CN114995973A

CN114995973A - Log processing method, nonvolatile storage medium, and log processing device

Info

Publication number: CN114995973A
Application number: CN202210536815.6A
Authority: CN
Inventors: 李潇潇; 于亚东; 曹国荣
Original assignee: Jushi Group Co Ltd
Current assignee: Jushi Group Co Ltd
Priority date: 2022-05-17
Filing date: 2022-05-17
Publication date: 2022-09-02
Anticipated expiration: 2042-05-17
Also published as: CN114995973B

Abstract

The invention provides a log processing method, a nonvolatile storage medium and a log processing device, comprising: acquiring an original log of an internal system, and extracting the original log of the internal system to acquire a keyword in the original log of the internal system and service data corresponding to the keyword; compiling a tree graph, comparing the keywords with the node contents in the tree graph from high to low according to the node hierarchy to obtain hit nodes matched with the keywords in the tree graph, and obtaining an external calling interface of an external system according to the hit nodes; and sending the service data to an external calling interface to call the external system operation. By the technical scheme provided by the invention, the technical problem that a plurality of systems cannot be cooperatively operated in the prior art can be solved.

Description

Log processing method, nonvolatile storage medium, and log processing device

Technical Field

The present invention relates to the technical field of multi-system cooperative work, and in particular, to a log processing method, a nonvolatile storage medium, and a log processing apparatus.

Background

At present, in the prior art, under a digital production environment of a manufacturing industry, a plurality of information systems, such as common systems of ERP, MES, SCADA, DCS, OA, WMS, and the like, are generally deployed, and each system in the systems generally has a specific function range and independently executes operations.

However, in actual business operation, multiple system jobs are often required to be executed cooperatively, and a method for effectively coordinating multiple systems in cooperation is lacking in the prior art.

Disclosure of Invention

The invention mainly aims to provide a log processing method, a nonvolatile storage medium and a log processing device, which are used for solving the technical problem that a plurality of systems cannot perform cooperative work in the prior art.

In order to achieve the above object, according to an aspect of the present invention, there is provided a log processing method including: acquiring an original log of an internal system, and extracting the original log of the internal system to acquire a keyword in the original log of the internal system and service data corresponding to the keyword; compiling a tree graph, comparing the keywords with the node contents in the tree graph from high to low according to the node hierarchy to obtain hit nodes matched with the keywords in the tree graph, and obtaining an external calling interface of an external system according to the hit nodes; and sending the service data to an external calling interface to call the external system operation.

Further, after extracting keywords and service data corresponding to the keywords in the original log of the internal system, caching the keywords and the corresponding service data; after the hit node matched with the keyword is obtained, the log processing method further comprises the following steps: and associating the cached keywords and the service data with the matched hit nodes to form an index database.

Further, after the index database is formed, the log processing method further includes: performing index search on the keywords and information in the index database; when an index searching result matched with the keyword exists in the index database, acquiring a hit node according to the index searching result; and when no index search result matched with the key words exists in the index database, comparing the key words with the node contents in the tree graph from high to low according to the node hierarchy.

Further, the method for comparing the keywords with the node contents in the tree graph according to the order of the node hierarchy from high to low comprises the following steps: matching the keywords with the node contents in the tree diagram layer by layer; when the nodes in the tree graph are matched with the keywords, judging whether the nodes have child nodes or not; if the node does not have the child node, the node is judged to be a hit node; otherwise, matching the keywords with the child nodes of the node until the hit node is judged.

Further, the method for comparing the keywords with the node contents in the tree graph according to the order of the node hierarchy from high to low comprises the following steps: when one node in the tree graph is matched with the keyword, judging the node as a hit node; and when at least two nodes in the tree graph are matched with the keywords, processing the at least two nodes to obtain hit nodes.

Further, a method of processing at least two nodes, comprising: comparing the levels corresponding to each node of the at least two nodes to obtain the node with the deepest level of the at least two nodes; when the number of the nodes with the deepest hierarchy is at least two, processing the nodes with the deepest hierarchy to obtain hit nodes; when one node is at the deepest level, the node at the deepest level is judged as a hit node.

Further, a method of processing at least two levels of deepest nodes, comprising: and respectively adding at least two child nodes of the node with the deepest hierarchy, respectively comparing the keywords with the added child nodes, and judging the added child nodes matched with the keywords as hit nodes.

Further, a method of processing at least two levels of deepest nodes, comprising: and sequencing at least two nodes with the deepest hierarchy, and acquiring hit nodes according to a sequencing result.

Further, the method for extracting the original log of the internal system comprises the following steps: and recognizing and recording all data-changed sentences in the original log, reading all data-changed sentences according to the time stamp, and splitting the read sentence contents one by one to obtain keywords and service data.

According to another aspect of the present invention, there is provided a nonvolatile storage medium including a program that employs the log processing method provided above.

According to another aspect of the present invention, there is provided a log processing apparatus including: the acquisition module is used for acquiring an original log of an internal system; the extraction module is used for extracting key words in an original log of an internal system and business data matched with the key words; the matching module compares the keywords with the node contents in the compiled tree diagram from high to low according to the node hierarchy to obtain hit nodes matched with the keywords in the tree diagram, and obtains an external calling interface of an external system according to the hit nodes; and the calling module is used for sending the service data to an external calling interface so as to call the external system operation.

By applying the technical scheme of the invention, the configurable tree node matching rules are matched step by step to finally position an external interface or method, the interface of the different-end information system can be flexibly driven according to information such as logs, database records and the like, the cooperative operation of an internal system and an external system is realized, the external system operation is finally started and called, and further the dynamic management and control and operation driving of multi-system cooperation can be realized by taking the log information as an entry point.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this application, illustrate embodiments of the invention and, together with the description, serve to explain the invention and not to limit the invention. In the drawings:

FIG. 1 is a logic diagram illustrating a log processing method provided in accordance with an embodiment of the present invention;

fig. 2 shows an illustrative diagram of a treemap provided in accordance with an embodiment of the invention.

Detailed Description

It should be noted that, in the present application, the embodiments and features of the embodiments may be combined with each other without conflict. The present invention will be described in detail below with reference to the embodiments with reference to the attached drawings.

As shown in fig. 1, an embodiment of the present invention provides a log processing method, where the log processing method includes: acquiring an original log of an internal system, and extracting the original log of the internal system to acquire a keyword in the original log of the internal system and service data corresponding to the keyword; compiling a tree graph, comparing the keywords with the node contents in the tree graph from high to low according to the node hierarchy to obtain hit nodes matched with the keywords in the tree graph, and obtaining an external calling interface of an external system according to the hit nodes; and sending the service data to an external calling interface to call the external system operation.

By adopting the log processing method provided by the embodiment, the matched hit node is obtained by performing tree recursion on the keyword of the original log of the internal system, the external calling interface of the external system is obtained according to the content of the hit node, and the service data is executed through the external calling interface, so that the calling operation of the external system is realized, the cooperative operation of the internal system and the external system is realized, and further, the dynamic management and control and operation driving of the multi-system cooperation can be realized by using the log information as an entry point. Specifically, the external system in the present embodiment may include a plurality of different external systems. Therefore, by the log processing method provided by the embodiment, a plurality of systems can be subjected to cooperative jobs.

In this embodiment, after extracting the keywords and the service data corresponding to the keywords in the original log of the internal system, caching the keywords and the corresponding service data; after the hit node matched with the keyword is obtained, the log processing method further comprises the following steps: and associating the cached keywords and the service data with the matched hit nodes to form an index database. By adopting the method, the external calling interface and the corresponding service data which are acquired by tree recursion can be conveniently and quickly acquired by the index database, so that the external system can be conveniently and quickly called for operation.

Specifically, after the index database is formed, the log processing method further includes: performing index search on the keywords and information in the index database; when an index searching result matched with the keyword exists in the index database, acquiring a hit node according to the index searching result; and when no index search result matched with the key words exists in the index database, comparing the key words with the node contents in the tree graph from high to low according to the node hierarchy. By adopting the method, index searching can be performed before tree recursion is performed, repeated operation on the content in the index database is avoided, and the system is not occupied, and the content in the index database can be conveniently and quickly acquired to call an external system for operation.

In this embodiment, the method for comparing the keywords with the node contents in the tree graph in the order from high to low of the node hierarchy includes: matching the keywords with the node contents in the tree diagram layer by layer; when the nodes in the tree graph are matched with the keywords, judging whether the nodes have child nodes or not; if the node does not have the child node, the node is judged to be a hit node; otherwise, matching the keywords with the child nodes of the node until the hit node is judged. By adopting the method, the hit node can be conveniently and accurately obtained, so that the corresponding external calling interface and the service data to be executed can be conveniently obtained according to the hit node, and the calling accuracy of the external system is improved.

Specifically, the method for comparing the keywords with the node contents in the tree graph according to the order of the node hierarchy from high to low comprises the following steps: when one node in the tree graph is matched with the keyword, judging the node as a hit node; and when at least two nodes in the tree graph are matched with the keywords, processing the at least two nodes to obtain hit nodes. By adopting the method, the exception processing can be avoided when at least two nodes appear until the only one matched node in the at least two nodes is obtained, and the obtained only one node is taken as a hit node, so that the condition that the call is abnormal when the at least two nodes appear is avoided, and the smooth operation of the call is ensured.

In this embodiment, a method for processing at least two nodes includes: comparing the levels corresponding to each node in the at least two nodes to obtain the node with the deepest level in the at least two nodes; when the number of the nodes with the deepest hierarchy is at least two, processing the nodes with the deepest hierarchy to obtain hit nodes; when one node is at the deepest level, the node at the deepest level is judged as a hit node. By adopting the sorting method, the corresponding hit nodes can be conveniently and accurately obtained, and external calling operation is carried out according to the contents of the hit nodes.

Specifically, the method for processing the node with the deepest at least two hierarchies comprises the following steps: and respectively adding at least two child nodes of the node with the deepest hierarchy, respectively comparing the keywords with the added child nodes, and judging the added child nodes matched with the keywords as hit nodes. By adopting the exception handling method, more accurate hit nodes can be conveniently obtained by optimizing the tree diagram, so that external calling operation can be smoothly carried out according to the hit nodes.

In this embodiment, the method for processing at least two nodes with the deepest hierarchy includes: and sequencing at least two nodes with the deepest hierarchy levels, and acquiring hit nodes according to sequencing results. By adopting the method, the hit nodes can be conveniently and accurately obtained through sequencing, and the external calling operation is convenient to carry out. Specifically, the ranking herein may be a manually customized ranking.

Specifically, the method for extracting the original log of the internal system comprises the following steps: and recognizing and recording all data-changed sentences in the original log, reading all data-changed sentences according to the time stamp, and splitting the read sentence contents one by one to obtain keywords and service data. By adopting the method, the keywords and the service data can be conveniently and quickly and accurately acquired, so that the external calling operation can be conveniently and quickly carried out.

The log processing method in the embodiment can automatically select the next service processing logic by intercepting logs of each system or database under the condition of multi-system integration, matching custom nodes layer by layer, and positioning a program or an interface, and finally drives the construction method of cooperative operation of different information systems. The log processing method in the embodiment comprises a plurality of log extraction methods, a set of configurable tree graphs, a set of matching and sorting methods, a set of exception handling methods, a set of fast hit weight methods and a set of service data extraction methods in logs. The invention utilizes the characteristic that the log is biased to the text, utilizes the software technology and the structural design of log processing, and aims at the multi-information system integrated environment to carry out multi-system cooperative dynamic control and operation driving by taking the log information as an entry point.

Specifically, the tree graph in this embodiment may be configured, the user-defined condition of the tree graph may be set layer by layer, and recursion may be performed in sequence to meet the matching requirements under different conditions, where each node has only one parent node, but may have infinite child nodes. The matching and sequencing method is to disassemble the target object, compare the target object with the node content configured in the attribute graph, and continue to compare the child nodes if the target object is hit, and so on; caching the target disassembled object when matching is started every time, and associating and setting sequencing a matched final result with the cache when matching is finally completed so as to carry out quick indexing; the exception handling method is characterized in that two or more than two hit results are generated when a target object is inevitably matched due to the configurable tree graph, and exception handling is required at the moment to optimize tree nodes or manually appoint association sequencing; the extraction method of the various logs and the extraction method of the service data in one set of logs are based on the extraction and the disassembly of log objects of an information system log or a database log, two different contents of keywords and service data appear during disassembly, the keywords are used for matching with nodes in a tree diagram, and the service data is used for forming data objects required by matched calling interfaces.

The log processing method in the embodiment belongs to a multi-system architecture, and relates to a construction method for automatically selecting the next service processing logic by matching custom nodes layer by layer and positioning a program or an interface, and finally driving different information systems to perform cooperative operation. Specifically, the log is a record generated by each operation in the operation process of an information system or a database, and often includes contents such as an operation method, an object, a result, and the like, and the initial purpose of the log is to record target information for exception checking or process retrieval of the system and data, and the log is often used in processes such as information system maintenance, routing inspection, exception handling, and the like.

The log extraction method in the embodiment comprises the steps of reading log text type logs of an information system; and reading logs of three main stream databases of mysql, sqlserver and oracle and reading database table data. The matching and sorting method and the service data extraction method in the tree form are characterized in that read logs are regularly disassembled, matching keywords and service data are extracted, then the matching keywords and the service data are compared with nodes in the tree form layer by layer, finally an interface is positioned and called, a service data object is sent through the interface, and a target program at a different end is called. The tree graph comprises node names, node IDs, father node IDs, matching contents, interface calling, sequencing and the like. The exception handling method is that due to configurability of the tree graph, a plurality of matching hit results are inevitably matched or the matching results in the past are modified and deleted to cause the condition that the matching cannot be performed, and exception handling is required, for example, to throw out information to be processed, and temporarily suspend the interception log.

As can be seen from the structure of log interception and index query in fig. 1, the present invention mainly includes various log extraction methods for a plurality of information systems; a configurable tree graph; a matching and sorting method; an exception handling method; a service data extraction method in the log and the like. As shown in fig. 1, the log extraction method for a plurality of information systems includes two objects, namely a database log and a system log.

The database logs are mainly extracted aiming at three main flow database logs, namely mysql, sqlserver and oracle.

The extraction method of mysql is as follows:

after logging in mysql, the sql statement is executed: show variables like 'log _ bin';

check if log _ bin is on.

The invention only identifies the added, deleted and modified sentences for interception, and adds codes under the [ mysql ] option of the mysql configuration file my.ini: log-bin ═ E:/mysql _ log _ bin.

Upon completion, mysql will automatically record all statements that change data under the log-bin configured directory.

And taking the creation time of the file as a condition, and reading the log according to the time stamp.

The extraction method of sqlserver is as follows:

and (3) executing the SQL statement:

SELECT TOP 1000 QS.creation_time,SUBSTRING(ST.text,(QS.statement_start_offset/2)+1,((CASE QS.statement_end_offset WHEN-1 THEN DATALENGTH(st.text)ELSE QS.statement_end_offset END-QS.statement_start_offset)/2)+1)AS statement_text,ST.text,QS.total_worker_time,QS.last_worker_time,QS.max_worker_time,QS.min_worker_time FROM sys.dm_exec_query_stats QS CROSS APPLY sys.dm_exec_sql_text(QS.sql_handle)ST WHERE QS.creation_time BETWEEN'2017-09-09 10:00:00'AND'2017-09-11 18:00:00'AND ST.text LIKE'％％'ORDER BY QS.creation_time DESC

reading log information may be performed according to a time stamp cycle using qs.creation _ time as a query condition.

The extraction method of oracle is as follows:

and (3) executing the SQL statement:

SELECT SQL_TEXT,LAST_ACTIVE_TIME,SQL_FULLTEXT FROM v$sql ORDER BY LAST_ACTIVE_TIME DESC

the log information may be read according to a TIME stamp cycle using LAST _ ACTIVE _ TIME as a query condition.

In particular, the original log of the system is generally a log type log, which is essentially a line-type, stream-recorded document, and the reading of the log contents can be performed using any programming language, as is the case with text documents.

After the original log content is read, the content needs to be deleted, namely, the corresponding matching and sorting method. The specific method is explained with reference to fig. 2 as follows:

and identifying the identifier of the ending statement executed by each log, and processing the logs one by one. Such as an ending part number of an sql statement or an ending period number of a log;

and matching keywords of the logs which are split into pieces one by one according to the configurable tree graph, wherein the keywords are the marked node contents in the tree graph. For example, a keyword for establishing a node 1 in the tree diagram is insert, a keyword for setting a node 1-3 below the node 1 is role _ table, and a keyword for setting a node 1-3-1 below the node 1-3 is sys _ admin, and then the two keywords are used for matching the log.

And matching from high to low according to the parent-child relationship of the nodes during matching, and narrowing the final hit range. And when the content is matched, the content with a deeper hierarchy is always hit, and when no child node exists in the layer or the child node is not matched with the content, an interface calling method of the node is executed.

In the matching operation, due to the configurability of the tree graph, it is inevitable that a plurality of matching hit results are matched or matching results that have been matched in the past are modified and deleted, which results in a case where matching cannot be performed, and exception handling is required. Such as the occurrence of:

when the matching operation is performed, multiple nodes are hit at the same time and the nodes are at the same level.

The method for processing the node exception, the first method can differentiate the hit result again, and increases the sub-nodes for matching and refining again; the second is to perform manual sequencing on the nodes, the initial states of all the nodes are no sequencing, and the priority hit sequencing number is always small when the nodes are selected. The present invention recommends using the first method and the second method only when refinement is no longer possible. For example, in FIG. 2, if the log hits both the user _ table of node 1-1 and the role _ table of node 1-3, then the first method is used to continue to join node 1-3-1 under node 1-3, at which time node 1-1 is ignored because of the layer-by-layer matching and always hits deeper levels.

Every time the modification operation is performed on the nodes with same level and existing sequencing, the sequencing of all nodes with same level in the nodes is reset, so that the phenomenon that the sequencing specified previously is used wrongly is avoided.

The service data extraction is the data requirement for executing interface call, namely the transmission parameter content of the interface, after the node hit is completed. Service data extraction is based on symbols or keywords, for example, in sql statements, insert statements necessarily contain values, such as the following statements:

insert _ role _ table values ('role _ lv');

the first appearing bracket "()" indicates the field name of the current execution, and the second bracket "()" indicates the data content of the current execution field. And (4) extracting according to the sequence for objectification, for example, carrying out cyclic access assignment by using comma as decomposition by using a split method of java, and the like, and finally completing construction of the data object.

After the operation is completed, the interface address in the matching node and the data object are sent together, the interface of the remote program is triggered, and the service operation of the program is executed.

The second embodiment of the invention provides a nonvolatile storage medium, the nonvolatile storage medium comprises a program, and the program adopts the log processing method provided above.

The third embodiment of the invention provides a log processing device, which comprises an acquisition module, an extraction module, a matching module and a calling module, wherein the acquisition module is used for acquiring the original log of an internal system. The extraction module is used for extracting keywords in the original log of the internal system and service data matched with the keywords. And the matching module compares the keywords with the node contents in the compiled tree graph from high to low according to the node hierarchy to obtain hit nodes matched with the keywords in the tree graph, and obtains an external calling interface of an external system according to the hit nodes. And the calling module sends the service data to an external calling interface so as to call the external system operation.

From the above description, it can be seen that the above-described embodiments of the present invention achieve the following technical effects: the past point-to-point calling relation based on program codes is unbound into a configurable tree node matching rule, an external interface or a method is finally positioned by step matching, the interface of the different-end information system can be flexibly driven according to information such as logs, database records and the like, and the external system operation is finally started and called.

It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments according to the present application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, and it should be understood that when the terms "comprises" and/or "comprising" are used in this specification, they specify the presence of stated features, steps, operations, devices, components, and/or combinations thereof, unless the context clearly indicates otherwise.

The relative arrangement of the components and steps, the numerical expressions, and numerical values set forth in these embodiments do not limit the scope of the present application unless specifically stated otherwise. Meanwhile, it should be understood that the sizes of the respective portions shown in the drawings are not drawn in an actual proportional relationship for the convenience of description. Techniques, methods, and apparatus known to those of ordinary skill in the relevant art may not be discussed in detail but are intended to be part of the specification where appropriate. In all examples shown and discussed herein, any particular value should be construed as merely illustrative, and not limiting. Thus, other examples of the exemplary embodiments may have different values. It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, further discussion thereof is not required in subsequent figures.

In the description of the present application, it is to be understood that the orientation or positional relationship indicated by the directional terms such as "front, rear, upper, lower, left, right", "lateral, vertical, horizontal" and "top, bottom", etc., are generally based on the orientation or positional relationship shown in the drawings, and are used for convenience of description and simplicity of description only, and in the case of not making a reverse description, these directional terms do not indicate and imply that the device or element being referred to must have a particular orientation or be constructed and operated in a particular orientation, and therefore, should not be considered as limiting the scope of the present application; the terms "inner and outer" refer to the inner and outer relative to the profile of the respective component itself.

Spatially relative terms, such as "above … …," "above … …," "above … …," "above," and the like, may be used herein for ease of description to describe one device or feature's spatial relationship to another device or feature as illustrated in the figures. It will be understood that the spatially relative terms are intended to encompass different orientations of the device in use or operation in addition to the orientation depicted in the figures. For example, if a device in the figures is turned over, devices described as "above" or "on" other devices or configurations would then be oriented "below" or "under" the other devices or configurations. Thus, the exemplary term "above … …" can include both an orientation of "above … …" and "below … …". The device may be otherwise variously oriented (rotated 90 degrees or at other orientations) and the spatially relative descriptors used herein interpreted accordingly.

It should be noted that the terms "first", "second", and the like are used to define the components, and are only used for convenience of distinguishing the corresponding components, and the terms have no special meanings unless otherwise stated, and therefore, the scope of protection of the present application is not to be construed as being limited.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A log processing method, comprising:

acquiring an original log of an internal system, and extracting the original log of the internal system to acquire a keyword in the original log of the internal system and service data corresponding to the keyword;

compiling a tree diagram, comparing the keywords with the node contents in the tree diagram from high to low according to the node hierarchy to obtain hit nodes matched with the keywords in the tree diagram, and obtaining an external calling interface of an external system according to the hit nodes;

and sending the service data to the external calling interface to call the external system operation.

2. The log processing method according to claim 1, wherein after extracting a keyword and service data corresponding to the keyword in an original log of the internal system, caching the keyword and the corresponding service data; after the hit node matched with the keyword is obtained, the log processing method further comprises the following steps:

and associating the cached keywords and the cached service data with the matched hit nodes to form an index database.

3. The log processing method according to claim 2, wherein after the index database is formed, the log processing method further comprises:

performing index search on the keywords and the information in the index database;

when an index searching result matched with the keyword exists in the index database, acquiring the hit node according to the index searching result;

and when no index searching result matched with the keyword exists in the index database, comparing the keyword with the node contents in the tree graph from high to low according to the node hierarchy.

4. The log processing method according to claim 1, wherein the method of comparing the keywords with the contents of the nodes in the tree view in order of node hierarchy from high to low comprises:

matching the keywords with the node contents in the tree diagram layer by layer;

when the nodes in the tree graph are matched with the keywords, judging whether child nodes exist in the nodes or not;

if the node does not have a child node, judging the node as a hit node; otherwise, matching the keyword with the child nodes of the node until a hit node is determined.

5. The log processing method according to claim 1, wherein the method of comparing the keywords with the contents of the nodes in the tree view in order of node hierarchy from high to low comprises:

when one node in the tree graph is matched with the keyword, judging the node as a hit node;

and when at least two nodes in the tree graph are matched with the keywords, processing the at least two nodes to obtain hit nodes.

6. The log processing method according to claim 5, wherein the method of processing the at least two nodes comprises:

comparing the levels corresponding to each node of the at least two nodes to obtain the node with the deepest level of the at least two nodes;

when the number of the nodes with the deepest hierarchy is at least two, processing the nodes with the deepest hierarchy to obtain hit nodes;

when the node at the deepest level is one, the node at the deepest level is determined to be the hit node.

7. The log processing method according to claim 6, wherein the method of processing at least two of the nodes having the deepest hierarchical levels comprises:

and respectively adding at least two child nodes of the node with the deepest hierarchy, respectively comparing the keyword with the added child nodes, and judging the added child nodes matched with the keyword as hit nodes.

8. The log processing method according to claim 6, wherein the method of processing at least two of the nodes having the deepest hierarchical levels comprises:

and sequencing at least two nodes with the deepest hierarchy, and acquiring the hit nodes according to a sequencing result.

9. The log processing method according to claim 1, wherein the method of extracting the original log of the internal system comprises:

and recognizing and recording all data-changed sentences in the original log, reading all data-changed sentences according to the time stamp, and splitting the read sentence contents one by one to obtain the keywords and the service data.

10. A nonvolatile storage medium characterized by comprising a program that employs the log processing method of any one of claims 1 to 9.

11. A log processing apparatus, comprising:

the acquisition module is used for acquiring an original log of an internal system;

the extraction module is used for extracting keywords in the original log of the internal system and the service data matched with the keywords;

the matching module compares the keywords with the node contents in the compiled tree diagram from high to low according to the node hierarchy to obtain hit nodes matched with the keywords in the tree diagram and obtain an external calling interface of an external system according to the hit nodes;

and the calling module is used for sending the service data to the external calling interface so as to call the external system operation.