, and ". 2 ”may be automatically displayed, and two lines for inputting the lower hierarchy of value may be automatically added.

Then, the user completes the content of the result display column A4 by adding the information of the underlined portion other than "2". As for the types of items value.like and value.dislike, it is defined in the schema definition information that the type of the upper map is string, so visualization information is generated when a row is automatically added. The process of automatically adding and displaying is performed by the unit 22 (automatic replenishment of the contents described later).

FIG. 11 is a diagram (No. 2) showing an example of schema definition information including elements that are difficult to analyze automatically. Further, FIG. 12 is a diagram showing an example of a log corresponding to the schema definition information shown in FIG. This schema definition information includes a map in the lower hierarchy of the map. In this case, the procedure for adding / editing the result display column A4 is performed as shown in FIG. FIG. 13 is a diagram (No. 2) showing an example of the contents of the result display column A4 that is added / edited by the user. In this case, the result display column A4 is completed by repeating the work as described with reference to FIG. 10 twice.

FIG. 14 is a diagram (No. 3) showing an example of schema definition information including elements that are difficult to analyze automatically. Further, FIG. 15 is a diagram showing an example of a log corresponding to the schema definition information shown in FIG. This schema definition information includes an array in the type. An array indicates a structure containing a plurality of arrays having different labels. The procedure for adding / editing the result display column A4 in this case is performed as shown in FIG. FIG. 16 is a diagram (No. 3) showing an example of the contents of the result display column A4 that is added / edited by the user. This log structure has a plurality of data series with different "likes and dislikes", which are represented by an array. Therefore, if a number is entered in the curly braces of array {}, only one line may be added.

FIG. 17 is a flowchart showing an example of the flow of processing executed by the log structure visualization device. First, the log structure visualization device acquires the schema definition information and the log (S100) and displays them in the text box (S102). Next, the log structure visualization device determines whether or not the analysis execution is instructed (S104).

When the analysis execution is instructed, the log structure visualization device recognizes the log structure based on the schema definition information (S106), and the log structure is automatically recognized in the result display column A4. Information indicating the above is displayed (S108).

Next, the log structure visualization device determines whether or not the addition / editing operation has been performed by the user (S110). When the addition / editing operation is performed by the user, the log structure visualization device reflects the content of the addition / editing operation in the result display column A4 (S112), and determines whether or not the line addition is necessary (S114). ). When it is necessary to add a row, the log structure visualization device adds a row and automatically replenishes the contents (S116).

When a negative determination is obtained in S110 or S114, or after the processing of S116, the log structure visualization device determines whether or not an instruction to save the result has been given (S120). The log structure visualization device returns the process to S110 when the result saving instruction is not given, uploads the data when the result saving instruction is given (S120), and ends the process of this flowchart.

According to the log structure visualization device, the log structure visualization method, or the program of the first embodiment described above, the schema definition information acquisition unit 20 for acquiring the schema definition information which is the definition information of the log described in text, and the schema. By providing a visualization information generation unit 22 that generates information for visualizing and displaying the structure of the log defined by the schema definition information based on the schema definition information acquired by the definition information acquisition unit 20. It is possible to generate a display screen so that the structure of the log can be easily understood.

Although the embodiments for carrying out the present invention have been described above using the embodiments, the present invention is not limited to these embodiments, and various modifications and substitutions are made without departing from the gist of the present invention. Can be added.

10 Terminal device 12 Communication unit 14 Input unit 16 Display unit 18 Browser function unit 20 Schema definition information acquisition unit 22 Visualization information generation unit 24 Information management unit 26 Storage unit 100 First server 200 Second server

Claims (9)

An acquisition unit that acquires the definition information of the log described in text, and
A generation unit that generates information for visualizing and displaying the log structure defined by the definition information of the log based on the definition information of the log acquired by the acquisition unit is provided.
The information for visualization and display includes at least the name, type, and description of the field described in the log.
The generator adds a line containing the name, the type, and the description based on the input operation performed on the input unit.
The generator adds a number of rows corresponding to the value entered in the type.
Log structure visualization device. The generator recognizes the structure of the log with reference to the position of a specific symbol included in the definition information of the log.
The log structure visualization device according to claim 1. The generation unit further adds or edits the generated information based on the input operation performed on the input unit.
The log structure visualization device according to claim 1 or 2. Further, the generation unit can be automatically replenished based on the input operation performed on the input unit and the definition information of the log in response to the input operation performed on the input unit. Is added to the generated information,
The log structure visualization device according to claim 3. The generation unit automatically determines the type of log defined in the definition information of the log based on the definition information of the log acquired by the acquisition unit, and determines the structure of the log based on the determination result. Generate information for visualization and display,
The log structure visualization device according to any one of claims 1 to 4. The generation unit determines the type of log defined in the definition information of the log based on the input operation performed on the input unit, and visualizes and displays the structure of the log based on the determination result. The log structure visualization device according to any one of claims 1 to 4, which generates information for the purpose. An information management unit is further provided, in which information generated by the generation unit is stored in a storage unit together with identification information, and information is read from the storage unit and returned in response to a request for specifying the identification information.
The log structure visualization device according to any one of claims 1 to 6. The computer
Get the definition information of the log described in the text,
Based on the acquired log definition information, information for visualizing and displaying the log structure defined in the log definition information is generated.
The information for visualization and display includes at least the name, type, and description of the field described in the log.
Based on the input operation performed on the input unit , a line containing the name, the type, and the description is added.
Add the number of rows corresponding to the value entered in the type ,
Log structure visualization method. On the computer
Get the definition information of the log described in the text
Based on the acquired log definition information, information for visualizing and displaying the log structure defined in the log definition information is generated.
The information for visualization and display includes at least the name, type, and description of the field described in the log.
Based on the input operation performed on the input unit , a line containing the name, the type, and the description is added.
Add the number of rows corresponding to the value entered in the type ,
program.

Images