Log analysis method and system based on large language model

Abstract

The invention provides a log analysis method and system based on a large language model, and belongs to the technical field of log analys.The method comprises the steps that anti-fact rewriting is conducted on a to-be-analyzed log, and multiple log variants are obtained; log parameters are extracted from the log variants through the large language model to serve as intermediate variables, and the confidence coefficient of each intermediate variable is determined; performing correctness scoring on each intermediate variable based on statistical information of a historical log corpus knowledge base; determining a comprehensive score of each intermediary variable according to the confidence coefficient of the intermediary variable and the correctness score of the intermediary variable; and screening the medium variable with the highest comprehensive score as a log parameter of the log to be analyzed, and generating a log template of the log to be analyzed according to the log parameter of the log to be analyzed. According to the log analysis method, the stable semantic structure of the log can be more emphasized in the log analysis process, and the accuracy and generalization ability of log analysis are improved.

Description

A log parsing method and system based on a large language model Technical Field

[0001] This invention relates to the field of log analysis technology, and in particular to a log parsing method and system based on a large language model. Background Technology

[0002] With the widespread application of cloud computing, distributed systems, and microservice architectures, the scale and complexity of modern software systems are growing exponentially. During operation, massive amounts of log data are continuously generated. This log data records the system's operational status, service interaction processes, and various abnormal events, serving as a crucial data foundation and important data source for system operation and maintenance monitoring, fault diagnosis and root cause analysis, security compliance auditing, and performance analysis. However, actual system logs are typically in unstructured or semi-structured text format, with complex and diverse formats and a lack of unified standards across different systems and modules, making it difficult for log data to be directly understood by machines and automatically analyzed. Therefore, log parsing, as the primary and fundamental step in the log analysis process, has emerged. Its core objective is to divide the raw log text into two parts: the log template and dynamically changing parameter variables, thereby transforming unstructured logs into structured data, enabling the logs to be stored and analyzed in a structured format.

[0003] Existing log parsing methods mainly include rule-based log parsing methods, statistical feature-based log parsing methods, and machine learning-based log parsing methods. Among them, rule-based methods rely on manually designed parsing rules or templates, resulting in poor adaptability and high maintenance costs; statistical methods typically rely on shallow features such as word frequency and position, and their accuracy is limited when faced with complex log formats; machine learning-based methods improve generalization ability to some extent, but usually require a large amount of labeled data and lack adaptability to new scenarios.

[0004] In recent years, Large Language Models (LLMs) have been increasingly applied to log parsing tasks due to their powerful natural language understanding capabilities. However, in practical applications, new technical problems have been discovered in the log parsing process: 1) During the pre-training phase, LLMs are mainly based on natural language and code corpora, lacking specialized modeling of log structures and easily relying on surface language patterns for inference; 2) When logs contain fixed formats, key-value structures, or semantically ambiguous fields, the model is prone to introducing parsing bias; 3) LLMs tend to over-abstract, merging log events that should be distinguished into the same template, affecting the accuracy of log grouping. These problems have not yet been systematically solved in existing technologies.

[0005] Therefore, a new log parsing method is urgently needed to improve the accuracy and stability of log parsing and extraction. Summary of the Invention

[0006] This invention provides a log parsing method and system based on a large language model, which solves the problem of large deviations in log parsing based on large language models in the prior art, and achieves accurate and stable log parsing.

[0007] In a first aspect, the present invention provides a log parsing method based on a large language model, comprising: rewriting the log to be parsed using a large language model to counterfactually, obtaining multiple log variants; extracting log parameters from the multiple log variants as mediator variables using the large language model, and determining the confidence level of each mediator variable; scoring the correctness of each mediator variable based on statistical information from a historical log corpus knowledge base; determining a comprehensive score for each mediator variable based on the confidence level and the correctness score of the mediator variable; selecting the mediator variable with the highest comprehensive score as the log parameter of the log to be parsed; and generating a log template of the log to be parsed based on the log parameter of the log to be parsed.

[0008] According to a log parsing method based on a large language model provided by the present invention, the method involves rewriting the log to be parsed using a large language model to obtain multiple log variants. The method includes: determining the counterfactual rewriting method; designing prompt words based on the counterfactual rewriting method to instruct the large language model to express the log in diverse ways while preserving its core semantics; inputting the prompt words into the large language model to obtain multiple log variants output by the large language model; wherein the counterfactual rewriting method includes at least one of the following: deleting, replacing, or perturbing format connectors in the log to be parsed; structurally rearranging the order of fields or phrases in the log to be parsed; replacing key descriptive words in the log to be parsed with synonyms; semantically enhancing the content of the log to be parsed; and transforming the voice, sentence structure, or person of the log to be parsed.

[0009] According to a log parsing method based on a large language model provided by the present invention, the step of extracting log parameters as mediator variables from multiple log variants using the large language model and determining the confidence level of each mediator variable includes: extracting log parameters from multiple log variants using the large language model to obtain log parameters corresponding to each log variant; performing deduplication processing on the log parameters corresponding to each log variant to obtain multiple mediator variables; wherein each mediator variable corresponds to one or more log variants; defining the matching strength between the mediator variable and the log variant based on the occurrence of each mediator variable in each log variant and the quality score of each log variant; wherein the quality score of each log variant is obtained when performing counterfactual rewriting on the log to be parsed using the large language model; and determining the confidence level of the mediator variable based on the matching strength between the mediator variable and the log variant.

[0010] According to a log parsing method based on a large language model provided by the present invention, determining the confidence level of the mediator variable based on the matching strength between the mediator variable and the log variant includes: determining the confidence level of the mediator variable based on the proportion of the sum of the matching strengths between the mediator variable and all the log variants to the total sum of the matching strengths between all the mediator variables and all the log variants.

[0011] According to a log parsing method based on a large language model provided by the present invention, the correctness score of each mediation variable based on statistical information from a historical log corpus knowledge base includes: constructing N-gram statistical information based on the historical log corpus knowledge base; for each parameter word in the mediation variable, constructing N-gram combinations between the parameter word and adjacent terms to obtain an N-gram combination set corresponding to the mediation variable; retrieving the co-occurrence frequency of the N-gram combination, the frequency of the parameter word, and the frequency of the adjacent terms from the N-gram statistical information; and determining the correctness score of the mediation variable based on the co-occurrence frequency of each N-gram combination in the N-gram combination set, the frequency of the parameter word, and the frequency of the adjacent terms.

[0012] According to the log parsing method based on a large language model provided by the present invention, the formula for determining the correctness score of the mediator variable is as follows:

[0013] in, Represents the k-th mediator variable Correctness score, Let i = 1, 2, ..., M, where M is the mediator variable. The total number of parameter words in the text; as a mediator variable The i-th parameter word in; For parameter words The j-th adjacent word, j=1,2; The co-occurrence frequency corresponding to the N-gram combination; They are parameter words Adjacent terms The frequency.

[0014] According to the log parsing method based on a large language model provided by the present invention, the historical log corpus knowledge base includes a set of parsed log templates; after generating the log template of the log to be parsed according to the log parameters of the log to be parsed, the method further includes: calculating the longest common subsequence similarity between the log template of the log to be parsed and each log template in the log template set; when the longest common subsequence similarity exceeds a preset threshold, merging the log templates and replacing the differences with wildcards; otherwise, adding the log template of the log to be parsed to the log template set and updating the N-gram statistics related to the log template of the log to be parsed.

[0015] Secondly, the present invention also provides a log parsing system based on a large language model, comprising: a log rewriting module, used to perform counterfactual rewriting on the log to be parsed using the large language model to obtain multiple log variants; a confidence assessment module, used to extract log parameters as mediator variables from the multiple log variants using the large language model, and determine the confidence level of each mediator variable; a correctness scoring module, used to score the correctness of each mediator variable based on statistical information from a historical log corpus knowledge base; a comprehensive scoring module, used to determine a comprehensive score for each mediator variable based on the confidence level and the correctness score of the mediator variable; and a template generation module, used to select the mediator variable with the highest comprehensive score as the log parameter of the log to be parsed, and generate a log template of the log to be parsed based on the log parameter of the log to be parsed.

[0016] Thirdly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the log parsing method based on the large language model as described above.

[0017] Fourthly, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the log parsing method based on a large language model as described above.

[0018] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the log parsing method based on a large language model as described above.

[0019] The beneficial effects of the technical solutions provided by some embodiments of the present invention include at least the following: 1) The log parsing method and system based on a large language model provided by the present invention intervenes in the log to be parsed by rewriting counterfactual logs, generating diverse log variants, cutting off the path that effectively reduces the dependence of the large language model on the original log surface format, alleviating "format bias", and improving the robustness of parsing; by evaluating the correctness of mediating variables based on statistical information from the historical log corpus knowledge base, the "over-abstraction" or "improper merging" behavior of the large language model caused by semantic ambiguity is corrected, alleviating "abstraction bias"; the log parsing method of the present invention can make the log parsing process focus more on the stable semantic structure of the log, so as to output more accurate and more general log templates in diverse log formats and complex scenarios, thereby improving the accuracy and generalization ability of log parsing.

[0020] 2) This invention defines the matching strength between mediator variables and log variants based on the occurrence of each mediator variable in each log variant and the quality score of each log variant, thereby quantifying the stability of the mediator scalar under different expressions. On this basis, the confidence level of the mediator variable is calculated as the proportion of the sum of the matching strengths between the mediator variable and all log variants to the total sum of the matching strengths between all mediator variables and all log variants. This can accurately measure the degree to which the mediator variable is stably extracted under multiple equivalent expressions. If a mediator variable can be consistently identified in more high-quality log variants, its confidence level is higher, indicating that it is more likely to correspond to the true parameter boundary, which is helpful in screening high-quality mediator variables.

[0021] 3) This invention introduces N-gram statistical information based on a historical log corpus knowledge base as an unbiased reference to retrieve the co-occurrence frequency of the N-gram combination corresponding to the mediating variable, as well as the frequency of the parameter word and the frequency of adjacent terms, thereby calculating the correctness score of the mediating variable and effectively assessing the possibility of "correct mediation". This correctness score is entirely dependent on corpus-level frequency statistics and is not affected by the inherent bias of large language models, thus avoiding the uncertainty brought about by a single evaluation method that relies entirely on large language models.

[0022] 4) This invention does not require modification or fine-tuning of the internal parameters of the large language model. All interventions and corrections are implemented through the external computing framework designed in this invention, avoiding the need to retrain the model for a specific log dataset, saving a lot of annotation costs and computing resources. This allows the method to be quickly adapted to new systems or log sources, with excellent engineering portability and plug-and-play characteristics, reducing the threshold for deployment and application.

[0023] 5) By constructing and maintaining a historical log corpus knowledge base, it is possible to quickly cache and match duplicate or similar log messages. This parsing process effectively controls memory consumption and response latency while introducing deep semantic analysis and bias correction. Experimental data verifies that, while balancing parsing accuracy and execution efficiency, the resource overhead of this invention remains within a reasonable and controllable range. It is suitable for large-scale production environments that require both accuracy and performance, and possesses good engineering practicality. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0025] Figure 1 is one of the flowcharts of the log parsing method based on a large language model provided by the present invention; Figure 2 is another flowchart of the log parsing method based on a large language model provided by the present invention; Figure 3 is a schematic diagram of the entire parsing process of a log to be parsed; Figure 4 is a schematic diagram of the structure of the log parsing system based on a large language model provided by the present invention; Figure 5 is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0027] Large language models are easily influenced by their pre-training experience during log parsing, tending to make inferences based on surface format or language habits, thus introducing parsing biases, mainly in the following two aspects: First, format bias. When faced with logs containing key-value structures, connectors, or fixed formats, large language models are prone to inferring parameter boundaries based on surface format, leading to the misidentification of structural fields that should be retained as templates as parameters.

[0028] Second, there is the abstraction bias. When there are semantically ambiguous or structurally unclear segments in the logs, large language models tend to over-abstract, merging multiple different log events into the same template, resulting in overly coarse template granularity, which affects the accuracy of subsequent log grouping and analysis.

[0029] Existing methods for mitigating bias in large language models often rely on adjusting internal model parameters or require additional labeled data, making them difficult to apply directly to high-frequency, low-latency engineering scenarios such as log parsing. Furthermore, existing methods generally lack structured modeling of the log parsing process, making it difficult to constrain the model's inference path from a fundamental perspective.

[0030] Therefore, there is an urgent need for a log parsing method that does not require modification of the internal structure of a large language model and can constrain and correct its parsing behavior externally, so as to improve the accuracy and stability of log template extraction.

[0031] Please refer to Figure 1 for Example 1. Figure 1 is a flowchart illustrating one of the log parsing methods based on a large language model according to an embodiment of the present invention. The method includes: S101, rewriting the log to be parsed using a large language model to obtain multiple log variants; S102, extracting log parameters from the multiple log variants as mediator variables using the large language model, and determining the confidence level of each mediator variable; S103, scoring the correctness of each mediator variable based on statistical information from a historical log corpus knowledge base; S104, determining the comprehensive score of each mediator variable based on the confidence level and the correctness score of the mediator variable; S105, selecting the mediator variable with the highest comprehensive score as the log parameter of the log to be parsed, and generating a log template of the log to be parsed based on the log parameter of the log to be parsed.

[0032] This invention provides a log parsing method and system based on a large language model. By intervening in the log to be parsed through counterfactual log rewriting, it cuts off the large language model's dependence on the original log's surface format (such as specific connectors or fixed word order), thus alleviating "format bias." Furthermore, by evaluating the correctness of mediating variables based on statistical information from a historical log corpus knowledge base, it corrects the "over-abstraction" or "inappropriate merging" behaviors of the large language model caused by semantic ambiguity, thus mitigating "abstraction bias." The log parsing method of this invention allows the log parsing process to focus more on the stable semantic structure of the log, thereby outputting more accurate and universal log templates in diverse log formats and complex scenarios, improving the accuracy and generalization ability of log parsing.

[0033] This invention uses the raw log message as a processing variable to represent the input of log parsing; log parameters as mediating variables to represent dynamic fields in the log that change with the running state; and log templates as result variables to represent the fixed structure obtained after parsing, thereby establishing a causal model of the log parsing structure. Through this modeling approach, the log parsing process is clearly divided into a causal chain of "raw log → log parameters → log template," providing a structural basis for correcting log parsing biases through the concept of causal intervention.

[0034] In step S101 of this embodiment, the log to be parsed is rewritten using counterfactual logs, which aims to generate multiple log variants with different syntactic structures and surface expressions while keeping the core semantics of the log unchanged.

[0035] First, the raw log message to be parsed is received, and basic preprocessing is performed on the log text, including character normalization, word segmentation, and special character unification, to obtain the log to be parsed. Then, counterfactual rewriting is performed on the log to be parsed using a large language model.

[0036] In some possible embodiments, the log to be parsed is counterfactually rewritten using a large language model to obtain multiple log variants, including: determining the counterfactual rewriting method; designing prompt words based on the counterfactual rewriting method to instruct the large language model to express the log in a variety of ways while preserving the core semantics of the log; and inputting the prompt words into the large language model to obtain multiple log variants output by the large language model.

[0037] Specifically, counterfactual rewriting methods include at least one of the following: deleting, replacing, or perturbing format connectors in the log to be parsed to weaken the impact of fixed formats on parsing; structurally rearranging the order of fields or phrases in the log to be parsed to break the surface expression pattern of the log; replacing key descriptive words in the log to be parsed with synonyms; and semantically enhancing the description of the content of the log to be parsed to reduce semantic ambiguity.

[0038] Transform the voice, sentence structure, or person of the log to be parsed, such as changing it to passive voice, interrogative sentence structure, or first-person narration.

[0039] That is, the present invention can use one or more of the above methods to rewrite logs and generate log variants with diverse text expressions.

[0040] In some possible implementations, the log to be parsed can also be reverse-factually rewritten using a large language model, outputting multiple log variants, and the rewriting quality of each rewritten log variant can be automatically scored. The scoring dimensions may include: terminology accuracy, information completeness, and style consistency.

[0041] Here is an example of a counterfactual rewriting prompt template: "You are a log processing system."

[0042] Instruction objective: To enhance the diversity of expression while preserving the core semantics of log messages.

[0043] Eight rewritten versions were executed: original sentence structure, no conjunction expression, synonym replacement, structural reorganization, enhanced description, passive voice, first-person narration, and interrogative sentence structure. Each version was evaluated for quality based on: terminology accuracy (0.0-1.0), information completeness (0.0-1.0), and style consistency (0.0-1.0). Output format: Log variant 1: {text}; Log variant 2: {text}; ...; Log variant 8: {text} Score: 1: {score}|2: {score}|...|8: {score} Trigger: Process log: {log}. This counterfactual rewriting prompt template includes requirements such as the instruction target, the rewriting method, the quality evaluation method, and the output format. By designing prompts using this template, the rewriting quality of each log variant can be scored using a large language model.

[0044] This invention generates diverse log variants, making subsequent parsing independent of a single expression form, thereby effectively reducing the dependence of large language models on surface format patterns and improving the robustness of parsing.

[0045] In step S102 of this embodiment, log parameters of log variants are extracted as mediating variables through a large language model, and the confidence level of each mediating variable is evaluated.

[0046] Specifically, firstly, log parameters are extracted from multiple log variants using a large language model, resulting in log parameters for each log variant. The following is an example of a prompt word template for log parameter extraction using a large language model: "You are a parameter extractor."

[0047] Instruction objective: For each rewritten log variant (# represents the number), extract the dynamic parameter values, i.e., the variable parts that will change in different log instances.

[0048] Output format: Parameter #: ({param1},{param2},...) Other constraints: No content will be output except as specified above. No additional comments or explanations will be added.

[0049] Example: Log variant 1: {example_text_1} Parameter 1: ({example_param_11}, {example_param_21}) Log variant 2: {example text 2} Parameter 2: ({example_param_21},…) Trigger: Log variant #:{text} This log parameter extraction prompt template example includes the instruction target, output format requirements, and other constraints, and provides a reference example. By designing prompt text using this prompt template and inputting it into the large language model, you can instruct the large language model to extract log parameters for each log variant.

[0050] Then, since different log variants may correspond to the same log parameters, deduplication is performed on the log parameters for each log variant. Each log parameter obtained after deduplication becomes a mediator variable. It's understandable that each log parameter / mediator variable includes multiple parameter words. For example, suppose a log variant is: CPU L1 I cache 16K, L1 D cache 16K. The log parameters extracted by the large language model are: (L1 I, 16K, L1 D, 16K). This log parameter is a mediator variable, which includes four parameter words. After deduplication, multiple log variants may correspond to the same mediator variable.

[0051] Finally, the confidence score for each mediating variable is calculated. For example, specific prompt words can be used to instruct the large language model to extract log parameters for each log variant while outputting a confidence score as the confidence level. Alternatively, the confidence score of the mediating variable can be determined based on the semantic similarity between the log parameters extracted from the log variant and the log to be parsed.

[0052] For example, the confidence level of the mediating variable can be calculated by statistically analyzing its occurrence in different log variants and the rewrite quality of each variant. For instance, one could identify which log variants extracted the mediating variable from, and then use a weighted sum of the rewrite quality scores of the corresponding log variants as the confidence level of the mediating variable.

[0053] In step S103 of this embodiment, the degree of matching between the mediating variable and the historical log template corresponding to the historical log corpus knowledge base is determined by statistical information from the historical log corpus knowledge base. The core idea is to use the distribution pattern of parameters in historical data to determine whether the currently extracted log parameters are "normal".

[0054] For example, a historical log corpus knowledge base can be built and maintained to record the historical log parameters and their frequency of occurrence for each log template. Newly extracted mediating variables can be scored based on their frequency of occurrence or TF-IDF value in the historical log corpus knowledge base. Parameters that occur frequently (such as the common port number 8080 and status code 200) score highly, indicating their correctness and reliability; parameters that never occur or are infrequent (such as abnormal IP address formats) score low.

[0055] For example, scoring can be done by combining regular expressions with statistical information. For instance, if historical statistics indicate that the data type of a parameter position is usually numeric (such as block_id), and the parameter word at the corresponding position of the mediator variable is in non-numeric format (such as containing special characters), then a low score or zero score can be given.

[0056] In step S104 of this embodiment, a comprehensive score for each mediating variable is calculated based on the confidence level and correctness score of each mediating variable.

[0057] For example, the product of the confidence level and the correctness score of each mediating variable can be directly defined as the overall score of that mediating variable:

[0058] in, For the kth mediator variable Overall score , These are the mediating variables. The confidence and correctness scores are calculated. k = 1, 2, ..., K, where K is the total number of mediating variables.

[0059] For example, a comprehensive score can also be calculated by weighting and summing the confidence level and correctness score of each mediating variable. In step S105 of this embodiment, the mediating variable with the highest comprehensive score is selected as the log parameter of the log to be parsed, and a log template of the log to be parsed is generated based on the log parameter of the log to be parsed.

[0060] Specifically, the mediator variables with the highest overall scores were selected. The large language model is guided to parse the log file containing the language. The corresponding log parameter {parameter_list} is replaced with the placeholder {param} to obtain the log template for the log to be parsed.

[0061] The log parsing process is performed by the large language model. The following is an example of a prompt word template for log parsing: "Extract the log template from the log to be parsed {log} by replacing the parameters in {parameter_list} of the log with {param}, and output the log template. Do not add any extra text before the output."

[0062] Example: log: 'DHCPOFFER on 10.100.4.251 to 00:11:43:e3:ba:c3 via ethl' parameter_list:{ '10.100.4.251','00:11:43:e3:ba:c3'} Log template: 'DHCPOFFER on {param} to {param} via ethl' Please extract the log template from the following input: log: {log} parameter_list: {parameter list}” This log parsing prompt word template provides instructions for parameter substitution and log parsing, and provides an example. Based on this prompt word template, constructing prompt words can guide the large language model to output the target log template, which serves as the final parsing result of the current log to be parsed.

[0063] Please refer to Figure 2 for implementation example 2. Figure 2 is a flowchart of a log parsing method based on a large language model provided by an embodiment of the present invention. The method includes: S201, matching the log to be parsed with parsed log templates in a historical log corpus knowledge base; S202, when the match is successful, directly outputting the corresponding log template as the log parsing result and ending the parsing; S203, when the match fails, rewriting the log to be parsed using a large language model to obtain multiple log variants; S204, extracting log parameters from the multiple log variants as mediator variables using a large language model; S205, defining the matching strength between the mediator variable and the log variant based on the occurrence of each mediator variable in each log variant and the quality score of each log variant; S206, determining the confidence level of the mediator variable based on the matching strength between the mediator variable and the log variant; S207, constructing N-gram statistical information based on the historical log corpus knowledge base; S208, for each parameter word in the mediator variable, constructing an N-gram combination between the parameter word and adjacent terms to obtain the mediator variable. S209. Retrieve the co-occurrence frequency, parameter word frequency, and adjacent term frequency of each N-gram combination from the N-gram statistics; S210. Determine the correctness score of the mediating variable based on the co-occurrence frequency, parameter word frequency, and adjacent term frequency of each N-gram combination in the N-gram combination set; S211. Determine the comprehensive score of each mediating variable based on the confidence level and correctness score of the mediating variable; S212. Select the mediating variable with the highest comprehensive score as the log parameter of the log to be parsed, and generate the log template of the log to be parsed based on the log parameter of the log to be parsed; S213. Calculate the longest common subsequence similarity between the log template of the log to be parsed and each log template in the log template set; S214. When the longest common subsequence similarity exceeds a preset threshold, merge the log templates and replace the differences with wildcards; otherwise, add the log template of the log to be parsed to the log template set and update the N-gram statistics related to the log template of the log to be parsed.

[0064] This invention constructs and maintains a historical log corpus knowledge base, enabling fast caching and matching of duplicate or similar log messages. This parsing process effectively controls memory consumption and response latency while introducing deep semantic analysis and bias correction.

[0065] This invention also defines the matching strength between mediator variables and log variants based on the occurrence of each mediator variable in each log variant and the quality score of each log variant, thereby quantifying the stability of the mediator scalar under different expressions; on this basis, the confidence level of the mediator variable is calculated, which can accurately measure the degree to which the mediator variable is stably extracted under multiple equivalent expressions.

[0066] Furthermore, this invention introduces N-gram statistical information based on a historical log corpus knowledge base as an unbiased reference to calculate the correctness score of the mediating variable, thus avoiding the uncertainty caused by relying entirely on a single evaluation method of a large language model.

[0067] In step S201 of this embodiment, a historical log corpus knowledge base is also constructed and maintained, which stores the template tree structure of parsed log templates.

[0068] Specifically, the construction process of the template tree structure of the parsed log templates is as follows: Each log template is first tokenized, resulting in a sequence of discrete tokens, which are then progressively inserted into the tree structure starting from the root node, until a leaf node is reached. Internal nodes of the tree represent individual tokens; wildcard nodes (denoted as <...) The tree structure is used to match variable-length token sequences, thus providing a more generalized abstraction of dynamic parameters. Leaf nodes correspond to complete log templates, which are formed by concatenating tokens along the path from the root node to the leaf node. Based on this tree structure, template retrieval can be completed with only one top-down traversal; simultaneously, subtrees share a common prefix, enabling efficient filtering and merging.

[0069] Before performing log parsing according to the present invention, the log to be parsed is first matched with the template tree structure of the parsed log templates in the historical log corpus knowledge base.

[0070] Specifically, the input log to be parsed is segmented into a token sequence, and then compared layer by layer from top to bottom starting from the root node of the template tree. Internal nodes are required to match the fixed token exactly, while wildcard nodes are not. > This is used to absorb variable-length fragments to abstract dynamic parameters, and to avoid overgeneralization by setting the maximum span of wildcards; the matching process proceeds recursively. If a leaf node is finally hit, it means that the corresponding log template already exists in the cache and can be reused directly; if multiple candidate log templates are hit at the same time, the log template with the longest total length of constant fragment characters is selected as the final log parsing result.

[0071] In step S202 of this embodiment, if a match is successful, the matched log template is output directly, and the log parsing ends.

[0072] In step S203 of this embodiment, if the matching fails, it indicates that a new log template has appeared. The log parsing process based on the large language model proposed in this invention is then entered to generate a new log template. The new log template is then written back to the template tree cache for subsequent rapid reuse.

[0073] Step S204 in this embodiment can be referred to step S102 in embodiment one, and will not be repeated here.

[0074] In step S205 of this embodiment, the stability of candidate mediators under different expressions is quantified by defining the matching strength between the mediator variable and all log variants.

[0075] Specifically, suppose there are a total of log variants generated by the large language model. Item, denoted as For each log variant After deduplication of the extracted log parameters, we get Different mediator variables Where s = 1, 2, ..., S, Indicates the first Log variant, Indicates the total number of log variants. Indicates the first There are 1 mediator variable, k=1,2,…,K. This represents the total number of mediating variables.

[0076] Define mediator variables With log variants Matching strength for:

[0077] in, It is an indicator function, when the mediator variable From log variants When a value is extracted, it takes the value 1; otherwise, it takes the value 0. Indicates log variant The rewrite quality score.

[0078] In step S206 of this embodiment, based on the mediation variable With log variants Match strength between Calculate the confidence level of the mediating variable.

[0079] In some possible embodiments, determining the confidence level of a mediator variable based on the strength of the match between the mediator variable and log variants includes: determining the confidence level of the mediator variable based on the proportion of the sum of the strengths of the matches between the mediator variable and all log variants to the total sum of the strengths of the matches between all mediator variables and all log variants.

[0080] Specifically, mediating variables The confidence score is calculated using the following formula:

[0081] Wherein, the numerator represents the mediating variable. The sum of quality-weighted match strengths across all log variants, with the denominator representing all mediation variables. ~ The sum of quality-weighted matching strengths across all log variants. Let n represent the nth mediating variable, where n = 1, 2, ..., K. The confidence score is obtained after normalization. Used to measure mediator variables The degree to which a mediating variable is stably extracted across multiple equivalent representations. If a mediating variable can be consistently identified across more high-quality log variants, its confidence level is higher, indicating that it is more likely to correspond to the true parameter boundaries.

[0082] In step S207 of this embodiment, in order to avoid relying entirely on the output of a large language model, N-gram statistical information based on a historical log corpus knowledge base is introduced as an unbiased reference.

[0083] Specifically, the construction of N-gram statistical information includes the following steps: 1) Segmenting the historical log data in the historical log corpus knowledge base and adding boundary markers at the beginning and end of the logs; 2) Constructing unigram and bigram frequency dictionaries based on the segmentation results; 3) Pruning low-frequency N-gram items to retain N-gram statistical information with stable structural features.

[0084] In step S208 of this embodiment, for each mediating variable, a corresponding N-gram combination set is constructed.

[0085] Specifically, for those containing Mediation variables of one parameter word Each parameter word There are two adjacent terms. Construct parameter words Its two adjacent terms The N-gram combinations are used to form the mediator variable, and the N-gram combinations corresponding to each parameter word are combined. The corresponding set of N-gram combinations For example, the set of N-gram combinations corresponding to the mediator variables ('L1 I', '16K', 'L1 D', '16K'). is {'CPU:, L1', 'I cache','cache: 16K', '16K, L1', '16K, L1', 'D cache:','cache: 16K','16K, [E]'}.

[0086] In step S209 of this embodiment, the co-occurrence frequencies corresponding to the above N-gram combinations are retrieved from the N-gram statistical information. and parameter words frequency Adjacent terms frequency Statistical information, etc.

[0087] In step S210 of this embodiment, the correctness of each mediating variable is evaluated based on the retrieved statistical information.

[0088] Specifically, first calculate the mediating variables. Stability score :

[0089] The above formula describes the mediating variable. Stability at the N-gram co-occurrence level. Since log parameters typically have low co-occurrence stability, a higher score often indicates that the mediation contains a non-parametric component. Finally, the mediation variable... Correctness score Defined as:

[0090] Correctness score Reflects the mediating variable The likelihood of it becoming a "correctness mediator"; the higher the score, the more accurate the obtained log template. Furthermore, this correctness score is unaffected by the inherent biases of large language models, as it relies entirely on corpus-level frequency statistics, rather than the output of the large language model.

[0091] Steps S211 to S212 in this embodiment can be referred to S104 to S105 in Embodiment 1, and will not be repeated here.

[0092] In step S213 of this embodiment, after a new log template is generated, the longest common subsequence similarity between the new log template and the parsed log template is calculated.

[0093] In step S214 of this embodiment, the longest common subsequence similarity between the new log template and the parsed log template is used to update the historical log data knowledge base.

[0094] 1) When the similarity exceeds the preset threshold, the log templates are merged and the differences are replaced with wildcards; 2) When the similarity is below the threshold, the new log template is inserted into the template tree; for example, suppose that there is already a log template "User<>loginfrom<>" in the currently parsed log template set, where "<>" corresponds to the log parameters, and the frequency dictionary also maintains some N-gram statistics containing wildcards. Suppose a new log entry arrives to be parsed. Using the method of this invention, a new log template "User Alicelogin from 10.0.0.1" is generated. First, this new log template is compared with each existing log template in the log template set to calculate the longest common subsequence similarity. It is found that the longest common subsequence similarity between this new log template and "User<>login from<>" exceeds the preset similarity threshold of 2. Therefore, it is determined that this is just a specific instance of an existing log template and no new log template needs to be added. Then, a merging generalization is performed: the different positions of the new log template and the matched existing log templates are uniformly represented by wildcards. The merged result is still "User<>login from<>", which is used to replace the original matching template (which is actually equivalent to keeping the log template set unchanged but confirming its coverage). Conversely, if the new log template is "Disk sda error code<>at sector<>", and its longest common subsequence similarity with any template in the log template set does not reach the preset similarity threshold, the algorithm will add it as a brand new log template to the log template set. At the same time, it will extract some N-gram statistical information (such as fragments containing wildcards) from this new log template, and write wildcards that have not yet appeared in the frequency dictionary into the dictionary with a small initial frequency to facilitate subsequent matching and statistical updates.

[0095] 3) Synchronously update N-gram statistics related to the new log template.

[0096] This invention does not require modification or fine-tuning of the internal parameters of a large language model. All interventions and corrections are implemented through the external computing framework designed in this invention, avoiding the need to retrain the model for a specific log dataset, saving a lot of annotation costs and computing resources. This allows the method to be quickly adapted to new systems or log sources, and has excellent engineering portability and plug-and-play characteristics, reducing the threshold for deployment and application.

[0097] Please refer to Figure 3, which is a schematic diagram of the entire parsing process for a log file to be parsed. As shown in Figure 3, assuming the original log file to be parsed is "CPU: L1 Cache: 16K, L1 D cache: 16K", ambiguous symbols in the log file that are prone to parsing errors, such as ":", "L1 I", and "L1 D", can be marked in advance for subsequent log rewriting. First, based on the original log file to be parsed, prompt words are generated using a counterfactual rewriting prompt word template and input into a large language model to generate multiple log variants and provide quality scores. Then, log parameters are extracted from each log variant and deduplicated to obtain several candidate mediating variables, and their confidence is calculated based on the quality score and frequency. For example, the large language model generates eight log variants for the original log to be parsed. Log parameters are extracted from these eight variants and deduplicated to obtain four candidate mediator variables. The confidence scores of these four candidate mediator variables are: ('L1 I cache: 16K, L1 D cache: 16K',): 0.130; ('L1 I', '16K', 'L1 D', '16K'): 0.113; ('L1', '16K', 'L1', '16K'): 0.250; ('16K', '16K'): 0.506. Then, the correctness score of each mediator variable is evaluated by matching against a historical log corpus knowledge base. The method for evaluating the correctness score of each mediator variable is as follows: an N-gram combination set of bigrams is constructed for each mediator variable, and then relevant bigrams are retrieved from the knowledge base and their correctness scores are calculated.

[0098] For example, the N-gram combination set corresponding to the candidate mediator variables ('L1 I', '16K', 'L1 D', '16K') is: bigrams={'CPU:, L1', 'I cache','cache: 16K', '16K, L1','16K, L1', 'Dcache:','cache: 16K','16K, [E]'}. Then, the confidence and correctness scores are combined to obtain the final comprehensive score. Finally, the mediator variable with the highest comprehensive score is selected to generate the structured parsing template "CPU: L1 I cache: {param}, L1 D cache: {param}".

[0099] The entire process in Figure 3 gradually reduces the analytical bias caused by format, symbol, and semantic ambiguity through mediation analysis in causal inference.

[0100] The effectiveness of the method of the present invention will be verified below with specific experimental data.

[0101] I. Experimental Setup This experiment was conducted on a Windows 10 operating system, using Python 3.6 and PyTorch version 1.9.0. The experiment was performed on a high-performance computer equipped with an NVIDIA GeForce RTX 4050 GPU. During the experiment, the large language model interface was called to perform log counterfactual rewriting and parameter extraction operations, and a statistical model was used to complete biased scoring and template generation.

[0102] II. Dataset Experiments: Fourteen publicly available log datasets (HDFS, Hadoop, Spark, Zookeeper, BGL, HPC, Thunderbird, Linux, HealthApp, Apache, Proxifier, OpenSSH, OpenStack, and Mac) from the LogPAI platform were selected as validation objects. These datasets cover various typical application scenarios, including distributed systems, microservice systems, operating system logs, and high-performance computing system logs. Each log entry is labeled with a corresponding real log template identifier to evaluate the correctness of the log parsing results.

[0103] III. Comparison Methods In order to comprehensively evaluate the performance of the method proposed in this invention, the comparison methods in this experiment include: 1) Log parsing method based on syntax rules.

[0104] These methods extract templates from log text using predefined parsing rules or log structure patterns, offering advantages such as high parsing efficiency and mature implementation, and are widely used in industrial scenarios. Typical examples include Drain (An online log parsing approach with a fixed depth tree) and Logram (Efficient log parsing using n-gram dictionaries). These methods perform well in scenarios with relatively stable log formats, but are sensitive to changes in log structure.

[0105] 2) Log parsing method based on large language model.

[0106] These methods leverage the natural language understanding capabilities of large language models to directly generate log templates from raw logs, and have made significant progress in parsing accuracy in recent years. Typical examples include LILAC (Lilac: Logparsing using llms with adaptive parsing cache) and LibreLog (LibreLog: Accurate and Efficient Unsupervised Log Parsing Using Open-Source Large Language Models). These methods demonstrate high parsing accuracy even in scenarios with complex log structures and semantically similar logs.

[0107] Since different comparison methods use different large language models in their original implementations, in order to ensure the fairness and comparability of the experimental results, in this embodiment, the same large language model is uniformly used as the underlying model support for all comparison methods based on large language models.

[0108] IV. Evaluation Metrics: To assess log parsing performance, the following evaluation metrics were used in the experiment: ① Log Grouping Accuracy (GA): measures whether logs are correctly grouped into the corresponding log templates; ② F1 score of Log Grouping Accuracy (FGA); ③ Template Parsing Accuracy (PA): measures whether each term in the parsed log template is completely consistent with the real template; ④ F1 score of Template Parsing Accuracy (FTA).

[0109] The above metrics can comprehensively reflect the log parsing effect from two levels: log grouping and template parsing.

[0110] V. Results Analysis (1) Validity Table 1. Experimental comparison of the method of the present invention and the comparative method on different indicators

[0111] Table 1 shows the experimental results of the method of this invention compared with four other methods (Drain, Logram, LILAC, and LibreLog) on ​​different datasets. As shown in Table 1, the method of this invention achieves superior performance in both log grouping and log parsing. Specifically, the method achieves an accuracy of 95.0% in log grouping accuracy (GA), 89.8% in F1 grouping accuracy (FGA), 87.5% in log parsing accuracy (PA), and 80.1% in template parsing F1 accuracy (FTA). These results demonstrate that the method of this invention has high accuracy in both log grouping and template parsing tasks.

[0112] Further comparison with existing log parsing methods based on large language models reveals that the method of this invention has significant advantages in handling scenarios with complex log structures and semantic ambiguity. For example, compared to log parsing methods that use example logs for context learning enhancement, its log grouping accuracy and parsing accuracy are improved to 95.0% and 87.5%, respectively; compared to log parsing methods that use similar log grouping for cue enhancement, the method of this invention also demonstrates higher accuracy in the above metrics.

[0113] Experimental results show that existing methods struggle to fully utilize the global statistical features of log data in complex log structures and semantically ambiguous scenarios, thus affecting parsing performance. In contrast, the method of this invention combines the semantic understanding capabilities of a large language model with the statistical characteristics of log data to correct the parsing results, effectively improving the accuracy of log parsing, especially demonstrating greater stability in ambiguous and complex log structure scenarios.

[0114] Furthermore, compared to traditional rule-based log parsing methods, the method of this invention shows significant advantages in parameter identification and template parsing accuracy. Experimental results show that rule-based log parsing methods are more than 10% and 30% lower than the method of this invention in terms of log grouping accuracy and log parsing accuracy, respectively. These results indicate that although rule-based methods can perform coarse-grained grouping of logs, they have significant limitations in terms of log parameter identification accuracy and parsing generalization ability.

[0115] (2) Memory Consumption To further evaluate the engineering feasibility of the method proposed in this invention in practical applications, this embodiment compares and analyzes the memory consumption of different log parsing methods during the log analysis process. The peak memory usage of each method in the log feature analysis stage (Corpus Profiling) and the log parsing stage (Parsing) was statistically analyzed, and the experimental results are shown in Table 2.

[0116] Table 2. Experimental comparison of peak memory usage between the method of the present invention and the comparative method.

[0117] Experimental results show that traditional rule-based log parsing methods have low memory consumption. These methods tightly integrate log preprocessing with template extraction, relying only on lightweight term dictionaries or N-gram frequency tables for log analysis, thus maintaining low memory usage in both stages. In contrast, log parsing methods based on large language models typically require additional memory overhead during the log feature analysis stage. For example, extracting example logs or grouping logs to enhance prompts introduces significant memory usage during log analysis; in the log parsing stage, memory consumption mainly comes from storing parsed templates and constructing enhanced prompts.

[0118] In the log feature analysis stage, the memory usage of the method of the present invention is mainly used to build a global N-gram statistical dictionary, and its peak memory consumption remains at a low level. In the log parsing stage, the memory usage increases due to the need to maintain multiple counterfactual log rewriting results and corresponding mediator variable caches at the same time, but it is still within a controllable range overall.

[0119] Experimental results show that, compared with existing log parsing methods based on large language models, the method of this invention can effectively control memory consumption while introducing causal intervention and counterfactual rewriting mechanisms, achieving a good balance between parsing accuracy and resource consumption, and has high engineering practicality.

[0120] Please refer to Figure 4, which is a schematic diagram of a log parsing system based on a large language model according to an embodiment of the present invention. The system includes: a log rewriting module 410, used to perform counterfactual rewriting on the log to be parsed using a large language model to obtain multiple log variants; a confidence assessment module 420, used to extract log parameters from the multiple log variants as mediator variables using a large language model and determine the confidence level of each mediator variable; a correctness scoring module 430, used to score the correctness of each mediator variable based on statistical information from a historical log corpus knowledge base; a comprehensive scoring module 440, used to determine the comprehensive score of each mediator variable based on the confidence level and the correctness score of the mediator variable; and a template generation module 450, used to select the mediator variable with the highest comprehensive score as the log parameter of the log to be parsed and generate a log template of the log to be parsed based on the log parameter of the log to be parsed.

[0121] The log parsing system based on a large language model described above and the log parsing method based on a large language model described above can be referred to and correspond to each other.

[0122] Figure 5 illustrates a schematic diagram of the physical structure of an electronic device. As shown in Figure 5, the electronic device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540. The processor 510, communication interface 520, and memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a log parsing method based on a large language model provided in the above-described method embodiments.

[0123] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0124] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute a log parsing method based on a large language model provided in the above-described method embodiments.

[0125] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is implemented to perform a log parsing method based on a large language model provided by the methods described above.

[0126] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0127] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0128] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A log parsing method based on a large language model, characterized in that, include: The log to be parsed is rewritten counterfactually using a large language model to obtain multiple log variants; log parameters are extracted from each of the log variants using the large language model as mediator variables, and the confidence level of each mediator variable is determined. The correctness score of each mediation variable is determined based on statistical information from a historical log corpus knowledge base. Based on the confidence level and the correctness score of the mediating variable, a comprehensive score is determined for each mediating variable; the mediating variable with the highest comprehensive score is selected as the log parameter of the log to be parsed; and a log template of the log to be parsed is generated based on the log parameter of the log to be parsed.

2. The log parsing method based on a large language model according to claim 1, characterized in that, The process of rewriting the log to be parsed using a large language model to obtain multiple log variants includes: determining the method of counterfactual rewriting; designing prompt words based on the method of counterfactual rewriting to instruct the large language model to express the log in a variety of ways while preserving the core semantics of the log; inputting the prompt words into the large language model to obtain multiple log variants output by the large language model; wherein the method of counterfactual rewriting includes at least one of the following: deleting, replacing, or perturbing the format connectors in the log to be parsed; structurally rearranging the order of fields or phrases in the log to be parsed; replacing key descriptive words in the log to be parsed with synonyms; semantically enhancing the description of the content of the log to be parsed; and changing the voice, sentence structure, or person of the log to be parsed.

3. The log parsing method based on a large language model according to claim 1, characterized in that, Determining the confidence level of each mediating variable includes: defining the matching strength between the mediating variable and the log variant based on the occurrence of each mediating variable in each log variant and the quality score of each log variant; wherein the quality score of each log variant is obtained when performing counterfactual rewriting on the log to be parsed using a large language model; and determining the confidence level of the mediating variable based on the matching strength between the mediating variable and the log variant.

4. The log parsing method based on a large language model according to claim 3, characterized in that, Determining the confidence level of the mediator variable based on the matching strength between the mediator variable and the log variant includes: determining the confidence level of the mediator variable based on the proportion of the sum of the matching strengths between the mediator variable and all the log variants to the total sum of the matching strengths between all the mediator variables and all the log variants.

5. The log parsing method based on a large language model according to claim 1, characterized in that, The method of scoring the correctness of each mediation variable based on statistical information from a historical log corpus knowledge base includes: constructing N-gram statistical information based on the historical log corpus knowledge base; for each parameter word in the mediation variable, constructing N-gram combinations between the parameter word and adjacent terms to obtain the N-gram combination set corresponding to the mediation variable; retrieving the co-occurrence frequency of the N-gram combination, the frequency of the parameter word, and the frequency of the adjacent terms from the N-gram statistical information; and determining the correctness score of the mediation variable based on the co-occurrence frequency of each N-gram combination in the N-gram combination set, the frequency of the parameter word, and the frequency of the adjacent terms.

6. The log parsing method based on a large language model according to claim 5, characterized in that, The formula for determining the correctness score of the mediator variable is as follows: in, Represents the k-th mediator variable Correctness score, Let i = 1, 2, ..., M, where M is the mediator variable. The total number of parameter words in the text; as a mediator variable The i-th parameter word in; For parameter words The j-th adjacent word, j=1,2; The co-occurrence frequency corresponding to the N-gram combination; They are parameter words Adjacent terms The frequency.

7. The log parsing method based on a large language model according to claim 5, characterized in that, The historical log corpus knowledge base includes a set of parsed log templates; After generating the log template of the log to be parsed based on the log parameters of the log to be parsed, the method further includes: calculating the longest common subsequence similarity between the log template of the log to be parsed and each log template in the log template set; When the similarity of the longest common subsequence exceeds a preset threshold, the log templates are merged and the differences are replaced with wildcards; otherwise, the log template of the log to be parsed is added to the log template set, and the N-gram statistics related to the log template of the log to be parsed are updated.

8. A log parsing system based on a large language model, characterized in that, include: The log rewriting module is used to perform counterfactual rewriting on the log to be parsed using a large language model to obtain multiple log variants; the confidence evaluation module is used to extract log parameters as mediator variables from the multiple log variants using the large language model and determine the confidence of each mediator variable. The correctness scoring module is used to score the correctness of each of the aforementioned mediating variables based on statistical information from a historical log corpus knowledge base. The comprehensive scoring module is used to determine the comprehensive score of each of the mediating variables based on the confidence level and the correctness score of the mediating variables, respectively. The template generation module is used to select the mediator variable with the highest comprehensive score as the log parameter of the log to be parsed, and generate the log template of the log to be parsed based on the log parameter of the log to be parsed.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the log parsing method based on a large language model as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the log parsing method based on a large language model as described in any one of claims 1 to 7.

Images