Micro-service log analysis method based on double-similarity retrieval and adaptive reasoning

Abstract

The invention discloses a micro-service log analysis method based on dual-similarity retrieval and adaptive reasoning, relates to the technical field of computers, and aims to solve the analysis problem caused by semantic diversity and unstable structure of micro-service logs. The method comprises the following steps of: preprocessing and grouping an original log, and matching and multiplexing an existing template through a template cache; when the big language model is not hit, a difference log sample is selected on the basis of the editing distance, a reference example is selected through semantic-structure double-similarity retrieval, a structured cue word containing a task description module, a reasoning mode selection module, a thinking chain reasoning module and other modules is constructed, the big language model is guided to conduct adaptive reasoning extraction on a template, and a cache is updated. Experiments show that the method is superior to an existing mainstream method in indexes such as grouping accuracy and analysis accuracy, can adapt to micro-service complex scenes, and improves the accuracy and stability of log analysis.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically, to a microservice log parsing method based on dual similarity retrieval and adaptive reasoning. Background Technology

[0002] In intelligent operation and maintenance scenarios of microservice systems, a large number of independently deployed service instances, containers, and nodes run in parallel. Different services generate logs according to their respective development specifications and technology stacks, exhibiting characteristics such as massive quantity, diverse formats, inconsistent fields, and similar structures but significant differences in variables. The same business event is often recorded separately in multiple services, forming a cross-component, multi-source log fragment chain. Meanwhile, logs, due to their low collection cost, wide coverage, and inclusion of key information such as abnormal states, call parameters, and runtime environment, have become one of the core data sources supporting anomaly detection, root cause localization, and fault diagnosis. However, microservice logs generally possess semi-structured and structure-drifting characteristics (such as new fields introduced by different versions or service teams, or changes in output format), making traditional parsing methods relying on manual rules or fixed templates difficult to work stably in the long term in high-concurrency, multi-version evolution microservice environments. Manual methods are also insufficient to handle massive log data. To address this, researchers have proposed various automated log parsing methods, the core of which lies in identifying variables in logs and extracting common templates. Current mainstream log parsing methods can be mainly divided into unsupervised methods and supervised methods.

[0003] Unsupervised methods are widely used in scenarios where manual annotation is not required, primarily relying on heuristic rules or statistical features for template extraction. Typical heuristic rule-based methods include Drain and Spell. Drain is based on the assumption that the first word of a log entry is constant, using a fixed-depth rule tree structure for hierarchical log classification. However, in microservice systems, many logs begin with dynamic parameters, URLs, request IDs, etc., often rendering this assumption invalid, leading to biases in the initial branching stage and affecting overall parsing accuracy. Spell extracts template constants through longest common subsequence matching, adapting to logs of varying lengths. However, in microservice environments, it is susceptible to interference from complex paths, parameter strings, and punctuation marks, resulting in inaccurate variable identification. Logram is an N-gram model based on statistical features, extracting templates by identifying high-frequency structural fragments. While performing well on well-structured, single-system datasets, it heavily relies on preset rules and frequency thresholds, making it difficult to adapt to new patterns in the semantically complex and frequently evolving logs of microservice scenarios. Overall, while unsupervised log parsing methods are convenient and do not require manual annotation, they rely too heavily on manual rules and frequency settings. They are particularly sensitive to dynamic changes in log structure and semantics in microservice environments and are difficult to adapt to complex scenarios across components and versions.

[0004] Supervised methods introduce manually labeled data to train or fine-tune models for automatic log template extraction. For example, the LogPPT method, based on a pre-trained language model and prompting learning techniques, guides the model to generate expected log templates using only a small amount of labeled data. While this type of method can improve template extraction accuracy in some stable scenarios, in microservice systems, it requires continuous supplementation and maintenance of labeled data for different services and versions, resulting in high training and maintenance costs. Furthermore, the model is also sensitive to changes in log structure, making it difficult to maintain stable performance in environments with diverse semantics and rapid version iterations.

[0005] These methods typically guide the model to automatically identify variables and extract templates from input logs by designing prompts and a small number of log template examples. For example, the DivLog method uses a few-shot prompt strategy, enabling the model to learn template extraction rules through context; LILAC further introduces a log caching mechanism to improve the accuracy of template extraction and overall parsing efficiency. Compared to traditional methods, these methods can be transferred between different systems without retraining and have strong generalization capabilities. However, in a microservice system environment, existing log parsing methods based on large language models still have the following shortcomings:

[0006] (1) The input samples are not sufficiently differentiated, resulting in redundancy. Microservice logs often generate a large number of highly similar logs on the same service instance or the same call path. If the entire set of logs is directly input into the LLM, it is easy to cause information redundancy, causing the model to focus too much on a few patterns, misleading the reasoning process, and reducing the template generalization ability on cross-instance and cross-version logs.

[0007] (2) Lack of representativeness in the selection of reference examples. Existing methods usually rely on manual or random selection of examples, failing to take into account both the semantic and structural features of logs, especially the semantic and structural differences across services. This results in the selected examples being too similar to or semantically unrelated to the target logs. This may "leak the answer," rendering the results obtained by LLM worthless for practical evaluation, and may also affect the learning ability of LLM and reduce parsing performance.

[0008] (3) Lack of inference control and unstable output. Current methods mostly use a "single-step generation" approach to directly output templates, lacking a clear inference path, which leads to inaccurate variable identification, especially when the logs contain omitting fields or use natural language descriptions, resulting in unstable output. At the same time, the fixed inference mode that cannot be dynamically adjusted according to the complexity of the logs will cause LLM to over-infer on simple logs or under-infer on complex logs, resulting in a decrease in parsing accuracy. Summary of the Invention

[0009] In view of the problems of existing technologies being unable to adapt to the needs of microservice systems and having unstable inference, this invention provides a microservice log parsing method based on dual similarity retrieval and adaptive inference. First, the original logs are preprocessed to extract the log content. Then, grouping and template cache matching are performed. Next, log samples with significant differences are selected as input by calculating edit distance. Then, semantic-structural dual similarity is calculated based on the selected samples to select template reference examples. A prompt word with adaptive inference function is constructed to guide the Large Language Model (LLM) in adaptive inference and log parsing. Finally, the log template is output and the template cache is updated.

[0010] The technical means employed in this invention are as follows: A microservice log parsing method based on dual similarity retrieval and adaptive inference includes the following steps: S1. Obtain the log data to be parsed, preprocess the log data to be parsed, and extract the log content corresponding to the log data to be parsed; S2. Represent the log content as a log content sequence, process the log content sequence based on the N-gram method, filter the constant words in the log content sequence to construct a log group structure identifier, and cluster logs with the same log group structure identifier into a group. S3. Perform template cache matching in the template cache library based on the log group structure identifier. The template cache library is used to store and retrieve parsed log templates. If the cache is hit, the corresponding template is directly reused to complete the log parsing. If the cache is not hit, proceed to S4. S4. In the log group, select logs with significant differences based on the edit distance between log contents as input samples; S5. Take the first log in the input sample as the query log, calculate the comprehensive similarity between the query log and each log in the template example library, and select the three logs with the highest comprehensive similarity to the input sample as reference examples to write prompt words. The template example library is used to store labeled example structures. The example structure includes ID, log content and its corresponding template. S6. Construct a structured Prompt based on the reference example. The Prompt includes a task description, example reference, reasoning mode selection, thought chain reasoning, and input and output instructions. S7. Call the LLM model and extract the log template based on the structured Prompt.

[0011] Furthermore, the log content includes event descriptions, state changes, or parameter information.

[0012] Furthermore, based on the edit distance between log contents within the log group, log samples with significant differences are taken as input, including: S401. Deduplicate all log content in the log group. If the number of samples after deduplication is insufficient, return the remaining samples directly as input samples; otherwise, execute S402. S402. Calculate the edit distance between each pair of log entries after deduplication, and sort them from largest to smallest edit distance. S403. Select the log pair with the largest edit distance to add to the candidate set. Then calculate the edit distance between the remaining logs and the candidate set. Select the log with the largest edit distance that is greater than the preset minimum edit distance threshold to add to the candidate set, until the required number is met.

[0013] Furthermore, the minimum edit distance threshold is set to 10 characters.

[0014] Furthermore, the comprehensive similarity is calculated based on the weighted sum of semantic similarity and structural similarity, wherein the semantic similarity is calculated using the cosine similarity of the embedded vectors, and the structural similarity is calculated using the Jaccard coefficient.

[0015] Furthermore, the example with the highest structural similarity to the query object is excluded during the sorting process.

[0016] Furthermore, the method also includes: S8. Write the extracted log templates into the template cache library.

[0017] Compared with the prior art, the present invention has the following advantages: This invention first preprocesses the raw logs to extract their content and groups them, constructing group structure identifiers for template caching and reuse to reduce LLM call costs. Then, to improve the diversity of input log samples, logs with significant structural differences are selected as LLM input samples through sample deduplication, edit distance calculation, and length difference supplementation. Next, semantic similarity and structural similarity are calculated based on the input samples and weighted fusion is performed. Reference examples with high overall similarity are selected from the template example library to improve example representativeness. Then, to control inference and improve output stability, prompts are constructed that include task descriptions, example references, inference mode selection, and thought chain inference (word segmentation, alignment, variable identification, template construction), as well as input and output instructions, guiding LLM to perform inference as needed to extract log templates. Finally, the extracted log templates are written to the template cache library, achieving fast matching and efficient reuse in a microservice environment. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a microservice log parsing method based on dual similarity retrieval and adaptive reasoning according to the present invention.

[0020] Figure 2 This is a diagram of the Prompt structure in an embodiment of the present invention.

[0021] Figure 3 This is a diagram showing the LLM output results in an embodiment of the present invention.

[0022] Figure 4 This is a comparison of different LLMs in the embodiments of the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] like Figure 1 As shown, this embodiment of the invention provides a microservice log parsing method based on dual similarity retrieval and adaptive reasoning, including the following steps: S1. Obtain the log data to be parsed, preprocess the log data to be parsed, and extract the log content corresponding to the log data to be parsed.

[0026] This step, tailored to the format characteristics of different log datasets, first constructs regular expressions using a custom log format to split the logs into multiple structured fields such as time, component, and content, from which the core semantic log content is extracted. Raw logs typically contain header information automatically generated by the system, such as timestamps, log levels (e.g., INFO, ERROR), process IDs, and component names. Directly using these fields in template extraction would introduce redundant noise and reduce parsing accuracy. Therefore, only the core semantic part—the log content—needs to be extracted. This content is output by the system code during runtime via print statements and includes event descriptions, state changes, or parameter information. Taking the HDFS system as an example, the raw log is: "081109 214009 2594 INFO dfs.DataNode$DataXceiver: 10.250.5.237:50010Served block blk_3166960787499091856 to / 10.251.43.147" In the log format definition, each field is defined as a fixed structure part (date, time, log level, process ID, and component name) and a log content part, specifically represented as follows: “ <date> <time> <pid> <level> <component> : <content>" Regular expressions were constructed using format definitions, and the original logs were decomposed into structured data. The results are shown in Table 1. Finally, the log content was extracted.

[0027] Table 1. Results of Regularization Preprocessing

[0028] S2. Represent the log content as a log content sequence, process the log content sequence based on the N-gram method, filter the constant words in the log content sequence to construct log group structure identifiers, and cluster logs with the same log group structure identifiers into a group.

[0029] This step grouped logs collected at the same time based on the structural features of N-gram probabilistic inductive logs. N-gram is a statistical model that uses the co-occurrence relationship of N consecutive words to indicate contextual dependencies and measures the structural association between words. Specifically, after regularization preprocessing, each log entry is represented as a sequence of several words (Tokens). For example, the log content token sequence of the example "081109 214009 2594 INFO dfs.DataNode$DataXceiver: 10.250.5.237:50010 Served block blk_3166960787499091856 to / 10.251.43.147" in step S1 is: ["10.250.5.237:50010", "Served", "block", "blk_3166960787499091856", "to", " / 10.251.43.147"]. Next, all words consisting of letters are extracted from the token sequence of each log content and concatenated in their original order to form a keyword string. Logs with the same keyword string are further grouped together, thus forming several initial log groups. Subsequently, in the initial log grouping, the N-gram conditional probabilities of each word in the token sequence of each log entry with its adjacent words are calculated, and the dependency of each word with its adjacent words is evaluated based on a co-occurrence threshold. The co-occurrence threshold is dynamically calculated based on the initial number of groups and is the ratio of an empirical coefficient to the number of groups; this invention sets the empirical coefficient to 5 based on expert experience. Specifically, for a given word, if its preceding two words are structurally fixed words, then the 3-gram conditional probability of its word with the preceding two words is calculated; if only its preceding word is a structurally fixed word, then the 2-gram conditional probability of its word with the preceding word is calculated. A structurally fixed word is defined as a word in the log content token sequence that has a stable co-occurrence relationship with its adjacent words. If the calculated conditional probability is lower than the co-occurrence threshold, it indicates a stable co-occurrence relationship. Finally, all structurally fixed words form a log group structure identifier, and logs with the same group structure identifier are clustered into the same group.

[0030] S3. Perform template cache matching in the template cache library based on the log group structure identifier. The template cache library is used to store and retrieve parsed log templates. If the cache is hit, the corresponding template is directly reused to complete the log parsing. If the cache is not hit, then execute S4.

[0031] This invention utilizes the group structure identifier generated in the previous step to perform template cache matching for each log group in the existing template cache library. The template cache library is built based on the correspondence between "group structure identifier and log template" and is used to store and quickly retrieve parsed log templates. If the cache is hit, it means that the log template for that structure already exists, and the corresponding template is directly reused, omitting the LLM parsing step to save costs and improve parsing speed; if the cache is not hit, the following LLM parsing steps are then performed.

[0032] S4. In the log group, select logs with significant differences in content edit distance as input samples.

[0033] For log groups that miss the cache, this invention proposes a diversity input sample selection strategy based on edit distance, and improves sample diversity by padding with log length differences. Edit distance is an indicator of the similarity between two strings, representing the minimum number of edit operations required to transform one string into another, where each edit includes the insertion, deletion, or replacement of a single character. The larger the edit distance value, the more significant the difference between the two logs, and its calculation formula is shown in formula (1).

[0034]

[0035] Where a and b represent two strings respectively; i represents the first i characters of the a sequence and j represents the first j characters of the b sequence; This represents the minimum edit distance required to transform the first i characters of string a into the first j characters of string b.

[0036] First, all log entries within the log group are deduplicated to obtain a deduplicated log group. If the number of deduplicated logs is less than or equal to a preset sample size threshold, the remaining logs are directly returned as input samples. In practical applications, the sample size threshold can be set through experiments or expert experience; in this invention, it is set to 3. If the number of deduplicated logs is greater than the preset sample size threshold, the edit distance is calculated for each pair of deduplicated logs to measure their structural differences. The log pair with the largest edit distance is added to the candidate set, and this log pair is removed from the deduplicated logs to obtain the remaining logs. Subsequently, one log from the remaining logs is taken, and its edit distance to each log in the candidate set is calculated. The minimum value is taken as the distance between this log and the candidate set. The edit distance between each log in the remaining logs and the candidate set is calculated, and the log with the largest distance to the candidate set that is greater than the preset minimum edit distance threshold is added to the candidate set, while this log is removed from the remaining logs. Because the differences in log content within the same group are relatively small, a change in a single variable (e.g., a port number changing from 50010 to 50011) usually only results in an edit distance difference of a few characters. However, when logs contain complex variable structures or missing fields, the edit distance difference is usually larger. This invention sets the minimum edit distance threshold to 10 characters. The above process is repeated until the preset sample size threshold is met. If the above conditions cannot be met, the longest log from the deduplicated logs that were not selected into the candidate set is further selected to supplement the sample.

[0037] S5. Take the first log in the input sample as the query log, calculate the comprehensive similarity between the query log and each log in the template example library, and select the three logs with the highest comprehensive similarity to the input sample as reference examples to write prompt words. The template example library is used to store labeled example structures. The example structure includes ID, log content and its corresponding template.

[0038] This invention proposes a reference example retrieval and selection strategy based on semantic-structural dual similarity to improve the context learning ability of LLM. First, a manually annotated template example library is constructed, with each example structure including an ID, log content, and its corresponding template. Then, the first log in the candidate set selected in S4 is used as the query object. The semantic similarity and structural similarity between this log and each log in the example library are calculated, and a comprehensive similarity is obtained based on a weighted fusion of the two. The three logs with the highest comprehensive similarity are selected as reference examples and written into the prompt words. In similarity calculation, this invention innovatively combines semantic and structural similarity. In some datasets where logs are more natural language-based (e.g., Thunderbird, Linux, and Mac), the same type of event may have different linguistic expressions. Relying solely on structural similarity may reduce the similarity of examples by ignoring the connections between such logs, thus affecting the context learning ability of LLM. However, by adopting a weighted fusion of semantic and structural similarity, both the semantic relevance of the examples and the consistency of the template structure can be ensured. Semantic similarity is calculated by cosine similarity of the embedded vectors, as shown in formula (2), while structural similarity is calculated by Jaccard coefficient, as shown in formula (3).

[0039]

[0040] in, This indicates the query log. This represents the content of a log entry in the example library. , Each represents its vector representation.

[0041] The final comprehensive similarity calculation formula is shown in formula (4).

[0042]

[0043] in, As the weighting coefficient, in this invention, we take... This is to emphasize the structural consistency of the template.

[0044] To prevent large models from directly "copying answers," which would render the results meaningless and unrelevant, this invention proposes excluding the example with the most similar structure to the query object during the sorting process. The specific algorithm for selecting the reference example is shown in Algorithm 1.

[0045]

[0046] S6. Construct a structured Prompt based on the reference example. The Prompt includes a task description, example reference, reasoning mode selection, thought chain reasoning, and input and output instructions.

[0047] This invention designs and constructs a structured Prompt with adaptive inference capabilities, which guides the LLM to complete log parsing. The specific Prompt structure is as follows: Figure 2 As shown, this prompt contains six key components: task description, example reference, reasoning mode selection, chain of thought (CoT) reasoning, and input / output instructions. These are explained in detail below.

[0048] (1) Task description. First, set up the roles, and then use concise and clear language to explain the task objectives to the model.

[0049] (2) Example References. In step 5, three reference examples that are most similar to the log to be parsed are selected for LLM to learn the context. Specifically, these include the log content and its corresponding log template.

[0050] (3) Inference Mode Selection. This invention proposes an adaptive inference strategy based on external triggering rules. By setting an inference mode selection mechanism in the prompt words, the LLM is controlled to adopt different parsing strategies under different log complexities. Compared with existing methods that do not perform inference or always perform inference in a fixed way, this invention presets inference triggering rules according to the structural characteristics of the log, guiding the LLM to determine whether CoT is needed, thus realizing adaptive inference of the LLM. The specific inference triggering rules are as follows: When the length of all logs in the input sample is long (set to more than 10 words in this invention, but can be set according to expert experience in actual applications), or the number of words is inconsistent (some have missing fields), or there is a variable composite structure, the LLM needs to perform subsequent inference. Among them, the variable composite structure is defined as a word with complete semantics composed of fixed symbols (such as separators, unit symbols or punctuation marks) and variable values ​​or strings in the log. When the length of all logs in the input sample is less than or equal to 10 words, the number of words is consistent and there is no variable composite structure, no inference is needed, and the log template can be extracted directly.

[0051] (4) Thought Chain Reasoning. The thought chain reasoning process designed in this invention draws on the strategies of traditional log parsing methods and combines them with the characteristics of actual log samples to construct a four-step reasoning process suitable for large language models. Specifically, it includes: 1) Tokenization. The original log content is divided into a series of tokens, and the splitting of compound words with fixed semantics, such as file paths and class names, is prohibited.

[0052] For example, IP addresses in the logs such as "192.168.1.12" are not split.

[0053] 2) Structure Alignment. Multiple log entries within the same log group are vertically aligned according to their token positions. For log entries of inconsistent length, placeholders are introduced. <none>"The missing positions are filled in to achieve uniform length and position alignment."

[0054] 3) Variable Identification. By comparing whether the tokens at the same location in different logs are consistent, it can be determined whether that location is a constant or a variable. A constant refers to static content that remains stable within that type of log and does not change with the logs; a variable is dynamic content that varies across different logs.

[0055] 4) Template construction. Replace all tokens marked as variables with wildcards "<". >”, retaining the constant part, to build a structured log template.

[0056] To more intuitively and clearly understand the adaptive reasoning process of LLM, an example is given to illustrate how LLM outputs its reasoning process, specifically including the selection of the reasoning mode and its reasons, detailed CoT steps, and the final template result. The output result is as follows: Figure 3 As shown. The input log is: log1: BAYMSGR2012806.gateway.messenger.live.com:443 close, 13155bytes (12.8 KB) sent, 21737 bytes (21.2 KB) received, lifetime 00:35 log2: proxy.cse.cuhk.edu.hk:5070 close, 403 bytes sent, 426 bytes received, lifetime<1 sec log3: video-hkg3-2.xx.fbcdn.net:443 close, 58373 bytes (57.0 KB) sent, 8896991 bytes (8.48 MB) received, lifetime 02:25 As shown in the results, when selecting the inference mode, LLM determines whether CoT (Copyright Tokenization) is needed based on whether the log contains the "IP:port" compound structure and variable unit units (KB, MB, and sec). Specifically, a compound structure like "proxy.cse.cuhk.edu.hk:5070" consists of multiple sub-components including IP addresses and port numbers, separated by a fixed separator ":", and belongs to a variable compound structure; a variable unit unit like "(12.8 KB)" exists in some logs but is missing in others, belonging to a field missing unit. Since the above-mentioned preset triggering rules for inference are met, it is determined that CoT is needed. Next, the log template is extracted according to the four steps of CoT. Specifically, the first step is to segment the input log, protecting the indivisibility of the "IP:port" structure and variable unit units; the second step is to align the log structure, using "" for logs that are insufficient in length. <none>"The third step is to compare words one by one, identifying variables including address types, number types, and variable units, as well as the constants "close", "sent", "received", and "lifetime"; the fourth step is to build a template, using "< " to identify words as variables. Replace with ">", while preserving delimiters and constants. The final log template is: "< >close,< >bytes< >sent,< >bytes< >received, lifetime< >".

[0057] (5) Input instructions: Input the logs with differences selected by S4, and instruct the LLM line number markers to be used only for reference and not to be part of the log content.

[0058] (6) Output instructions: The output format is JSON, and the output result is expressed using "< The template for replacing variables is used, and if all variables are constants, the log file itself is returned directly.

[0059] S7. Call the LLM model and extract the log template based on the structured Prompt.

[0060] This invention achieves automatic log template extraction by invoking an LLM (Local Management Module) and using a Prompt with adaptive inference capabilities built using S6. Specifically, the LLM first reads and parses the Prompt to clarify the task objectives and output format requirements. Subsequently, relying on its powerful context learning and self-reasoning capabilities, and guided by the CoT (Cooperation of Reasoning), it understands the semantics of the input log and summarizes the log structure, thereby extracting and outputting a structured log template.

[0061] S8. Write the extracted log templates into the template cache library.

[0062] This invention achieves structured storage and efficient reuse of log templates through a template output and cache update strategy. Specifically, log templates generated by LLM are written to a template cache library for fast querying and reuse, thereby improving parsing efficiency. Furthermore, complete log template files are generated for each dataset, ensuring centralized management and traceability of template information, and providing support for subsequent log maintenance, analysis, and optimization.

[0063] The following specific application examples will further illustrate the solution and effects of the present invention.

[0064] The dataset used in this embodiment is the LogHub-2.0 dataset. LogHub-2.0 is an authoritative log parsing evaluation benchmark dataset released by Fudan University, widely used to verify the effectiveness and universality of log structuring methods. This dataset covers 14 sub-datasets, encompassing various system platforms and typical application scenarios, and is highly representative. Each dataset contains raw log files, standard log files, and standard template files, providing a complete validation standard for log structure extraction and template evaluation.

[0065] This invention treats log parsing as a structural induction and template matching task, employing four metrics to evaluate parsing performance: Group Accuracy (GA), Parsing Accuracy (PA), Precision Template Accuracy (PTA), and Recall Template Accuracy (RTA). GA is defined as the ratio of correctly grouped logs to the total number of logs. A log is considered correctly grouped if and only if its group meets two conditions: first, all logs within the group must belong to the same log event template in the standard template; second, all logs corresponding to the standard template of that event must be assigned to this group. PA is defined as the ratio of correctly parsed logs to the total number of logs. PTA is defined as the percentage of correct templates among all extracted templates, reflecting the model's precision. RTA is defined as the percentage of correctly extracted templates among all standard templates, reflecting the model's recall.

[0066] The experimental software environment consisted of Python 3.9, PyTorch 2.4.1, and CUDA 12.6. The hardware environment consisted of a 13th Gen Intel(R) Core(TM) i9-13900K 3.00 GHz, an NVIDIA GeForce RTX 3090, and deepseek-v3 for LLM.

[0067] A comparative experiment was conducted using two widely used traditional log parsing methods and one log parsing method employing LLM, as detailed below: Drain: An unsupervised log parsing method based on a rule-based tree structure. It uses a fixed-depth parse tree to classify logs hierarchically, compares word segmentation positions layer by layer, and extracts constant structures to generate templates.

[0068] Spell: A log parsing method based on word frequency statistics and the Longest Common Subsequence (LCS) algorithm. It first constructs a word frequency table, then uses LCS to compare the common structures among log entries to extract templates.

[0069] Selflog: An LLM-based log parsing method. By leveraging the semantic understanding and inductive capabilities of LLM, it groups logs, generates templates, and then corrects them to achieve automated log parsing.

[0070] The experimental results of comparing the proposed large language model log parsing method (Ours) with baseline methods are shown in Table 2.

[0071] Table 2 Comparison of different methods

[0072] The experimental results in the table show that the method of this invention (Ours) outperforms other log parsing methods in overall performance. Specific results are analyzed below.

[0073] The Spell method has an average GA of 0.2070 and an average PA of 0.3024, making it the worst performing method overall. Its parsing ability is particularly poor on complex datasets; for example, its PA is 0 on the Proxifier and OpenStack datasets, indicating that it fails to extract the correct template. This is mainly because Spell relies heavily on word frequency statistics and the longest common subsequence (LCS) to extract log templates. It has poor ability to identify log variables with complex structures and diverse semantics, making it difficult to generalize a consistent template, ultimately impacting parsing performance.

[0074] The Drain method has an average GA of 0.2097 and an average PA of 0.5446, indicating poor overall performance. While it achieves a PA of 0.9790 on well-structured datasets like HDFS, demonstrating high parsing accuracy, its performance drops significantly on logs with complex structures and diverse semantics. For example, on datasets like Linux, HealthApp, Proxifier, OpenSSH, OpenStack, and Mac, the PA is below average. Furthermore, the GA is low on most datasets, indicating poor clustering and grouping capabilities. This is because Drain heavily relies on a fixed-depth rule tree structure, partitioning logs layer by layer according to word segmentation positions, and cannot adapt to changes in log format. This method is extremely sensitive to log format changes and struggles to handle log types with natural language descriptions or irregular structures, resulting in low grouping and parsing performance.

[0075] The Selflog method demonstrates significantly better overall performance than traditional methods, with average GA and PA reaching 0.9051 and 0.8027 respectively, far exceeding the Drain and Spell methods. This method performs particularly well on multiple datasets, achieving GA=1.0000 on datasets such as HDFS, Apache, Proxifier, and HealthApp, exhibiting extremely strong grouping capabilities. However, Selflog generally lags behind GA in PA, especially on Linux datasets. This is because the correction strategy employed by this method tends to merge multiple semantically similar log templates into a generalized template, which, while improving grouping consistency, reduces template accuracy.

[0076] The proposed method (Ours) exhibits superior overall performance, with average GA and PA reaching 0.9085 and 0.9260 respectively, exceeding all comparative experiments. Compared to traditional methods Drain and Spell, this method demonstrates significant advantages on all datasets; simultaneously, compared to the large model method Selflog, this method still shows superior and stable performance, especially with a significant improvement in average PA. This indicates that this method not only maintains stable and high-precision template extraction on log datasets with simple and regular structures, but also demonstrates better performance on log datasets with diverse semantics, such as significantly improving PA compared to the Selflog method on Linux, OpenSSH, OpenStack, and Mac datasets. This is because this method introduces an adaptive inference strategy, which determines whether to perform CoT inference based on log complexity, improving the parsing accuracy of complex logs while avoiding over-inference on simple logs, ensuring stable output results; furthermore, this method's example selection strategy based on structural and semantic diversity allows LLM to better identify variables in logs based on similar semantics, further improving parsing accuracy.

[0077] Meanwhile, to verify the impact of different LLMs on log parsing performance, this invention further conducted comparative experiments with different LLMs. The experimental results are as follows: Figure 4 As shown. In addition to Deepseek's deepseek-v3 used in this method, two other mainstream large language models were also selected, including OpenAI's ChatGPT-5 Mini and Alibaba Cloud's Tongyi Qianwen-Plus-Latest, as detailed below.

[0078] deepseek-V3 is a large language model open-sourced by DeepSeek, supporting a maximum context window of 128K and possessing powerful semantic understanding and structural induction capabilities.

[0079] ChatGPT-5 Mini: A lightweight model launched by OpenAI, continuing the legacy of GPT. The instruction understanding capability of 5 significantly reduces computing resources and response latency while maintaining the quality of the generated output.

[0080] Tongyi Qianwen-Plus-Latest is a large language model launched by Alibaba Cloud. It supports ultra-long contexts and performs well in Chinese and English understanding, instruction execution, and structured information extraction.

[0081] As shown in the figure, deepseek-v3 outperformed all four evaluation metrics, achieving scores of 0.9085, 0.9260, 0.9048, and 0.8397 respectively, demonstrating strong capabilities in semantic understanding, log structure recognition, and template extraction. ChatGPT-5 Mini performed similarly to Tongyi Qianwen in GA and PA, but its PTA and RTA were significantly lower, indicating that the templates extracted by ChatGPT-5 Mini had lower accuracy and lagged behind manually annotated standard templates. In conclusion, this invention selects deepseek-v3 as the large language model for log parsing tasks.

[0082] Log template extraction is a crucial step in intelligent operations and maintenance (O&M) to support anomaly detection, root cause localization, and fault recovery. The diverse log formats from multiple sources in microservice systems increase the complexity of template parsing. To address this, this invention proposes a microservice log parsing method based on dual similarity retrieval and adaptive reasoning, fully leveraging the semantic understanding and structural induction capabilities of large language models. First, the original logs are preprocessed and grouped. Then, based on edit distance, highly dissimilar samples are selected within each log group as input samples. Building upon this, a semantic-structural dual similarity retrieval enhancement mechanism is constructed to select reference examples with high similarity and diversity to the logs to be parsed. This leads to the construction of a structured Prompt with adaptive reasoning capabilities, guiding the LLM (Low Language Model) to perform adaptive reasoning and complete log parsing. Finally, the template is updated and cached. The input sample selection based on edit distance involves deduplication, edit distance calculation, and length difference supplementation to reduce redundant noise while selecting logs with high differences as input. The semantic-structural dual similarity retrieval enhancement mechanism calculates the semantic and structural similarity between the query log and the example library logs separately, and selects logs with high overall similarity and their templates as reference examples through weighted fusion, ensuring both semantic relevance and template structural consistency. The Prompt feature, with adaptive inference capabilities, includes task descriptions, example references, inference mode selection, thought chain inference, and input / output instructions. This adaptive inference function ensures LLM's direct parsing ability for simple logs while improving its inference ability for logs with complex structures and diverse semantics, guaranteeing stable LLM output results while improving template accuracy. Comparative experiments on real datasets show that the proposed method outperforms other baseline methods in all metrics. Comparative experiments with different large language models demonstrate that using Deepseek-v3 as support provides comprehensive and optimal performance guarantees for log parsing tasks.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.< / none> < / none> < / content> < / component> < / level> < / pid> < / time> < / date>

Claims

1. A microservice log parsing method based on dual similarity retrieval and adaptive reasoning, characterized in that, Includes the following steps: S1. Obtain the log data to be parsed, preprocess the log data to be parsed, and extract the log content corresponding to the log data to be parsed; S2. Represent the log content as a log content sequence, process the log content sequence based on the N-gram method, filter the constant words in the log content sequence to construct a log group structure identifier, and cluster logs with the same log group structure identifier into a group. S3. Perform template cache matching in the template cache library based on the log group structure identifier. The template cache library is used to store and retrieve parsed log templates. If the cache is hit, the corresponding template is directly reused to complete the log parsing. If the cache is not hit, proceed to S4. S4. In the log group, select logs with significant differences in content edit distance as input samples; S5. Take the first log in the input sample as the query log, calculate the comprehensive similarity between the query log and each log in the template example library, and select the three logs with the highest comprehensive similarity to the input sample as reference examples to write prompt words. The template example library is used to store labeled example structures. The example structure includes ID, log content and its corresponding template. S6. Construct a structured Prompt based on the reference example. The Prompt includes a task description, example reference, reasoning mode selection, thought chain reasoning, and input and output instructions. S7. Call the LLM model and extract the log template based on the structured Prompt.

2. The microservice log parsing method based on dual similarity retrieval and adaptive reasoning according to claim 1, characterized in that, The log content includes event descriptions, status changes, or parameter information.

3. The microservice log parsing method based on dual similarity retrieval and adaptive reasoning according to claim 1, characterized in that, Based on the edit distance between log contents within the log group, log samples with significant differences are taken as input, including: S401. Deduplicate all log content in the log group. If the number of samples after deduplication is insufficient, return the remaining samples directly as input samples; otherwise, execute S402. S402. Calculate the edit distance between each pair of log entries after deduplication, and sort them from largest to smallest edit distance. S403. Select the log pair with the largest edit distance to add to the candidate set. Then calculate the edit distance between the remaining logs and the candidate set. Select the log with the largest edit distance that is greater than the preset minimum edit distance threshold to add to the candidate set, until the required number is met.

4. The microservice log parsing method based on dual similarity retrieval and adaptive reasoning according to claim 3, characterized in that, The minimum edit distance threshold is set to 10 characters.

5. The microservice log parsing method based on dual similarity retrieval and adaptive reasoning according to claim 1, characterized in that, The overall similarity is calculated based on a weighted sum of semantic similarity and structural similarity. The semantic similarity is calculated using the cosine similarity of the embedded vectors, and the structural similarity is calculated using the Jaccard coefficient.

6. The microservice log parsing method based on dual similarity retrieval and adaptive reasoning according to claim 5, characterized in that, The instance with the highest structural similarity to the query object is excluded during the sorting process.

7. The microservice log parsing method based on dual similarity retrieval and adaptive reasoning according to claim 1, characterized in that, The method further includes: S8. Write the extracted log templates into the template cache library.

Images