{
  "schema_version": "0.6.0",
  "paper_id": "towards-a-classification-of-log-parsing-errors",
  "page_url": "https://naser.github.io/research-publications/papers/towards-a-classification-of-log-parsing-errors/",
  "title": "Towards a Classification of Log Parsing Errors",
  "title_variants": [],
  "authors": [
    "Issam Sedki",
    "Abdelwahab Hamou-Lhadj",
    "Otmane Ait Mohamed",
    "Naser Ezzati-Jivan"
  ],
  "author_details": [
    {
      "name": "Issam Sedki",
      "orcid": null,
      "profile_url": "https://dblp.org/pid/305/0448.html"
    },
    {
      "name": "Abdelwahab Hamou-Lhadj",
      "orcid": "https://orcid.org/0000-0002-3319-5006",
      "profile_url": "https://dblp.org/pid/70/2136.html"
    },
    {
      "name": "Otmane Ait Mohamed",
      "orcid": null,
      "profile_url": "https://dblp.org/pid/95/4076.html"
    },
    {
      "name": "Naser Ezzati-Jivan",
      "orcid": "https://orcid.org/0000-0003-1435-6297",
      "profile_url": "https://naser.github.io/"
    }
  ],
  "publication": {
    "year": 2023,
    "venue": "IEEE International Conference on Program Comprehension (ICPC)",
    "type": "conference paper",
    "publication_date": "2023-05",
    "online_date": null,
    "print_date": "2023-05",
    "volume": null,
    "issue": null,
    "pages": "84-88",
    "article_number": null,
    "publisher": "IEEE",
    "issn": [],
    "isbn": [],
    "crossref_type": "proceedings-article"
  },
  "publication_type": "conference paper",
  "status": "published_with_public_full_text",
  "canonical_source_url": "https://doi.org/10.1109/ICPC58990.2023.00023",
  "source_record_id": "towards-a-classification-of-log-parsing-errors-c341910da7",
  "identifiers": {
    "doi": "10.1109/ICPC58990.2023.00023"
  },
  "abstract": null,
  "abstract_source": "Author-hosted full-text PDF reviewed; abstract paraphrased for this catalog.",
  "abstract_available": false,
  "scholar_eligibility": {
    "eligible": false,
    "basis": "not-eligible",
    "note": "The page is a discovery record; it does not claim Google Scholar article-host eligibility."
  },
  "description": "The paper classifies recurring log-parsing errors and connects them to token and event characteristics that can guide parser design and logging practice.",
  "evidence_level": "full-text-reviewed",
  "evidence": {
    "source_basis": "full-text-reviewed",
    "coverage": "material paper sections",
    "summary_origin": "AI-assisted catalog editorial summary",
    "review_status": "catalog-reviewed; paper-author approval pending",
    "verified_on": "2026-08-09",
    "sources": [
      {
        "note": "ICPC log-parsing-errors PDF: four LogHub datasets, four parsers, 8,000 labelled events, nine categories, and error-count method"
      },
      {
        "note": "ICPC log-parsing-errors PDF: 523 errors, 65.51% tokenization-related share, 28.5% regex share, per-category values, and HealthApp/OpenStack examples"
      },
      {
        "note": "Zenodo dataset DOI and author-hosted PDF recorded as public resources"
      },
      {
        "note": "Local PDF hash verified in pdf-evidence/extraction-manifest.json"
      }
    ]
  },
  "summary": {
    "core_contribution": "The paper classifies recurring log-parsing errors and connects them to token and event characteristics that can guide parser design and logging practice.",
    "problem": "Log parsers vary substantially across datasets, but recurring error causes lack a common classification that can guide parser design and logging practice (p. 1).",
    "method": "Drain, AEL, Spell, and ULP are compared against manual ground truth from four LogHub datasets: OpenStack, Linux, HealthApp, and Apache. Each contributes 2,000 manually parsed events; parser errors are manually inspected and grouped into nine categories. Static-token correctness/order and dynamic-token presence/order define the comparison; repeated instances of the same error are counted once (pp. 2-4).",
    "findings": "The study reports 523 errors: Linux 231, OpenStack 151, HealthApp 130, and Apache 11. C1/C2/C3/C7 tokenization-related categories account for 65.51% of errors; regex preprocessing accounts for 28.5% of captured errors. OpenStack C2 ranges from 29.63% to 68.75% across parsers (51.31% average); C6 averages 20.05% versus C2's 20.95%; C7 reaches 67.75% of HealthApp errors (pp. 2-4).",
    "limitations": "Preliminary scope: four datasets, four parsers, and 8,000 manually labelled events. Industrial generalization and system-type effects are untested; parser versions/configurations are unknown.",
    "future_work": "Larger/cross-system datasets, improved parser algorithms and preprocessing, delimiter-aware/consistent logging practices, and further study of system-type effects (p. 4)."
  },
  "tags": [
    "observability",
    "trace-analysis",
    "anomaly-detection",
    "performance-analysis"
  ],
  "keywords": [
    "log parsing",
    "parser errors",
    "Drain",
    "AEL",
    "Spell",
    "ULP",
    "LogHub",
    "tokenization",
    "logging practices",
    "dynamic tokens",
    "static tokens",
    "delimiter-aware logging",
    "parser error taxonomy"
  ],
  "versions": [
    {
      "id": "published-version",
      "label": "Published version",
      "relation": "version-of-record",
      "title": "Towards a Classification of Log Parsing Errors",
      "url": "https://doi.org/10.1109/ICPC58990.2023.00023",
      "pdf_url": null,
      "status": "published",
      "canonical_for_citation": true
    },
    {
      "id": "public-full-text",
      "label": "Public full text",
      "relation": "source-record",
      "title": "Towards a Classification of Log Parsing Errors",
      "url": "https://users.encs.concordia.ca/~abdelw/papers/ICPC23_ParsingErrors.pdf",
      "pdf_url": "https://users.encs.concordia.ca/~abdelw/papers/ICPC23_ParsingErrors.pdf",
      "status": "public_full_text",
      "canonical_for_citation": false
    }
  ],
  "access": {
    "status": "published_with_public_full_text",
    "note": "The DOI is the canonical citation target; the public full-text or author-manuscript link is external and the PDF is not redistributed here.",
    "license": null
  },
  "resources": {
    "code": null,
    "data": "https://doi.org/10.5281/zenodo.7623145",
    "slides": null,
    "demo": null
  },
  "citation_guidance": {
    "when_to_cite": "Cite this paper when your work uses or compares the nine-category taxonomy of recurring log parsing failures involving token format, demarcation, static/dynamic confusion, and slight structural variation.",
    "points": [
      "For the nine-category taxonomy of recurring log parsing failures involving token format, demarcation, static/dynamic confusion, and slight structural variation.",
      "For the four-parser/four-LogHub comparison and its 523 manually examined error instances.",
      "For evidence that tokenization-related categories dominate the observed errors and that regular-expression preprocessing is a distinct error source.",
      "For delimiter-aware and more consistent logging as design responses to parser failures."
    ],
    "canonical_version_id": "published-version"
  },
  "provenance": {
    "metadata_verified_on": "2026-08-09",
    "metadata_source": [
      "ICPC log-parsing-errors PDF: four LogHub datasets, four parsers, 8,000 labelled events, nine categories, and error-count method",
      "ICPC log-parsing-errors PDF: 523 errors, 65.51% tokenization-related share, 28.5% regex share, per-category values, and HealthApp/OpenStack examples",
      "Zenodo dataset DOI and author-hosted PDF recorded as public resources",
      "Local PDF hash verified in pdf-evidence/extraction-manifest.json"
    ],
    "summary_written_by": "AI-assisted",
    "summary_verified_by": "full-text-grounded catalog review; author approval pending",
    "linked_preprint_record": null,
    "author_order_note": null
  },
  "batch": {
    "phase": 2,
    "batch_label": "expanded forty-paper release",
    "status": "included_in_expanded_catalog",
    "selected_at": "2026-08-09"
  }
}