LogParser-LLM: Advancing Efficient Log Parsing with Large Language Models

TL;DR

LogParser-LLM leverages large language models to enhance log parsing efficiency and accuracy, eliminating the need for labeled data and hyper-parameter tuning, and introduces user-adjustable granularity for tailored analysis.

Contribution

The paper presents a novel log parser that integrates LLMs for semantic and statistical analysis, improving adaptability and performance over existing methods without requiring training data.

Findings

Achieves 90.6% F1 score on log grouping accuracy.

Requires only 272.5 LLM invocations on average.

Outperforms state-of-the-art log parsers in efficiency and accuracy.

Abstract

Logs are ubiquitous digital footprints, playing an indispensable role in system diagnostics, security analysis, and performance optimization. The extraction of actionable insights from logs is critically dependent on the log parsing process, which converts raw logs into structured formats for downstream analysis. Yet, the complexities of contemporary systems and the dynamic nature of logs pose significant challenges to existing automatic parsing techniques. The emergence of Large Language Models (LLM) offers new horizons. With their expansive knowledge and contextual prowess, LLMs have been transformative across diverse applications. Building on this, we introduce LogParser-LLM, a novel log parser integrated with LLM capabilities. This union seamlessly blends semantic insights with statistical nuances, obviating the need for hyper-parameter tuning and labeled training data, while ensuring rapid adaptability through online parsing. Further deepening our exploration, we address the intricate challenge of parsing granularity, proposing a new metric and integrating human interactions to allow users to calibrate granularity to their specific needs. Our method's efficacy is empirically demonstrated through evaluations on the Loghub-2k and the large-scale LogPub benchmark. In evaluations on the LogPub benchmark, involving an average of 3.6 million logs per dataset across 14 datasets, our LogParser-LLM requires only 272.5 LLM invocations on average, achieving a 90.6% F1 score for grouping accuracy and an 81.1% for parsing accuracy. These results demonstrate the method's high efficiency and accuracy, outperforming current state-of-the-art log parsers, including pattern-based, neural network-based, and existing LLM-enhanced approaches.