# Automatic Parsing and Utilization of System Log Features in Log Analysis: A Survey
## 3 Feature Extraction and Utilization
### Digital Features
#### 3.1.3 Log Event Features  
The log count features and the log index features mainly focus on the distribution of log events in time and space, which is a statistical feature. However, with changes in system functions, modification of log statements, and other actual operations that lead to changes in the syntax or types of log events, the above log features cannot guarantee normal operation while maintaining the existing coding structure. Furthermore, such statistical features cannot describe the semantic information contained in the log. With the development of deep learning models and natural language processing technologies, the feature extraction of log events using related technologies has become the most common method in today's research.  
[PERSON] et al. [44] regarded log sentences as ordinary natural language texts, rather than formatted templates, and applied Google's word2 vec for word embedding to obtain log event features. Word2 vec can obtain the contextual features of log sentences very well, but it has difficulty in obtaining log semantics. [PERSON] et al. [15] proposed a template vectorization representation method, Template2 Vec, by adding log synonyms and antonyms, which could extract semantic information in logs simply and effectively. It is also the first feature extraction method that considers log semantic information. This method can match new generated, unseen log templates into existing log templates based on semantic features, which allows the model to adapt to the changing actual production environment without frequent modification, and [PERSON] et al. utilized both log count features and log semantic features to detect the statistical and logical relationships of log events. LogRobust [16] obtains word embedding through FastText, uses TD-IDF for vector weighting, converts each log event into a fixed-dimensional semantic vector to obtain the semantic information embedded in the sentence, and uses Bi-LSTM for semantic learning. This method can adapt to basically similar, but not identical, log statements generated with iterative updates of the system. [PERSON] et al. [18] used Bert for log feature extraction. In contrast to other feature extraction methods, this method adds a self-attention layer to the encoder to obtain information implicit in log sentences. [PERSON] et al. [17] split the compound long words in the log into multiple sub-words and at the same time used Bert to generate word vectors. In this way, the log template sentence was transformed into a list of word vectors. [PERSON] et al. [45] believed that calculating the log event vector from the word vector brought huge computational overhead, so they proposed that LogEvent2 Vec directly encode the log event vector from the log event. Specifically, for the log sequence \([L_{i+1},L_{i+2},\ldots,L_{i+L},\ldots,L_{i+M}]\), [PERSON] et al. used \([L_{i+L-k},\ldots,L_{i+L-1},L_{i+L+1},\ldots,L_{i+L+k}]\) as the input of word2 vec, and the goal was to obtain the log event features of the log event \(L_{i+L}\). This method of encoding log features according to the log context can simultaneously represent the log sequence  
Figure 4: Log template sequence after log parsing. The “*” in the figure represents the variable part in the log template.  
features and log semantic features. However, its actual effect remains to be further verified. [PERSON] et al. [46] counted the log word frequency in their research, and calculated the weight \(Weight_{Log}^{Word}\) of each word in each log event through TF-IDF; for example, by converting the event \(L\) into a word weight vector \([Weight_{L}^{Word_{1}},Weight_{L}^{Word_{2}},\ldots,Weight_{L}^{Word_{L}}]\), each dimension value represents the weight representation of a word in the dictionary in the log \(L\).