UniParser: A Unified Log Parser for Heterogeneous Log Data

TL;DR

UniParser is a novel log parser that captures common behaviors across diverse log data by learning patterns through token and context encoding, significantly improving parsing accuracy over existing methods.

Contribution

UniParser introduces a unified approach with specialized modules to effectively parse heterogeneous logs, addressing diversity and semantic understanding challenges.

Findings

Outperforms state-of-the-art log parsers on 16 datasets

Effectively captures semantic meanings in log messages

Demonstrates robustness across diverse log sources

Abstract

Logs provide first-hand information for engineers to diagnose failures in large-scale online service systems. Log parsing, which transforms semi-structured raw log messages into structured data, is a prerequisite of automated log analysis such as log-based anomaly detection and diagnosis. Almost all existing log parsers follow the general idea of extracting the common part as templates and the dynamic part as parameters. However, these log parsing methods, often neglect the semantic meaning of log messages. Furthermore, high diversity among various log sources also poses an obstacle in the generalization of log parsing across different systems. In this paper, we propose UniParser to capture the common logging behaviours from heterogeneous log data. UniParser utilizes a Token Encoder module and a Context Encoder module to learn the patterns from the log token and its neighbouring context. A Context Similarity module is specially designed to model the commonalities of learned patterns. We have performed extensive experiments on 16 public log datasets and our results show that UniParser outperperforms state-of-the-art log parsers by a large margin.