Log parsing, a vital task for interpreting the vast and complex data produced within software architectures faces significant challenges in the transition from academic benchmarks to the industrial domain. Existing log parsers, while highly effective on standardized public datasets, struggle to maintain performance and efficiency when confronted with the sheer scale and diversity of real-world industrial logs. These challenges are two-fold: 1) massive log templates: The performance and efficiency of most existing parsers will be significantly reduced when logs of growing quantities and different lengths; 2) Complex and changeable semantics: Traditional template-matching algorithms cannot accurately match the log templates of complicated industrial logs because they cannot utilize cross-language logs with similar semantics. To address these issues, we propose ECLIPSE, Enhanced Cross-Lingual Industrial log Parsing with Semantic Entropy-LCS, since cross-language logs can robustly parse industrial logs. On the one hand, it integrates two efficient data-driven template-matching algorithms and Faiss indexing. On the other hand, driven by the powerful semantic understanding ability of the Large Language Model (LLM), the semantics of log keywords were accurately extracted, and the retrieval space was effectively reduced. Notably, we launch a Chinese and English cross-platform industrial log parsing benchmark ECLIPSE- BENCH to evaluate the performance of mainstream parsers in industrial scenarios. Our experimental results across public benchmarks and ECLIPSE- BENCH underscore the superior performance and robustness of our proposed ECLIPSE. Notably, ECLIPSE both delivers state-of-the-art performance when compared to strong baselines and preserves a significant edge in processing efficiency.
翻译:日志解析作为解读软件架构所产生海量复杂数据的关键任务,在从学术基准向工业领域迁移时面临重大挑战。现有日志解析器虽然在标准化公共数据集上表现优异,但在面对真实工业日志的巨大规模与多样性时,难以维持其性能与效率。这些挑战主要体现在两方面:1)海量日志模板:当日志数量持续增长且长度各异时,大多数现有解析器的性能与效率会显著下降;2)复杂多变的语义:传统模板匹配算法因无法有效利用具有相似语义的跨语言日志,难以准确匹配复杂工业日志的模板。为解决这些问题,我们提出ECLIPSE(基于语义熵-最长公共子序列的增强型跨语言工业日志解析器),该系统能够利用跨语言日志的语义鲁棒性解析工业日志。一方面,它融合了两种高效的数据驱动模板匹配算法与Faiss索引技术;另一方面,借助大语言模型强大的语义理解能力,准确提取日志关键词的语义特征,并有效缩减检索空间。值得注意的是,我们构建了中英文跨平台工业日志解析基准数据集ECLIPSE-BENCH,用以评估主流解析器在工业场景下的性能。在公开基准与ECLIPSE-BENCH上的实验结果表明,我们所提出的ECLIPSE方法具有卓越的性能与鲁棒性。特别地,与强基线方法相比,ECLIPSE不仅取得了最先进的解析性能,同时在处理效率方面保持显著优势。