## 4 Experiments
### Ablation Study  
In this study, we considered not only the semantic information of log messages and the sequential relationships between logs but also the component value parameters in logs. To verify the advantages of feature combinations, we evaluated the performance of LTAomaly without component value parameters in the log. Without the semantic message of the log template sequence, LTAomaly only models the accuracy of component value parameters. Therefore, ablation experiments were performed on the BGL and HDFS datasets. Table 4 shows the performances of different feature extraction techniques in two datasets, in which \"-\" and \"O\" indicate using and not using the technique, respectively, and W means that we should think about the semantic information of the log message and the sequential relationship between logs, with the highest score expressed in bold. More importantly, C represents the component value parameter that uses the log. We observe that LTAomaly with no logging component parameters has a lower recall rate than that with logging component parameters, indicating that some exceptions caused by parameter value errors are ignored. The accuracy of LTAomaly without log semantic and sequence information is relatively low; hence, this information is important for anomaly detection. The LTAomaly model (with no component value parameters) and the LogRobust model ignore component value information. However, LTAomaly outperforms LogRobust, which shows that Transformer with LSTM is more effective in logging exception detection.  
In log anomaly detection, it is crucial to consider the values of log components because they provide information about the state of the application or system. Abnormal events usually cause abnormal changes in log component values. Therefore, analyzing log component values can effectively detect and identify abnormal events. When selecting an anomaly detection algorithm, various log component values must be taken into account, and attempts should be made to determine which values are most suitable for detecting anomalous events. Attention should also be paid to issues such as how to perform preprocessing and normalization and how to deal with missing values in the data to ensure the quality and reliability of the data. By considering these factors collectively, the proposed approach's performance results can be improved, and accurate log anomaly detection can be achieved.  
This study uses Transformer with LSTM for log exception detection for the first time. We investigated whether the fusion of LSTM and Transformer can improve the accuracy of detection. Ablation experiments on the HDFS and BGL datasets were performed to analyze the impact of each component on the overall model. Table 5 shows the performance of different anomaly detection techniques in two datasets, with the best results highlighted in bold. Table 5 confirms that adding LSTM modules to Transformer provides better exception detection performance, with the highest score expressed in bold.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multicolumn{3}{c}{**Techniques**} & \multirow{2}{*}{**Precision**} & \multirow{2}{*}{**Recall**} & \multirow{2}{*}{**F1-Measure**} \\ \cline{2-2} \cline{5-6}  & **W** & & & & \\ \hline \multirow{3}{*}{BGL} & - & O & 0.95 & 0.91 & 0.929 \\  & O & - & 0.79 & 0.86 & 0.823 \\  & - & - & **0.97** & **0.98** & **0.975** \\ \hline \multirow{3}{*}{HDFS} & - & O & 0.97 & 0.98 & 0.975 \\  & O & - & 0.83 & 0.89 & 0.859 \\ \cline{1-1}  & - & - & **0.98** & **0.99** & **0.985** \\ \hline \hline \end{tabular}
\end{table}
Table 4: The performance of different feature extraction technology combinations in datasets.