Zero-Shot Online Log Parsing with Hybrid LCS–LLM Templates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing log parsing methods, including grammar-based and semantic-based approaches, face challenges in accurately identifying static and dynamic variables in logs due to reliance on expert knowledge, lack of labeled data, and high costs associated with large language models, leading to inefficiencies in online log parsing scenarios.
Innovation Solution
A low-cost, zero-shot online log parsing method that combines grammatical information from the longest common subsequence (LCS) with semantic information from a large language model, using pre-defined rules and regular expressions to extract and correct log templates, followed by template merging and splitting based on frequency analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If grammar-based log parsing methods are used, then log grouping capability is improved, but parsing accuracy deteriorates due to lack of semantic information utilization
Solution Approach 1:
The patent combines grammar-based parsing (LCS algorithm) with semantic-based parsing (large language model) into a unified hybrid framework. The grammar component handles structural pattern matching while the semantic component interprets meaning, allowing the system to achieve both good log grouping capability and high parsing accuracy simultaneously.
2Measurement precision
If semantic-based methods with deep learning are used, then parsing accuracy is improved, but cost and complexity increase due to requirement of labeled data for training
Solution Approach 1:
The patent replaces expensive, complex pre-trained language models with a simpler large language model that can be invoked on-demand without requiring labeled training data. This approach achieves high parsing accuracy while avoiding the high costs and complexity associated with training deep learning models, effectively using a cheaper alternative that doesn't require long-term investment in model training infrastructure.
3Measurement precision
If large language models are invoked for every log parsing task, then semantic information is obtained, but time and money costs increase
Solution Approach 1:
The patent segments the log parsing task into two parts: structural analysis handled by the efficient LCS algorithm and semantic analysis handled by the large language model. By dividing the work, the system avoids invoking the expensive LLM for every log entry, instead using it only when semantic interpretation is truly needed, thereby reducing both time and money costs while maintaining high accuracy.
Solution Approach 2:
The patent introduces the LCS algorithm as an intermediary layer between the log input and the large language model. The LCS algorithm first processes the log structure and only passes logs requiring semantic interpretation to the LLM, acting as a filter that reduces the number of LLM invocations and thereby reducing time and computational costs.
4Productivity
If existing log parsing methods are used, then processing speed is maintained, but reliability deteriorates due to illusion of large language models
Solution Approach 1:
The patent implements a feedback mechanism where the system continuously validates and refines log templates through iterative processing. The hybrid approach allows the system to cross-check semantic interpretations against grammatical structures, providing feedback that corrects LLM hallucinations and improves reliability while maintaining processing speed through efficient algorithm design.
Data Source
AI summary
Disclosed in the present disclosure is a low-cost and zero-shot online log parsing method based on a large language model, including: firstly, extracting content of a log in a log message using regular expressions, then, performing regular expression matching with a log template in a database; if the matching is successful, updating a log sample corresponding to the log template; if the matching fails, conducting a dialogue with the large language model to obtain a new log template; performing template correction to prevent the log template generated by the large language model from being incapable of performing regular expression matching with the log message; performing template merging when a new template is generated; performing template splitting when the log sample is updated; and for all log templates to be added to the database, firstly, normalizing the log templates by post-processing, and then storing the log templates to the database. The log template generated by the present disclosure outperforms conventional methods in terms of word parsing accuracy, with significant advantages in speed and cost compared with the direct use of the large language model to perform log parsing tasks.