A method implemented with a processor, comprising: identifying a log (1702, 1902, 2102) to analyze; creating a master list from a first log entry (1906a, 1906b, 2402) within the log (1702, 1902, 2102), the first log entry (1906a, 1906b, 2402) comprising one or more lines, wherein the master list comprises a mapping structure that maps each element of the first log entry (1906a, 1906b, 2402) of the log (1702, 1902, 2102) to an identified element type of a plurality of element types, wherein the plurality of element types comprises at least one of a string type, an integer type, an alphabetic character type, or a field rule type, wherein the field rule type corresponds to a sequence of elements defined by a predefined field rule; selecting a second log entry (1906a, 1906b, 2402) from the log (1702, 1902, 2102), the second log entry (1906a, 1906b, 2402) comprising one or more lines; comparing the second log entry (1906a, 1906b, 2402) against the master list to identify variable parts and non-variable parts, and updating the master list to reflect at least the variable parts and the non-variable parts, wherein the non-variable parts comprise elements which are common between the master list and the second log entry (1906a, 1906b, 2402), and wherein the variable parts comprise elements in which the master list differs from the second log entry (1906a, 1906b, 2402); determining whether there is a further log entry (1906a, 1906b, 2402) to process, and, if so, then repeating the selecting, comparing and updating for the further log entry (1906a, 1906b, 2402); for at least two of the variable parts, assigning, in the mapping structure, each variable part of the at least two variable parts to a data type that encompasses all values detected in said each variable part in the processed log entries (1906a, 1906b, 2402); and processing the master list to construct a regular expression for the non-variable parts with placeholders for the variable parts to implement a log parser, wherein at least two different placeholders are associated with different data types assigned to the corresponding variable parts. identifying a log (1702, 1902, 2102) to analyze; creating a master list from a first log entry (1906a, 1906b, 2402) within the log (1702, 1902, 2102), the first log entry (1906a, 1906b, 2402) comprising one or more lines, wherein the master list comprises a mapping structure that maps each element of the first log entry (1906a, 1906b, 2402) of the log (1702, 1902, 2102) to an identified element type of a plurality of element types, wherein the plurality of element types comprises at least one of a string type, an integer type, an alphabetic character type, or a field rule type, wherein the field rule type corresponds to a sequence of elements defined by a predefined field rule; wherein the master list comprises a mapping structure that maps each element of the first log entry (1906a, 1906b, 2402) of the log (1702, 1902, 2102) to an identified element type of a plurality of element types, wherein the plurality of element types comprises at least one of a string type, an integer type, an alphabetic character type, or a field rule type, wherein the field rule type corresponds to a sequence of elements defined by a predefined field rule; selecting a second log entry (1906a, 1906b, 2402) from the log (1702, 1902, 2102), the second log entry (1906a, 1906b, 2402) comprising one or more lines; comparing the second log entry (1906a, 1906b, 2402) against the master list to identify variable parts and non-variable parts, and updating the master list to reflect at least the variable parts and the non-variable parts, wherein the non-variable parts comprise elements which are common between the master list and the second log entry (1906a, 1906b, 2402), and wherein the variable parts comprise elements in which the master list differs from the second log entry (1906a, 1906b, 2402); wherein the non-variable parts comprise elements which are common between the master list and the second log entry (1906a, 1906b, 2402), and wherein the variable parts comprise elements in which the master list differs from the second log entry (1906a, 1906b, 2402); determining whether there is a further log entry (1906a, 1906b, 2402) to process, and, if so, then repeating the selecting, comparing and updating for the further log entry (1906a, 1906b, 2402); for at least two of the variable parts, assigning, in the mapping structure, each variable part of the at least two variable parts to a data type that encompasses all values detected in said each variable part in the processed log entries (1906a, 1906b, 2402); and processing the master list to construct a regular expression for the non-variable parts with placeholders for the variable parts to implement a log parser, wherein at least two different placeholders are associated with different data types assigned to the corresponding variable parts.