UniParser: A Unified Log Parser for Heterogeneous Log Data

Abstract

Logs provide first-hand information for engineers to diagnose failures in large-scale online service systems. Log parsing, which transforms semi-structured raw log messages into structured data, is a prerequisite of automated log analysis such as log-based anomaly detection and diagnosis. Almost all existing log parsers follow the general idea of extracting the common part as templates and the dynamic part as parameters. However, these log parsing methods, often neglect the semantic meaning of log messages. Furthermore, high diversity among various log sources also poses an obstacle in the generalization of log parsing across different systems. In this paper, we propose UniParser to capture the common logging behaviours from heterogeneous log data. UniParser utilizes a Token Encoder module and a Context Encoder module to learn the patterns from the log token and its neighbouring context. A Context Similarity module is specially designed to model the commonalities of learned patterns. We have performed extensive experiments on 16 public log datasets and our results show that UniParser outperperforms state-of-the-art log parsers by a large margin.

Accepted by WWW 2022, 8 pages

References in corpus (2)

• Text Understanding from Scratch
• Length Matters: Clustering System Log Messages using Length of Words

Cited by in corpus (6)

• LLMParser: An Exploratory Study on Using Large Language Models for Log Parsing
• Multivariate Log-based Anomaly Detection for Distributed Database
• Reducing Events to Augment Log-based Anomaly Detection Models: An Empirical Study
• A Comparative Study on Large Language Models for Log Parsing
• Log Parsing Evaluation in the Era of Modern Software Systems
• Adaptive and Efficient Log Parsing as a Cloud Service