Package: logpai
LogparserLogparser provides a machine learning toolkit and benchmarks for automated log parsing, which is a crucial step for structured log analytics. By applying logparser, users can automatically extract event templates from unstructured logs and convert raw log messages into a sequence of structured events. The process of log parsing is also known as message template extraction, log key extraction, or log message clustering in the literature.An example of log parsing🌈 New updatesSince the first release of logparser, many PRs and issues have been submitted due to incompatibility with Python 3. Finally, we update logparser v1.0.0 with support for Python 3. Thanks for all the contributions! (#PR86,#PR85,#PR83,#PR80,#PR65,#PR57,#PR53,#PR52,#PR51,#PR49,#PR18,#PR22)We build the logpai package wheel, which contains logparser as a submodule. Please install it viapip install logpai.We refactor the code structure and beautify the code via the Python code formatter black.Log parsers available:PublicationParserPaper ReferenceIPOM'03SLCTA Data Clustering Algorithm for Mining Patterns from Event Logs, by Risto Vaarandi.QSIC'08AELAbstracting Execution Logs to Execution Events for Enterprise Applications, by Zhen Ming Jiang, Ahmed E. Hassan, Parminder Flora, Gilbert Hamann.KDD'09IPLoMClustering Event Logs Using Iterative Partitioning, by Adetokunbo Makanju, A. Nur Zincir-Heywood, Evangelos E. Milios.ICDM'09LKEExecution Anomaly Detection in Distributed Systems through Unstructured Log Analysis, by Qiang Fu, Jian-Guang Lou, Yi Wang, Jiang Li. [Microsoft]MSR'10LFAAbstracting Log Lines to Log Event Types for Mining Software System Logs, by Meiyappan Nagappan, Mladen A. Vouk.CIKM'11LogSigLogSig: Generating System Events from Raw Textual Logs, by Liang Tang, Tao Li, Chang-Shing Perng.SCC'13SHISOIncremental Mining of System Log Format, by Masayoshi Mizutani.CNSM'15LogClusterLogCluster - A Data Clustering and Pattern Mining Algorithm for Event Logs, by Risto Vaarandi, Mauno Pihelgas.CNSM'15LenMaLength Matters: Clustering System Log Messages using Length of Words, by Keiichi Shima.CIKM'16LogMineLogMine: Fast Pattern Recognition for Log Analytics, by Hossein Hamooni, Biplob Debnath, Jianwu Xu, Hui Zhang, Geoff Jiang, Adbullah Mueen. [NEC]ICDM'16SpellSpell: Streaming Parsing of System Event Logs, by Min Du, Feifei Li.ICWS'17DrainDrain: An Online Log Parsing Approach with Fixed Depth Tree, by Pinjia He, Jieming Zhu, Zibin Zheng, and Michael R. Lyu.ICPC'18MoLFIA Search-based Approach for Accurate Identification of Log Message Formats, by Salma Messaoudi, Annibale Panichella, Domenico Bianculli, Lionel Briand, Raimondas Sasnauskas.:bulb: Welcome to submit a PR to push your parser code to logparser and add your paper to the table.InstallationWe recommend installing the logparser package and requirements via pypi.pip install logpai==logparserv1.0.0In particular, the package depends on the following requirements.Python 3.6+regex 2022.3.2numpypandasscipydeap (if using logparser.MoLFI)gcc (if using logparser.SLCT)Get startedRun the demo:For each log parser, we provide a demo to help you get started. Each demo shows the basic usage of a target log parser and the hyper-parameters to configure. For example, the following command shows how to run the demo for Drain.cd logparser/Drain
python demo.pyAfter finishing running the demo, you can obtain extracted event templates and parsed structured logs in the result folder.HDFS_2k.log_templates.csvHDFS_2k.log_structured.csvRun the benchmark:For each log parser, we provide a benchmark script to run log parsing on theloghub_2k datasetsfor evaluating parsing accuarcy. You can also useother benchmark datasets for log parsing.cd logparser/Drain 
python benchmark.pyParse your own logs:It is easy to apply logparser to parsing your own log data. To do so, you need to install the logpai package first. Then you can develop your own script following the below code snippet to start log parsing.fromlogparser.DrainimportLogParserinput_dir='PATH_TO_LOGS/'# The input directory of log fileoutput_dir='result/'# The output directory of parsing resultslog_file='unknow.log'# The input log file namelog_format='<Date> <Time> <Level>:<Content>'# Define log format to split message fields# Regular expression list for optional preprocessing (default: [])regex=[r'(/|)([0-9]+\.){3}[0-9]+(:[0-9]+|)(:|)'# IP]st=0.5# Similarity thresholddepth=4# Depth of all leaf nodesparser=LogParser(log_format,indir=input_dir,outdir=output_dir,depth=depth,st=st,rex=regex)parser.parse(log_file)The full example is shown asexample/parse_your_own_logs.py.Production useThe main goal of logparser is used for research and benchmark purpose. Researchers can use logparser as a code base to develop new log parsers while practitioners could assess the performance and scalability of current log parsing methods through our benchmarking. We strongly recommend practitioners to try logparser in your production environment. But be aware that the current implementation of logparser is far from ready for production use. Whereas we currently have no plan to do that, we do have a few suggestions for developers who want to build an intelligent production-level log parser.Please be aware of the licenses ofthird-party librariesused in logparser. We suggest to keep one parser and delete the others and then re-build the package wheel. This would not break the use of logparser.Please enhance logparser with efficiency and scalability with multi-processing, add failure recovery, add persistence to disk or message queue Kafka.Drain3provides a good example for your reference that is built with [practical enhancements] for production scenarios.Citation👋 If you use our logparser tools or benchmarking results in your publication, please cite the following papers.[ICSE'19] Jieming Zhu, Shilin He, Jinyang Liu, Pinjia He, Qi Xie, Zibin Zheng, Michael R. Lyu.Tools and Benchmarks for Automated Log Parsing.International Conference on Software Engineering (ICSE), 2019.[DSN'16] Pinjia He, Jieming Zhu, Shilin He, Jian Li, Michael R. Lyu.An Evaluation Study on Log Parsing and Its Use in Log Mining.IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2016.DiscussionWelcome to join our WeChat group for any question and discussion. Alternatively, you canopen an issue here.