Plug it and Play on Logs: A Configuration-Free Statistic-Based Log Parser

TL;DR

This paper introduces PIPLUP, a novel statistic-based log parser that is configuration-free, highly accurate, and generalizable, challenging the belief that statistic-based methods are inferior to semantic-based approaches.

Contribution

PIPLUP eliminates the need for pre-assumed token positions and uses data-insensitive parameters, enabling plug-and-play log parsing with high accuracy and efficiency.

Findings

PIPLUP outperforms state-of-the-art statistic-based parsers like Drain.

PIPLUP achieves competitive accuracy compared to semantic-based parsers like LUNAR.

PIPLUP demonstrates low time consumption without GPU or external APIs.

Abstract

Log parsing is an essential task in log analysis, and many tools have been designed to accomplish it. Existing log parsers can be categorized into statistic-based and semantic-based approaches. In comparison to semantic-based parsers, existing statistic-based parsers tend to be more efficient, require lower computational costs, and be more privacy-preserving thanks to on-premise deployment, but often fall short in their accuracy (e.g., grouping or parsing accuracy) and generalizability. Therefore, it became a common belief that statistic-based parsers cannot be as effective as semantic-based parsers since the latter could take advantage of external knowledge supported by pretrained language models. Our work, however, challenges this belief with a novel statistic-based parser, PIPLUP. PIPLUP eliminates the pre-assumption of the position of constant tokens for log grouping and relies on data-insensitive parameters to overcome the generalizability challenge, allowing "plug and play" on given log files. According to our experiments on an open-sourced large log dataset, PIPLUP shows promising accuracy and generalizability with the data-insensitive default parameter set. PIPLUP not only outperforms the state-of-the-art statistic-based log parsers, Drain and its variants, but also obtains a competitive performance compared to the best unsupervised semantic-based log parser (i.e., LUNAR). Further, PIPLUP exhibits low time consumption without GPU acceleration and external API usage; our simple, efficient, and effective approach makes it more practical in real-world adoptions, especially when costs and privacy are of major concerns.