Validation-Selected Drain3–DeepLog and SPELL–DeepLog Pipelines for HDFS Anomaly Detection: Performance and Exploratory Event-Granularity Analysis

Log parsing defines the event vocabulary supplied to sequence-based anomaly detectors and can alter downstream transitions. We compare validation-selected Drain3–DeepLog and SPELL–DeepLog pipelines on HDFS, comprising 11,175,629 log lines and 575,061 labeled blocks. Both branches used the same field extraction, pre-masking rules, block memberships, DeepLog model family, training protocol, hyperparameter search space, and validation-F1 selection criterion. For each parser, 12 DeepLog models were fitted on normal training blocks and evaluated at three top-k settings, yielding 36 candidate configurations; the final configuration was selected by maximum block-level anomaly-class F1 on labeled validation data containing both normal and anomalous blocks. The selected configurations were evaluated on the designated test partition of 125,116 blocks. Drain3–DeepLog achieved precision 0.9303, recall 0.9548, F1 0.9424, and false-positive rate 0.0086; SPELL–DeepLog achieved 0.8403, 0.8578, 0.8490, and 0.0197, respectively. Drain3 produced 1306 more true positives and 1232 fewer false positives. Balanced accuracy and Matthews correlation coefficient (MCC) were 0.9731 and 0.9354 for Drain3–DeepLog and 0.9191 and 0.8306 for SPELL–DeepLog. An exploratory event-definition analysis compared Drain3 E5 and E32 with the high-coverage SPELL S5 event without treating the comparison as verified occurrence-level mapping. S5 occurred in 80.86% of all blocks. Within the evaluated HDFS setting, based on one fixed block partition and one validation-based development realization, the findings characterize the two complete validation-selected pipelines rather than a universal parser ranking.