## 1 Introduction
If the task is performed by experts or developers with domain knowledge, efficiency is improved. However, this approach is not promising, particularly in environments with different languages and frameworks. In addition, when large-scale distributed systems are widely used, the number of logs increases rapidly. As the number of event types increases, new services and functions are rapidly iterated. Manual log parsing cannot satisfy the requirements of large-scale distributed systems. Previous studies have proposed various log parsing methods, including the log-based ELK algorithm [10], LenMa algorithm [12], and MoLFI algorithm [13]. These methods only require log files as input and employ clustering or evolutionary algorithms to automatically extract templates. Many techniques for automatically extracting templates have been proposed, with the goal of accurately and rapidly parsing log files. These techniques can be divided into four main categories: frequent pattern mining-based methods, clustering-based methods, heuristic rules-based methods, and machine learning-based methods. Each category has its advantages and disadvantages. The system log messages of distributed servers differ from other log data. These messages exhibit unique characteristics, such as tokens and length, that can be used as enlightening prior knowledge to efficiently extract the common part of the log message as templates. AEL [14] extracts log templates based on the occurrence frequency of constant and variable tokens; IPLoM [15] extracts templates based on the log length and token mapping; Drain [16] constructs a parsing tree based on the log length and token prefix and takes leaf nodes as templates; Spell [17] uses the longest common subsequence (LCS) for log analysis based on prefix trees. Accuracy and time efficiency are generally considered the most adequate indicators in this field. Although the aforementioned methods achieve good results, they have limitations, such as insufficient precision and low efficiency. The fundamental reason is that the system logs of large-scale distributed systems do not improve mining with specific heuristic rules in terms of token and length. These methods use only general rules, resulting in too many or insufficient template parameters: overfitting or underfitting. To solve these problems, by analyzing the common characteristics of the system logs of large-scale distributed systems (Linux, Windows, Hadoop, Android, Apache, Spark), we find that the first token and log length are the two most enlightening factors. Therefore, we propose an efficient log parsing method with heuristic rules by clustering based on the first token and length (CFTL). The proposed method automatically and accurately identifies log event templates corresponding to raw messages. Compared with existing log parsers, CFTL is a relatively lightweight algorithm that exhibits higher accuracy and efficiency. The main contributions are summarized as follows:  
Figure 2: Example of log messages. 1. An efficient system log parsing method with heuristic rules was proposed to improve the accuracy and efficiency of large-scale edge system log parsing. 2. Key local features and general global features were both used as heuristic rules, where the first token was the key local feature recording system behavior, and the length was selected as the general global feature. This approach not only ensured analytical accuracy but also prevented underfitting. It also overcame the excessive consideration of tokens and focused on the excessive overfitting of template parameters caused by non-key local features. 3. The separation algorithm of constant and variable tokens and the LCS algorithm were both optimized. Based on the property of the optimal substructure, a recursive relationship of optimal values was established, which significantly reduced the complexity of rule separation and template matching, effectively improving efficiency. 4.