DLogParser: An Efficient Dynamic Log Parser with Multiple Grouping Criteria

Most existing log parsers are static. When parsing logs with a static parser, the accuracy tends to fluctuate significantly. To overcome this issue, this paper proposes a dynamic log parser named DLogParser. The core idea of DLogParser is to select different parsing policies based on log features. DLogParser first parses a small batch of sample log messages, then analyzes log characteristics from the parsing results, and determines an appropriate parsing policy for the current logs. Then it parses all remaining logs according to the determined policy. To support dynamic parsing policies, DLogParser incorporates 5 grouping criteria for log features, including length, punctuation, first token, last token, and key token, and establishes 7 rules for parsing policy generation. We evaluated DLogParser on public datasets from LogHub. The experimental results demonstrate that compared to 11 existing log parsers, DLogParser achieves an accuracy of 90.3% with an acceptable performance loss.