Small is Beautiful: A Practical and Efficient Log Parsing Framework
Minxing Wang, Yintong Huo
TL;DR
This work tackles the practical challenge of deploying log parsers with small LLMs by introducing EFParser, an unsupervised framework that combines a dual tree-bucket cache, a correction module, and a reference exemplar selector. The key innovations are an adaptive cache updating mechanism that merges semantically related templates and a correction gate that validates LLM-generated templates before caching, both tailored to mitigate hallucinations in compact models. Empirical results on the Loghub-2.0 dataset show EFParser outperforms all unsupervised baselines when run on 8B-scale models and remains competitive with larger LLMs, while maintaining efficiency. The approach demonstrates strong robustness across model types and configuration settings, offering a practical pathway for privacy-conscious, real-world log analysis deployments.
Abstract
Log parsing is a fundamental step in log analysis, partitioning raw logs into constant templates and dynamic variables. While recent semantic-based parsers leveraging Large Language Models (LLMs) exhibit superior generalizability over traditional syntax-based methods, their effectiveness is heavily contingent on model scale. This dependency leads to significant performance collapse when employing smaller, more resource-efficient LLMs. Such degradation creates a major barrier to real-world adoption, where data privacy requirements and computational constraints necessitate the use of succinct models. To bridge this gap, we propose EFParser, an unsupervised LLM-based log parser designed to enhance the capabilities of smaller models through systematic architectural innovation. EFParser introduces a dual-cache system with an adaptive updating mechanism that distinguishes between novel patterns and variations of existing templates. This allows the parser to merge redundant templates and rectify prior errors, maintaining cache consistency. Furthermore, a dedicated correction module acts as a gatekeeper, validating and refining every LLM-generated template before caching to prevent error injection. Empirical evaluations on public large-scale datasets demonstrate that EFParser outperforms state-of-the-art baselines by an average of 12.5% across all metrics when running on smaller LLMs, even surpassing some baselines utilizing large-scale models. Despite its additional validation steps, EFParser maintains high computational efficiency, offering a robust and practical solution for real-world log analysis deployment.