With the rise of the Internet of Things (IoT), billions of devices generate massive volumes of log data, capturing their operations and interactions. These logs are typically messy and unstructured, making analysis difficult. By transforming raw logs into structured templates, log parsing provides a fundamental basis for various operational tasks, including fault detection, anomaly diagnosis, and large-scale system monitoring. However, existing methods face limitations: heuristic-based approaches struggle with pattern variability, while deep learning models, particularly large language models (LLMs), are computationally intensive and unstable for industrial deployment. We propose LogSieve, a hybrid log parsing framework that balances efficiency and adaptability. Built upon a prefix-tree parser, LogSieve introduces three key components: (1) a semantically weighted similarity function for enhanced template grouping, (2) a fragmented template rectification module to merge structurally similar templates, and (3) a confidence-aware postprocessing step that selectively invokes LLMs to refine low-confidence results. Experiments on public datasets show that LogSieve improves parsing accuracy by 15.7% while reducing LLM usage by 78.2%. It achieves processing speeds of over 0.4 million lines per minute, demonstrating its scalability and practicality for large-scale log analysis.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

LogSieve: Log Parsing with Selective LLM-Based Template Rectification

  • Chong Ling,
  • Xiaohou Shi,
  • Ke Li,
  • Yan Sun

摘要

With the rise of the Internet of Things (IoT), billions of devices generate massive volumes of log data, capturing their operations and interactions. These logs are typically messy and unstructured, making analysis difficult. By transforming raw logs into structured templates, log parsing provides a fundamental basis for various operational tasks, including fault detection, anomaly diagnosis, and large-scale system monitoring. However, existing methods face limitations: heuristic-based approaches struggle with pattern variability, while deep learning models, particularly large language models (LLMs), are computationally intensive and unstable for industrial deployment. We propose LogSieve, a hybrid log parsing framework that balances efficiency and adaptability. Built upon a prefix-tree parser, LogSieve introduces three key components: (1) a semantically weighted similarity function for enhanced template grouping, (2) a fragmented template rectification module to merge structurally similar templates, and (3) a confidence-aware postprocessing step that selectively invokes LLMs to refine low-confidence results. Experiments on public datasets show that LogSieve improves parsing accuracy by 15.7% while reducing LLM usage by 78.2%. It achieves processing speeds of over 0.4 million lines per minute, demonstrating its scalability and practicality for large-scale log analysis.