HG - I nsight L og: Context Prioritization and Reduction for Question Answering with Non-Natural Language Construct Log Data (2025)

Abstract: Modern IT systems generate vast amounts of log data, which pose challenges for Large Language Models (LLMs) due to their large size, irrelevant entries, and non-Natural Language (non-NL) construct (e.g., domain-specific jargon, error codes, file paths, and abbreviations). Traditional methods like Retrieval-Augmented Generation (RAG) and GraphRAG fail to preserve temporal sequences, handle non-NL for context and entities extraction, and dynamically prioritize query-relevant context. To address these limitations, we propose HG-InsightLog, a novel framework that constructs a multi-entity temporal hypergraph representing log attribute-value pair as nodes and connecting them with hyperedges, capturing critical connections in the data. HG-InsightLog introduces a multi-step query personalization mechanism enhancing the Personalized PageRank algorithm to rank hyperedges based on query relevance and contextual centrality to priortize critical connections. Top ranked hyperedges are extracted and converted back into log formats preserving temporal order and reducing context. Experimental results across multiple datasets demonstrate its superiority over existing methods, enhancing factual, causal, and analytical reasoning. Our approach enables smaller LLMs like LLaMA-8B to perform effective log-based QA. Being model-agnostic and training-free, it scales with evolving open-source LLMs without relying on proprietary systems.

## introduction log files are crucial for monitoring, diagnostics, and root cause analysis (rca) in it systems, capturing events, operations, and errors @xcite . however, their sheer volume-sometimes reaching up to 50 gb per hour-makes manual analysis overwhelming and renders traditional machine learning methods ineffective for efficient question answering (qa) @xcite . llms like gpt-3.5, gpt-4 @xcite , and llama @xcite excel in qa tasks with natural language (nl) data @xcite @xcite but face two major challenges (long temporal context (see by leveraging the efficiency and capabilities of llama3.1 8b, this work sets a benchmark for resource-efficient, accurate, and query-adaptive log data analysis. ## related work llms for log analysis -llms have been explored for log analysis, particularly for parsing and anomaly detection. lilac @xcite applies llms for log parsing, converting unstructured logs into structured formats. logbert @xcite employs self-supervised learning to predict masked keys in normal log sequences, aiding anomaly detection. rca-focused methods chen et al. @xcite use llms to summarize cloud incidents and predict root causes, though they rely on incident-level data rather than raw logs. ## methodology the key idea of our method is to create a hypergraph representation of the entire large log file and rank the hyperedges based on the user query and node centrality. we then extract the top-p hyperedges while preserving the temporal sequence and convert them back into the original log structure. this approach reduces the context size while preserving the temporal sequence of the logs and prioritizing critical information. figure 2 provides an overview of our approach. we begin with a brief overview of the problem in section 3.1, followed by a detailed explanation of our method in sections 3.2 -3.6. ## conclusion we present hg-insightlog, a novel hypergraphbased framework for efficient llm-driven qa on large, non-natural log data. by constructing a multi-entity hypergraph and leveraging an enhanced hyperedge ranking mechanism, our method effectively reduces context size, preserves temporal structure, and prioritizes query-relevant information. experimental results across multiple datasets demonstrate superior performance over baselines in factual, causal, and analytical reasoning tasks. our approach ensures scalable, training-free qa while maintaining causal coherence, making it a robust solution for log-based analysis. future work will explore integrating domain-specific retrieval and adaptive fine-tuning to enhance performance on a wide varieties of proprietary log datasets.