2025 · IEEE International Conference on Program Comprehension (ICPC)
Developing a Taxonomy for Advanced Log Parsing Techniques
Evidence basis: full-text-reviewed · Review status: catalog-reviewed; paper-author approval pending
observability trace-analysis anomaly-detection performance-analysis
log parsing log event characteristics LEC taxonomy LogHub Drain IPLoM AEL Spell LenMa LogMine SHISO ULP open coding regex NER chi-square parser errors token structure
Core contribution: The paper introduces a taxonomy of log-event characteristics that explains why different log parsers fail across systems and parser families.
Problem and motivation
Heterogeneous and evolving logs make template extraction unreliable; existing parser evaluations often emphasize algorithm design without identifying the log-event characteristics that cause errors across datasets and parser families.
Method and contribution
The study samples 16 LogHub datasets with 2,000 manually parsed events per dataset, yielding 32,000 labeled events. Eight parsers-Drain, IPLoM, AEL, Spell, LenMa, LogMine, SHISO, and ULP-are compared against ground-truth templates. Open coding, regular expressions, named-entity recognition, and manual review identify 30 log-event characteristics (LECs) grouped into Log Event Presentation, Data Types, and Structural Arrangement of Tokens. A chi-square test of independence examines association with parsing errors.
Findings and evidence
Total parser error counts are Drain 851, IPLoM 882, LenMa 883, AEL 914, ULP 923, Spell 959, SHISO 963, and LogMine 965; IPLoM timed out on Android. Unseparated token sequences and alphanumeric/special-character mixtures are repeatedly difficult. Dataset mismatch totals include Linux 93.81%, OpenStack 83.13%, BGL 73.33%, HDFS 9.85%, and Apache 38.80% in the reported table.
Limitations and future directions
Limitations: The corpus contains 16 public datasets and eight parsers, not industrial/proprietary logs; parser versions, host/runtime configuration, and independent-run protocol are unknown. Open coding and automated LEC detection may miss characteristics in complex datasets.
Future work: Develop hybrid parsers that combine domain knowledge with data-driven adaptation, handle difficult LECs dynamically, and promote standardized logging formats.
Sources and identifiers
- Published version published
- Public full text · PDF public_full_text
When to cite this paper
Cite this paper when your work uses or compares a 30-characteristic log-event taxonomy organized into presentation, data-type, and structural-token dimensions.
- a 30-characteristic log-event taxonomy organized into presentation, data-type, and structural-token dimensions.
- the eight-parser/16-LogHub benchmark and its exact-template error comparison.
- the finding that unseparated token sequences and alphanumeric/special-character mixtures are cross-parser failure hotspots.
- the Linux/HDFS/Apache mismatch contrast when motivating dataset-dependent parser evaluation.
Citation
@inproceedings{ezzatiJivan2025developinga,
author = {Issam Sedki and Abdelwahab Hamou-Lhadj and Otmane Ait Mohamed and Naser Ezzati-Jivan},
title = {Developing a Taxonomy for Advanced Log Parsing Techniques},
year = {2025},
booktitle = {IEEE International Conference on Program Comprehension (ICPC)},
pages = {01-12},
publisher = {IEEE},
doi = {10.1109/ICPC66645.2025.00061},
url = {https://doi.org/10.1109/ICPC66645.2025.00061}
}Other citation formats for Word and reference managers
Sedki, I., Hamou-Lhadj, A., Mohamed, O. A., & Ezzati-Jivan, N. (2025). Developing a Taxonomy for Advanced Log Parsing Techniques. In IEEE International Conference on Program Comprehension (ICPC) (pp. 01-12). https://doi.org/10.1109/ICPC66645.2025.00061I. Sedki, A. Hamou-Lhadj, O. A. Mohamed, and N. Ezzati-Jivan, "Developing a Taxonomy for Advanced Log Parsing Techniques," in IEEE International Conference on Program Comprehension (ICPC), pp. 01-12, 2025, doi: 10.1109/ICPC66645.2025.00061