SchemaCoder: Automatic Log Schema Extraction Coder with Residual Q-Tree Boosting

TL;DR

SchemaCoder is an innovative fully automated framework that leverages a novel Residual Q-Tree Boosting mechanism and LLMs to extract log schemas across diverse formats without human intervention, significantly outperforming existing methods.

Contribution

It introduces the first fully automated log schema extraction framework using a Residual Q-Tree Boosting approach that eliminates the need for human-designed regular expressions.

Findings

Achieves 21.3% improvement over state-of-the-art methods on LogHub-2.0.

Effectively extracts schemas from diverse log formats without human customization.

Demonstrates robustness and scalability across large log datasets.

Abstract

Log schema extraction is the process of deriving human-readable templates from massive volumes of log data, which is essential yet notoriously labor-intensive. Recent studies have attempted to streamline this task by leveraging Large Language Models (LLMs) for automated schema extraction. However, existing methods invariably rely on predefined regular expressions, necessitating human domain expertise and severely limiting productivity gains. To fundamentally address this limitation, we introduce SchemaCoder, the first fully automated schema extraction framework applicable to a wide range of log file formats without requiring human customization within the flow. At its core, SchemaCoder features a novel Residual Question-Tree (Q-Tree) Boosting mechanism that iteratively refines schema extraction through targeted, adaptive queries driven by LLMs. Particularly, our method partitions logs into semantic chunks via context-bounded segmentation, selects representative patterns using embedding-based sampling, and generates schema code through hierarchical Q-Tree-driven LLM queries, iteratively refined by our textual-residual evolutionary optimizer and residual boosting. Experimental validation demonstrates SchemaCoder's superiority on the widely-used LogHub-2.0 benchmark, achieving an average improvement of 21.3% over state-of-the-arts.