SCOPE: Tree-based Self-Correcting Online Log Parsing via Syntactic-Semantic Collaboration

TL;DR

SCOPE is a novel log parsing method combining heuristic and LLM-based approaches with a bi-directional tree and a two-stage collaboration framework, achieving high accuracy and efficiency.

Contribution

It introduces a self-correcting online log parser that reduces LLM calls using a syntactic-semantic collaboration framework and a bi-directional tree structure.

Findings

Outperforms state-of-the-art methods in accuracy and efficiency

Reduces LLM API usage significantly while maintaining high parsing accuracy

Demonstrates effectiveness on diverse benchmark datasets

Abstract

Log parsing is a critical step for automated log analysis in complex systems. Traditional heuristic-based methods offer high efficiency but are limited in accuracy due to overlooking semantic context. In contrast, recent LLM-based parsers improve accuracy via se mantic understanding but incur high latency from frequent model calls. To address this, we propose SCOPE, the first self-correcting online log parsing method that integrates the strengths of both heuristic and LLM-based paradigms. SCOPE introduces a novel bi-directional tree structure that enables efficient template match ing from both forward and reverse directions, resulting in a higher overall matching rate. Additionally, it adopts a two-stage syntactic semantic collaboration framework: a lightweight NLP model first utilizes part-of-speech (POS) information for syntax-based match ing, while the LLM is selectively invoked as a fallback to handle semantically complex cases when uncertainty remains. This design significantly reduces LLM API usage while maintaining high ac curacy, achieving a balance between efficiency and effectiveness. Extensive evaluations on diverse benchmark datasets show that SCOPE outperforms state-of-the-art methods in both accuracy and efficiency. The implementation and datasets are publicly released to facilitate further research.