Summary of the invention
The embodiment of the invention is to provide a kind of log processing method, a kind of log processing equipment and a kind of log processing system, by the profile information that is provided with journal file is put in order, generate the structural data of business item correspondence, solve the high problem of development cost in the prior art, shortened the construction cycle.
In order to reach above-mentioned technique effect, the embodiment of the invention has proposed a kind of log processing method, comprising:
Obtain the journal file that network side sends;
Put described journal file in order according to the profile information that sets in advance;
The fileinfo of putting in order out is treated to the structural data corresponding with business item, and described structural data is stored in the structured storage system.
Preferably, described log processing method also comprises:
Statistical demand real time modifying profile information according to business item.
Preferably, the profile information that sets in advance of the described basis step of putting described journal file in order comprises:
Described journal file is put out in order the fileinfo of business item statistical demand according to described profile information.
Preferably, described the file process of putting in order the out step for the structural data corresponding with business item is comprised:
Periodically call the fileinfo that the real-time processing scripts analysis and arrangement of business item correspondence goes out, generate the structural data corresponding with business item.
Preferably, after the step of the structural data that described generation is corresponding with business item, also comprise:
According to described structural data the health status of business is monitored, and the processing of reporting to the police; Or/and
According to described structural data traffic hotspots is found and automatic early-warning automatically.
Correspondingly, the embodiment of the invention discloses a kind of log processing equipment, comprising:
Acquisition module is used to obtain the journal file that network side sends;
Sorting module is used for putting the journal file that described acquisition module obtains in order according to the profile information that sets in advance;
The structuring processing module is used for the fileinfo that described sorting module is put in order out is treated to the structural data corresponding with business item, and described structural data is stored in the structured storage system.
Preferably, described log processing equipment also comprises:
Profile information is provided with module, is used for the statistical demand real time modifying profile information according to business item.
Preferably, described sorting module is provided with the journal file that the profile information of module setting obtains described acquisition module and puts out the fileinfo of business item statistical demand in order according to described profile information.
Preferably, described structuring processing module comprises:
Analyze generation unit, the real-time processing scripts that is used for periodically calling the business item correspondence is analyzed the fileinfo that described sorting module is put in order out, generates the structural data corresponding with business item;
Transmitting element is used for that the described structural data that described analysis generation unit generates is sent to the structured storage system and stores.
Correspondingly, the embodiment of the invention discloses a kind of log processing system, comprise network side server and daily record distributor, described log processing system also comprises at least one log processing equipment, and described log processing equipment is above-mentioned log processing equipment;
Described network side server sends to described daily record distributor with the journal file that generates, described daily record distributor is transmitted described journal file to described log processing equipment according to the load balancing strategy, by described log processing equipment described journal file is handled.
Preferably, described log processing system also comprises at least one structured storage system, is used for structured data.
Preferably, described log processing system also comprises:
Monitoring alarm equipment is used for according to described structural data the health status of business being monitored, and the processing of reporting to the police; Or/and
Find source of early warning, be used for traffic hotspots being found and automatic early-warning automatically according to described structural data.
Implement the embodiment of the invention, by the profile information that is provided with journal file is put in order, generate the structural data of business item correspondence, solved the high problem of development cost in the prior art, shortened the construction cycle, improved disposal ability to massive logs, by revising profile information in real time, agility satisfies various statistical demand neatly fast, obtain statistics in real time, and can carry out the dilatation of system by adding log processing equipment and structured storage system neatly, and the automatic in real time discovery and the automatic early-warning of supporting business focus, can accomplish to report to the police automatically in real time to the health status of system business module.
Embodiment
In order to make technical problem to be solved by this invention, technical scheme and beneficial effect clearer,, the present invention is further elaborated below in conjunction with drawings and Examples.
See also the schematic flow sheet of the embodiment of the invention log processing method shown in Fig. 2, comprising:
Step S201: obtain the journal file that network side sends;
Particularly, journal file is to be generated according to specific form by network side server, as, " key=value " form of cutting apart with " || " etc., this network side server can be web server or service server etc., corresponding log system has: log4j, log4cxx, log4cplus or the like, network side server can pass through User Datagram Protocol (UDP, User Datagram Protocol) mode sends to the daily record distributor with the journal file that generates, the daily record distributor is transmitted log processing equipment to local terminal with the journal file received in the UDP mode according to the load balancing strategy, and log processing equipment gets access to the journal file that network side sends.Need to prove that this log processing equipment is the platform of handling magnanimity Internet service log information, have general, but real-time collecting and handle the massive logs informational function.
Step S202: put described journal file in order according to the profile information that sets in advance;
Particularly, log processing equipment sets in advance profile information according to the statistical demand of business item, this profile information comprises the business item information of needs statistics, the platform of promptly handling magnanimity Internet service log information is provided with this profile information in advance, configuration file as the txt form, the technical staff only needs to fill in corresponding profile information according to form can finish setting, need add up a certain index (as number) of certain business as the technical staff, the technical staff only need open the profile information that the configuration file of txt form fills in number item correspondence according to form and gets final product so, log processing equipment will be put described journal file in order according to the profile information of the number item correspondence that sets, particularly, the journal file that for example obtains is cut apart " key=value " form and is produced with " || ", log processing equipment is that the relevant information of number is put in order with the key in the journal file so, as, putting in order out with the number is one group of file of filename.
Step S203: the fileinfo of putting in order out is treated to the structural data corresponding with business item, and described structural data is stored in the structured storage system.
Particularly, log processing equipment is handled the fileinfo of putting in order out among the step S202, the project of needs statistics is treated to structural data, and be stored in the structured storage system, the structured storage system can be relevant database, the perhaps structured storage system of BigTable type is as hadoop/hbase etc.Subsequently, relevant business datum analytical equipment can directly be carried out the further analysis of data apace according to the structural data that is stored in the structured storage system, as carry out the related services such as generation, business datum contrast, business datum inquiry of business datum form, perhaps directly provide online service to use.
Need to prove, the technical staff can revise profile information in real time according to the statistical demand of business item, promptly, log processing equipment according to the technical staff in real time retouching operation can delete, change profile information in real time or add statistical item or log processing function, the profile information of real time modifying can come into force, need not to restart log processing equipment in real time, greatly reduce the required cost of exploitation of finishing said function in the prior art, simplified flow process, save the time, thereby improved log processing efficient.
Need to prove that also log processing equipment can be expanded by starting a plurality of examples, promptly can expand daily record distributor proof load equilibrium by adding log processing equipment and structured storage system neatly.
Further, step S203 can be specially, log processing equipment periodic ground (as per 5 minutes) calls the fileinfo that the real-time processing scripts analytical procedure S202 of business item correspondence puts in order out, generate the structural data corresponding with business item, as, the real-time processing scripts of log processing equipment periodic ground number of calls statistical item correspondence, analysis is one group of file of filename with the number, generate the structural data corresponding, then described structural data is stored in the structured storage system with the number statistical project.
Again further, behind the step S203, monitoring alarm equipment can be monitored the health status of business according to the structural data in certain one-period, and the processing of reporting to the police, or the discovery source of early warning can be found and automatic early-warning traffic hotspots automatically according to described structural data, as popular list, focus, user visitor, the statistics of data such as user trajectory, and by mail or SMS notification technical staff or other associated users, current can being applied to searched, picture searching, music searching, video search, Blog Search, the QQ bookmark, go in search Waltz or the like.
Describe the schematic flow sheet of log processing method of the present invention above in detail, below accordingly, describe the structure of the log processing system of the embodiment of the invention in detail.
The structural representation of the log processing system of the embodiment of the invention as shown in Figure 3, log processing system comprises network side server 31, daily record distributor 32, at least one log processing equipment 33 and at least one structured storage system 34, particularly, log processing system also can comprise a plurality of network side servers 31 and daily record distributor 32, present embodiment is to comprise a network side server 31, a daily record distributor 32, a log processing equipment 33 and a structured storage system 34 describe for example, network side server 31 sends to daily record distributor 32 with the journal file that generates, daily record distributor 32 is transmitted described journal file to log processing equipment 33 according to the load balancing strategy, handle by 33 pairs of described journal files of log processing equipment, log processing equipment 33 is the platform of handling magnanimity Internet service log information, have general, but real-time collecting and processing massive logs informational function, the daily record data after log processing equipment 33 will be handled stores in the structured storage system 34.
Log processing equipment 33 comprises acquisition module 331, sorting module 332 and structuring processing module 333, wherein
Acquisition module 331 is used to obtain the journal file that network side sends;
Particularly, journal file is to be generated according to specific form by network side server 31, as, " key=value " form of cutting apart with " || " etc., network side server 31 can be web server or service server etc., corresponding log system has: log4j, log4cxx, log4cplus or the like, network side server 31 can send to daily record distributor 32 with the journal file that generates by the UDP mode, daily record distributor 32 is transmitted the journal file of receiving to log processing equipment 33 in the UDP mode according to the load balancing strategy, and the acquisition module 331 of log processing equipment 33 gets access to journal file.
Sorting module 332 is used for putting the journal file that acquisition module 331 obtains in order according to the profile information that sets in advance;
Particularly, log processing equipment 33 sets in advance profile information according to the statistical demand of business item, this profile information comprises the business item information of needs statistics, the platform of promptly handling magnanimity Internet service log information is provided with this profile information in advance, configuration file as the txt form, the technical staff only needs to fill in corresponding profile information according to form can finish setting, need add up a certain index (as number) of certain business as the technical staff, the technical staff only need open the profile information that the configuration file of txt form fills in number item correspondence according to form and gets final product so, sorting module 332 will be put described journal file in order according to the profile information of the number item correspondence that sets, particularly, for example the journal file that obtains of acquisition module 331 is cut apart " key=value " form and is produced with " || ", sorting module 332 is that the relevant information of number is put in order with the key in the journal file so, as, putting in order out with the number is one group of file of filename.
Structuring processing module 333 is used for the fileinfo that sorting module 332 is put in order out is treated to the structural data corresponding with business item, and described structural data is stored in the structured storage system 34.
Particularly, structured storage system 34 can be relevant database, and the perhaps structured storage system of BigTable type is as hadoop/hbase etc.Subsequently, relevant business datum analytical equipment can directly be carried out the further analysis of data apace according to the structural data that is stored in the structured storage system 34, as carry out the related services such as generation, business datum contrast, business datum inquiry of business datum form, perhaps directly provide online service to use.
Below in conjunction with Fig. 4, further specify the structure of log processing equipment 33 in the embodiment of the invention, log processing equipment 33 comprises acquisition module 331, outside sorting module 332 and the structuring processing module 333, comprise that also profile information is provided with module 334, be used for statistical demand real time modifying profile information according to business item, particularly, the technical staff can be provided with module 334 by profile information according to the statistical demand of business item and revise profile information in real time, promptly, profile information is provided with module 334 and can deletes profile information in real time, change or interpolation statistical item or log processing function, the profile information of real time modifying can come into force in real time, need not to restart log processing equipment, greatly reduce the required cost of exploitation of finishing said function in the prior art, simplified flow process, save the time, thereby improved log processing efficient; Sorting module 332 is provided with the journal file that profile information that module 334 is provided with obtains acquisition module 331 according to profile information and puts out the fileinfo of business item statistical demand in order.
Further, structuring processing module 333 comprises: analyze generation unit 3331 and transmitting element 3332, wherein
Analyze the fileinfo that real-time processing scripts analysis and arrangement module 332 that generation unit 3331 is used for periodically calling the business item correspondence is put in order out, generate the structural data corresponding with business item;
Transmitting element 3332 is used for analyzing described structural data that generation unit 3331 generates and sends to structured storage system 34 and store.
Particularly, analyze generation unit 3331 periodically (as per 5 minutes) call the fileinfo that the real-time processing scripts analysis and arrangement module 332 of business item correspondence is put in order out, generate the structural data corresponding with business item, as, analyze the periodically real-time processing scripts of number of calls statistical item correspondence of generation unit 3331, analysis is one group of file of filename with the number, generate the structural data corresponding, by transmitting element 3332 described structural data is stored in the structured storage system 34 then with the number statistical project.
The structural representation of another embodiment of log processing system of the present invention as shown in Figure 5, log processing system comprises outside network side server 31, daily record distributor 32, log processing equipment 33 and the structured storage system 34, also comprise monitoring alarm equipment 35 and find source of early warning 36, wherein
Monitoring alarm equipment 35 is used for according to described structural data the health status of business being monitored, and the processing of reporting to the police;
Find that source of early warning 36 is used for according to described structural data traffic hotspots being found and automatic early-warning automatically.
Particularly, monitoring alarm equipment 35 can be monitored the health status of business according to the structural data in certain one-period, and the processing of reporting to the police, and discovery source of early warning 36 can be found and automatic early-warning traffic hotspots automatically according to described structural data, as popular list, focus, user visitor, the statistics of data such as user trajectory, and by mail or SMS notification technical staff or other associated users, current can being applied to searched, picture searching, music searching, video search, Blog Search, the QQ bookmark, go in search Waltz or the like.
Need to prove that log processing equipment 33 can be expanded by starting a plurality of examples, log processing system promptly can be expanded the 32 proof load equilibriums of daily record distributor by adding log processing equipment 33 and structured storage system 34 neatly.
In sum, pass through the foregoing description, according to the profile information that is provided with journal file is put in order, generate the structural data of business item correspondence, solved the high problem of development cost in the prior art, shortened the construction cycle, improved disposal ability to massive logs, by revising profile information in real time, agility satisfies various statistical demand neatly fast, obtain statistics in real time, and can carry out the dilatation of system by adding log processing equipment and structured storage system neatly, and the automatic in real time discovery and the automatic early-warning of supporting business focus, can accomplish to report to the police automatically in real time to the health status of system business module.
Need to prove that through the above description of the embodiments, those skilled in the art can be well understood to the present invention and can realize by the mode that software adds essential hardware platform, can certainly all implement by hardware.Based on such understanding, all or part of can the embodying that technical scheme of the present invention contributes to background technology with the form of software product, this computer software product can be stored in the storage medium, as ROM/RAM, magnetic disc, CD etc., comprise that some instructions are with so that a computer equipment (can be a personal computer, server, the perhaps network equipment etc.) carry out the described method of some part of each embodiment of the present invention or embodiment.
Above disclosed only is preferred embodiment in the embodiment of the invention, can not limit the present invention's interest field certainly with this, and therefore the equivalent variations of doing according to claim of the present invention still belongs to the scope that the present invention is contained.