{
  "schema_version": "0.6.0",
  "paper_id": "decoding-log-parsing-challenges-taxonomy",
  "page_url": "https://naser.github.io/research-publications/papers/decoding-log-parsing-challenges-taxonomy/",
  "title": "Decoding Log Parsing Challenges: A Comprehensive Taxonomy for Actionable Solutions",
  "title_variants": [],
  "authors": [
    "Issam Sedki",
    "Abdelwahab Hamou-Lhadj",
    "Otmane Ait-Mohamed",
    "Naser Ezzati-Jivan",
    "Mohammed A. Shehab"
  ],
  "author_details": [
    {
      "name": "Issam Sedki",
      "orcid": "https://orcid.org/0009-0006-8709-7934",
      "profile_url": "https://dblp.org/pid/305/0448.html"
    },
    {
      "name": "Abdelwahab Hamou-Lhadj",
      "orcid": "https://orcid.org/0000-0002-3319-5006",
      "profile_url": "https://dblp.org/pid/70/2136.html"
    },
    {
      "name": "Otmane Ait-Mohamed",
      "orcid": "https://orcid.org/0000-0003-1378-1443",
      "profile_url": "https://dblp.org/pid/95/4076.html"
    },
    {
      "name": "Naser Ezzati-Jivan",
      "orcid": "https://orcid.org/0000-0003-1435-6297",
      "profile_url": "https://naser.github.io/"
    },
    {
      "name": "Mohammed A. Shehab",
      "orcid": "https://orcid.org/0000-0003-3369-8540",
      "profile_url": "https://dblp.org/pid/162/3272.html"
    }
  ],
  "publication": {
    "year": 2024,
    "venue": "2024 ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE Companion)",
    "type": "poster paper",
    "publication_date": "2024-04-14",
    "online_date": "2024-05-23",
    "print_date": "2024-04-14",
    "volume": null,
    "issue": null,
    "pages": "392-393",
    "article_number": null,
    "publisher": "ACM",
    "issn": [],
    "isbn": [],
    "crossref_type": "proceedings-article"
  },
  "publication_type": "poster paper",
  "status": "published_with_public_full_text",
  "canonical_source_url": "https://doi.org/10.1145/3639478.3643523",
  "source_record_id": "decoding-log-parsing-challenges-a-comprehensive-taxonomy-for-actionable-solutions-a76a73833e",
  "identifiers": {
    "doi": "10.1145/3639478.3643523"
  },
  "abstract": "Logging is a common practice in software engineering that is used by developers to understand the runtime aspects of a system. Log files, however, tend to vary in their structures, making it challenging to analyze their content. In this paper, we present a preliminary taxonomy of log event characteristics that commonly lead to log parsing errors. We achieve this through the analysis of 16 log datasets using eight different parsing tools. We believe that this taxonomy can be used to guide the design of better log parsing tools that can adapt to various log file structures. It can also pave the way to the development of logging guidelines and best practices.",
  "abstract_source": "Exact author abstract from ACM's free-access version of record, reviewed in full on 2026-08-09.",
  "abstract_available": true,
  "scholar_eligibility": {
    "eligible": true,
    "basis": "complete-visible-author-abstract",
    "note": "The page displays the complete verified author abstract."
  },
  "description": "Logging is a common practice in software engineering that is used by developers to understand the runtime aspects of a system. Log files, however, tend to vary in their structures, making it challenging to analyze their content. In this paper, we present a preliminary taxonomy of log event characteristics that commonly lead to log parsing errors. We achieve this through the analysis of 16 log datasets using eight different parsing tools. We believe that this taxonomy can be used to guide the design of better log parsing tools that can adapt to various log file structures. It can also pave the way to the development of logging guidelines and best practices.",
  "evidence_level": "full-text-reviewed",
  "evidence": {
    "source_basis": "full-text-reviewed",
    "coverage": "material paper sections",
    "summary_origin": "AI-assisted catalog editorial summary",
    "review_status": "catalog-reviewed; paper-author approval pending",
    "verified_on": "2026-08-09",
    "sources": [
      {
        "note": "ACM free-access eReader, pp. 392-393: complete paper, abstract, approach, taxonomy tables, results, limitations, and conclusion"
      },
      {
        "note": "ACM page verified 2026-08-09: free access, DOI 10.1145/3639478.3643523, pp. 392-393, published 23 May 2024"
      },
      {
        "note": "Official ICSE poster page: https://conf.researchr.org/details/icse-2024/icse-2024-posters/68/Decoding-Log-Parsing-Challenges-A-Comprehensive-Taxonomy-for-Actionable-Solutions"
      },
      {
        "note": "DOI: https://doi.org/10.1145/3639478.3643523"
      },
      {
        "note": "Private batch report: reports/parallel-batch-02.md"
      }
    ]
  },
  "summary": {
    "core_contribution": "The paper derives a 30-item taxonomy of log event characteristics that induce parsing errors and quantifies the characteristics with the largest impact across eight parsers.",
    "problem": "Log parsers must separate static template text from dynamic values across heterogeneous formats, yet prior work concentrates on parser algorithms more than on the data characteristics that repeatedly cause parsing errors.",
    "method": "The study uses 16 heterogeneous Loghub datasets, each with 2,000 manually parsed events and templates as ground truth, and runs Drain, IPLoM, AEL, Spell, Lenma, LogMine, SHISO, and ULP with their published configurations. The authors open-code an initial sample of 100 unique events per dataset, iteratively reconcile codes and categories, and then extend detection to all events with regular expressions and named-entity recognition.",
    "findings": "The analysis identifies 30 log event characteristics in three groups: 19 data-type characteristics, six structural patterns, and five log-message-composition characteristics. Four characteristics account on average for more than half of observed parsing errors: unseparated token sequences contribute about 19-20% across parsers, alphanumeric-plus-special-character tokens about 11-13%, colon-delimited key-value pairs 10.63-11.42%, and decimal values 7.43-8.55%.",
    "limitations": "This is a preliminary two-page study. The initial qualitative coding uses 100 unique events per dataset, the automated extension depends on regular expressions and named-entity recognition, parser configurations follow prior publications, and detailed per-dataset results are omitted because of space limits.",
    "future_work": "Use the taxonomy to design parsers that adapt to heterogeneous log structures and to develop empirically grounded logging guidelines and best practices; validate the taxonomy on additional datasets and parser families."
  },
  "tags": [
    "observability",
    "machine-learning",
    "trace-analysis",
    "benchmark-datasets"
  ],
  "keywords": [
    "log parsing",
    "log event characteristics",
    "LEC taxonomy",
    "LogHub",
    "open coding",
    "Drain",
    "IPLoM",
    "AEL",
    "Spell",
    "LenMa",
    "LogMine",
    "SHISO",
    "ULP",
    "log templates",
    "parsing errors",
    "ICSE 2024"
  ],
  "versions": [
    {
      "id": "published-version",
      "label": "Published version",
      "relation": "version-of-record",
      "title": "Decoding Log Parsing Challenges: A Comprehensive Taxonomy for Actionable Solutions",
      "url": "https://doi.org/10.1145/3639478.3643523",
      "pdf_url": null,
      "status": "published",
      "canonical_for_citation": true
    },
    {
      "id": "free-access-acm-pdf",
      "label": "Free-access ACM PDF",
      "relation": "source-record",
      "title": "Decoding Log Parsing Challenges: A Comprehensive Taxonomy for Actionable Solutions",
      "url": "https://dl.acm.org/doi/pdf/10.1145/3639478.3643523?download=true",
      "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/3639478.3643523?download=true",
      "status": "public_full_text",
      "canonical_for_citation": false
    }
  ],
  "access": {
    "status": "published_with_public_full_text",
    "note": "ACM marks the two-page version of record as free access and provides public PDF and eReader links. The PDF is externally linked and is not redistributed here.",
    "license": null
  },
  "resources": {
    "code": null,
    "data": null,
    "slides": null,
    "demo": null
  },
  "citation_guidance": {
    "when_to_cite": "Cite this paper when analyzing which log-event structures systematically cause errors across automated log parsers.",
    "points": [
      "A 30-item taxonomy derived from 16 Loghub datasets and eight log parsers.",
      "Open coding plus regex and named-entity-recognition expansion for identifying error-inducing log characteristics.",
      "Cross-parser impact estimates for unseparated tokens, mixed alphanumeric/special-character tokens, colon-delimited key-value pairs, and decimals."
    ],
    "canonical_version_id": "published-version"
  },
  "provenance": {
    "metadata_verified_on": "2026-08-09",
    "metadata_source": [
      "ACM free-access eReader, pp. 392-393: complete paper, abstract, approach, taxonomy tables, results, limitations, and conclusion",
      "ACM page verified 2026-08-09: free access, DOI 10.1145/3639478.3643523, pp. 392-393, published 23 May 2024",
      "Official ICSE poster page: https://conf.researchr.org/details/icse-2024/icse-2024-posters/68/Decoding-Log-Parsing-Challenges-A-Comprehensive-Taxonomy-for-Actionable-Solutions",
      "DOI: https://doi.org/10.1145/3639478.3643523",
      "Private batch report: reports/parallel-batch-02.md"
    ],
    "summary_written_by": "AI-assisted",
    "summary_verified_by": "full-text-grounded catalog review; author approval pending",
    "linked_preprint_record": null,
    "author_order_note": null
  },
  "batch": {
    "phase": 2,
    "batch_label": "expanded forty-paper release",
    "status": "included_in_expanded_catalog",
    "selected_at": "2026-08-09"
  }
}