Source-linked AI summary
UniParser: A Unified Log Parser for Heterogeneous Log Data
Yudong Liu, Xu Zhang, Shilin He, Hongyu Zhang, Liqun Li, Yu Kang, Yong Xu, Minghua Ma, Qingwei Lin, Yingnong Dang, Saravan Rajmohan, Dongmei Zhang
TL;DR
Existing log parsers often neglect log semantics and struggle to generalize across diverse sources, limiting reliable structured extraction for automated analysis. UniParser learns shared logging behaviours through token, context, and context-similarity modules, outperforming state-of-the-art parsers on 16 public datasets. It can also adapt to distinctive sources with limited fine-tuning.
Problem
Existing parsers neglect semantic meaning and face highly diverse log sources, creating challenges for accurate parsing and generalization.
Method
UniParser uses Token Encoder and Context Encoder modules to capture template and parameter patterns, while Context Similarity models their commonalities across heterogeneous sources.
Results
12% on Group Accuracy and about 40% on Message-Level Accuracy: UniParser outperforms state-of-the-art parsers across 16 public log datasets.
Takeaways & Limitations
UniParser can be applied directly to most new log sources and requires only a small amount of fine-tuning for distinctive patterns.
Takeaways & Limitations
Existing parsers remain difficult to apply in real-world scenarios because complicated log data exposes parsing-accuracy limitations.
Abstract
from arXiv · showhide
Logs provide first-hand information for engineers to diagnose failures in large-scale online service systems. Log parsing, which transforms semi-structured raw log messages into structured data, is a prerequisite of automated log analysis such as log-based anomaly detection and diagnosis. Almost all existing log parsers follow the general idea of extracting the common part as templates and the dynamic part as parameters. However, these log parsing methods, often neglect the semantic meaning of log messages. Furthermore, high diversity among various log sources also poses an obstacle in the generalization of log parsing across different systems. In this paper, we propose UniParser to capture the common logging behaviours from heterogeneous log data. UniParser utilizes a Token Encoder module and a Context Encoder module to learn the patterns from the log token and its neighbouring context. A Context Similarity module is specially designed to model the commonalities of learned patterns. We have performed extensive experiments on 16 public log datasets and our results show that UniParser outperperforms state-of-the-art log parsers by a large margin.
1 INTRODUCTION
Online-service failures make logs essential for diagnosis, but existing parsers struggle with semantic ambiguity and heterogeneous sources. UniParser learns shared logging patterns and achieves higher accuracy and efficiency across public datasets.
- Logs record system events and runtime status that engineers inspect to investigate, mitigate, and resolve failures in large-scale online services.
- Automated log analysis supports anomaly detection, diagnosis, failure prediction, and performance modeling as raw log volumes grow.
- Existing parsers can misclassify semantically meaningful parameters as templates and face poor generalization across diverse log sources.
- UniParser captures common semantic patterns using token, context, and context-similarity modules, enabling direct application to new log sources after training.
- 12% on Group Accuracy and about 40% on Message-Level Accuracy: UniParser outperforms state-of-the-art parsers across 16 public log datasets.It parses millions of logs in 2 ∼3 minutes, about half the running time of the most efficient existing parser.
- UniParser captures common templates or parameter patterns across heterogeneous sources and demonstrates stronger performance, efficiency, and module effectiveness than existing approaches.
2 BACKGROUND AND MOTIVATION
Log parsing extracts templates and parameters, but conventional frequency, clustering, and heuristic methods struggle with semantic ambiguity, heterogeneous sources, and evaluation that may not reflect extraction quality. These limitations motivate learning shared logging practices across systems.
- 2.1 Log Parsing: Log parsing separates static descriptive templates from dynamic parameters in semi-structured messages.
- 2.2 Related Work: Existing parsers commonly extract frequent or shared tokens as templates and varying tokens as parameters.
- 2.2.2 Related Work.: Frequent-pattern methods build itemsets from tokens, token-position pairs, or token n-grams before clustering messages and extracting templates.
- 2.2.2 Related Work.: Clustering methods identify common tokens within groups of similar logs rather than across the global dataset.
- 2.2.2 Related Work.: Heuristic parsers exploit log-specific properties such as token occurrences, message length, token position, and mapping relations.
- 2.3 Limitations of Existing Work: Existing approaches are difficult to apply in real-world scenarios because their parsing accuracy degrades on complicated log data.
- 2.3 Limitations of Existing Work: Semantic neglect can misidentify stable values such as success or directory paths as templates even when their meanings indicate parameters.
- 2.3.1 Ignoring semantic meaning of log tokens.: Offline parsers may require large message volumes for parameters to show sufficient dynamic variation, while diverse sources force repeated adaptation and preprocessing.
3 APPROACH
UniParser learns whether each log token belongs to a template or parameter by combining token content, local context, and cross-source pattern similarity. It trains offline on heterogeneous sources and applies the learned parser online to unseen sources without target labels.
- Model architecture: UniParser combines Token Encoder, Context Encoder, and Context Similarity modules to model token and neighboring-context patterns.The Context Similarity module is used during offline training to emphasize commonalities among learned patterns.
- Problem formulation: UniParser transforms log parsing into token classification, assigning each token to either the template or parameter part.Template tokens are combined into the log template, while parameter tokens form the parameter list.
- Overview: The approach has separate offline cross-source training and online parsing phases, allowing a trained model to process a target source directly.Training uses labeled logs from multiple sources to learn common patterns rather than source-specific contents.
- Token Encoder: Character-level embeddings address unseen log-token vocabulary, using combinations of 96 common characters instead of an enormous token-level vocabulary.This design targets the out-of-vocabulary problem caused by diverse and dynamic log words.
- Context Encoder: The Context Encoder uses a local window because neighboring symbols and words help identify whether a target token is a parameter or template.The method considers nearby tokens while limiting context to a range around the target.
- Context Similarity: Contrastive learning pulls context encodings from similar logs closer than those from dissimilar logs, reducing content diversity's effect on shared patterns.Similar logs are grouped by token length and first token; one similar and multiple dissimilar messages support the contrastive objective.
- Loss function: The training objective combines token-level classification loss with context-level contrastive loss using a weighted sum.The classification layer concatenates Token Encoder and Context Encoder representations before predicting token categories.
4 EXPERIMENT
The experiments evaluate UniParser on LogPai's heterogeneous benchmark using token-level labels derived from message-level ground truth. The setup spans 16 systems and specifies separate training and online parsing configurations.
- Evaluation: The evaluation reports Group Accuracy and Message-Level Accuracy, including a metric introduced to better reflect complete token identification.The experiment section presents parsing accuracy, performance comparison, and component evaluation.
- Datasets: Experiments use 16 LogPai datasets spanning distributed systems, supercomputers, operating systems, mobile systems, server applications, and standalone software.Each message has a ground-truth template, which is transformed into token-level labels for UniParser.
- Implementation: The experimental implementation uses a Tesla P100 GPU, PyTorch 1.4, Adam optimization, an initial learning rate of 0.002, batch size 256, and four training epochs.Online parsing uses batch size 512; the Context Encoder uses k = 3 and the dissimilar set contains three logs.
4.2 Evaluation Metrics
The evaluation distinguishes grouping logs under templates from correctly identifying every token's role. Message-Level Accuracy is stricter because one token error makes the whole message incorrect.
- Group Accuracy: Group Accuracy measures alignment between parser-generated log groups and groups belonging to the same ground-truth template.It can reward correct grouping even when template and parameter tokens are misidentified.
- Message-Level Accuracy: Message-Level Accuracy counts a log as correct only when every token is correctly labeled as template or parameter.This makes MLA stricter than Group Accuracy because any token-level error invalidates the complete message parse.
- Illustrative comparison: MLA in the illustrated example is 3⁄6 because only the three messages in the left group are parsed completely correctly.The example contrasts complete token identification with grouping under a common template.
4.3 Parsing Accuracy Evaluation
UniParser is compared with four established parsers through cross-source training across all 16 datasets. It performs better on nearly all datasets and both metrics, while Proxifier remains a documented exception.
- Experimental protocol: For each target dataset, UniParser trains on the other 15 datasets before parsing the target source.The comparison includes Drain, AEL, LenMa, and LFA across all 16 datasets.
- Overall results: UniParser outperforms existing methods on almost all datasets with respect to both evaluation metrics.The reported comparison covers Group Accuracy and Message-Level Accuracy.
- Average comparison: 11.9% higher Group Accuracy and 40.8% higher MLA than Drain are reported on average.Drain averages 0.867 Group Accuracy and 0.377 MLA, whereas UniParser reaches 0.785 MLA in the cited comparison.
- Metric interpretation: Existing parsers can achieve high Group Accuracy while still producing low MLA, whereas UniParser predicts token categories individually.The cited Drain example has Group Accuracy 0.867 and MLA 0.377; UniParser's cited MLA is 0.785.
- Limitation: UniParser does not outperform existing methods on the Proxifier dataset.The authors attribute this result to a large gap between Proxifier and the other datasets and discuss fine-tuning with a small amount of labeled data.
4.4 Runtime Performance Evaluation
UniParser is evaluated for runtime across increasing log volumes and compared with state-of-the-art parsers on MLA.
- Runtime Performance Evaluation: UniParser’s running time increases slowly as log volume expands.The runtime comparison includes data-loading time, and both axes in Figure 5 use logarithmic scales.
- Runtime Performance Evaluation: The runtime evaluation compares UniParser with other log parsers under different log-data volumes.
- Runtime Performance Evaluation: Table 2 compares UniParser with state-of-the-art log parsers using Message-Level Accuracy.
4.5 Component Evaluation
Component and parameter studies show that contextual information and context similarity improve parsing, while excessive context can introduce noise. UniParser also outperforms a supervised sequence-labeling comparator.
- Component Effectiveness: The component-effectiveness experiments are conducted on Android logs, which contain hundreds of templates and complicated patterns.The study focuses on MLA because Group Accuracy cannot properly measure parser performance in this evaluation.
- Component Effectiveness: 0.838 MLA is achieved with the Context Similarity module, versus 0.352 MLA using only Token Encoder and 0.587 MLA after adding Context Encoder.The comparisons indicate that contextual patterns support target-token classification and that Context Similarity makes encoded features more precise.
- Parameter Analysis: MLA remains relatively stable from 0.78 to 0.84 as k varies from 1 to 5, increasing through k in [3] before declining.Here, k denotes the number of tokens surrounding the target token; distant tokens may add noise.
- Comparison with Sequence Labeling Model: UniParser outperforms Bidirectional LSTM-CNNs-CRF, while both deep-learning parsers outperform existing unsupervised parsers such as Drain on Android.
5 DISCUSSION
UniParser can adapt to new log sources through direct application or online fine-tuning, but training still requires labeled log data and token splitting has limits.
- Model Fine-tuning: Engineers can fine-tune UniParser online by inspecting a few parsed logs, correcting templates or parameters, and feeding the labels back into the model.This mechanism is designed to help the model adapt quickly to target log sources.
- Labeling Effort: Training requires labeled log data, although the datasets can be labeled once for offline supervised learning.
- Adaptation to New Sources: UniParser can be applied directly to most new log sources without extra labeling effort because it learns common patterns across heterogeneous sources.Distinctive sources such as Proxifier may require only a small amount of fine-tuning.
- Token Splitting: Token splitting can be difficult for complex log messages because special-symbol rules may separate tokens that should remain together.The paper illustrates this issue with the token “time(s)” in “Process A done this 1 time(s)”.
6 APPLICATION IN PRACTICE
UniParser has been applied in Microsoft 365 and Azure Cloud across several log-analysis scenarios, where it is reported to improve parsing accuracy and robustness.
- Application in Practice: UniParser has been applied to safe deployment guarding, performance issue diagnosis, and log-based anomaly detection in Microsoft 365 and Azure Cloud.
- Application in Practice: Compared with existing log parsers, UniParser achieves higher parsing accuracy on complicated industrial log data.
- Application in Practice: The paper reports that UniParser’s robustness on industrial log data improves various downstream log-based tasks.
7 CONCLUSION
UniParser addresses heterogeneous log parsing by learning template and parameter patterns through token, context, and context-similarity modules. Evaluated on public datasets, it outperforms state-of-the-art parsers on two reported accuracy measures.
- Log parsing transforms semi-structured raw logs into structured data and supports automated log analysis.
- UniParser combines Token Encoder, Context Encoder, and Context Similarity modules to capture template and parameter patterns across heterogeneous logs.
- 12% on Group Accuracy and about 40% on Message-Level Accuracy over state-of-the-art parsers.