## 1 Introduction  
The scale of computer distributed systems is expanding, and these systems play a critical role in our daily lives. Whenever abnormal conditions occur in large-scale distributed systems, the corresponding company or enterprise suffers inestimable losses. Therefore, the stability of these systems is critical. System anomalies are typically stored in system logs, regardless of whether they are caused by hardware or software factors. To locate specific anomaly information, data mining techniques are applied to system logs for anomaly detection [1, 2, 3, 4, 5], fault diagnosis [6, 7, 8], performance monitoring [9, 10], and other operations. Logs are essential in the development and maintenance of systems because they record the operation and state of these systems. A large amount of log data exist on the server in large-scale distributed systems, including system, network traffic, application, and audit logs. Among them, system logs are the most important; they record the events and behaviors of various system activities and are typically semi-structured text output by programmers using print statements such as when writing source code. An unstructured log message typically includes a raw message comprising constant and variable components, with the timestamp and description information representing the event time and its emergency level, respectively. In a raw message, the constant part always consists of log print statements in the source code; in contrast, the variable part may depend on specific operations. A specific system operation is described by a raw message. Therefore, it can obtain the log events of each log message using some methods and then apply log events to represent each log message, thereby converting them into structured messages [11] (Figure 1). The conversion of unstructured log messages into structured log messages is important because most data mining models require structured data as input, and these data mining models are helpful for log analysis techniques. Therefore, for log analysis, it is important to first identify the log event of each log message. For example, two log messages are presented in Figure 2. In the first log message, \"081109 203519\" is the timestamp, and \"PacketResponder 1 for block blk16089 terminating\" is its raw message content part, where \"PacketResponder\", \"for\", \"block\", and \"terminating\" constitute the constant part, and \"1\" and \"blk 168\" constitute the variable part. \"PacketResponder * for block * terminating\" represents the log event, where \"*\" represents a variable. A log file contains multiple log events. Log messages belonging to the same event type always have the same constant message. However, the variable message differs as the event occurs. In general, log output statements always differ; thus, the format of log messages changes frequently. When the number of log messages is small, manual reading can be used to obtain log event templates. However, when the size of log files increases or there are many variations in log events, algorithms and tools are required to identify log event templates automatically from log messages. The extraction of log event templates is not only convenient for the corresponding analysis but also saves memory and queries and summarizes logs into a compact template. Figure 1: Conversion of unstructured log messages into structured log messages. Before the emergence of large-scale distributed systems, the system log scale was small, and manual log parsing could be effectively performed using simple regularization expressions and other methods. Conventional log parsing methods generally require developers to manually create a regular expression list to match each log message, which depends on the output of the source code. Thus, if the output statement changes, the regular expression list needs to be updated. When there are many log output statements in a system and the update frequency is high, manually creating and updating the regular expression list become a laborious task.