Unsupervised Log Parsing Based on Large Language Models and Entropy

A crucial first step in enabling a variety of log analysis activities is log parsing, which is the process of transforming unstructured log entries into a structured format. Even though several log parsing approaches have been developed, existing methods exhibit notable limitations when processing log data that undergo dynamic changes. In recent years, the remarkable advancements in large language models (LLM) have showcased their proficiency in comprehending natural language and code, making them suitable for application in the domain of log parsing. Recently, some log parsers have utilized clustering algorithms and sampling techniques to construct contrastive log samples, which are then analyzed using LLM, achieving high-quality log parsing. However, the templates generated by LLM may not always be accurate, and existing LLMbased log parsers typically treat the LLM-generated templates as final parsing results, which can negatively impact parsing accuracy. Additionally, the clustered logs fed into the LLM may contain inconsistencies, further affecting the accuracy of the generated templates. To address the aforementioned issues, we propose LECUR, an unsupervised log parser with template correction. To reduce parsing errors caused by LLM hallucinations and clustering biases, LECUR integrates a novel component, an entropy-based template corrector. The templates generated by the LLM are not directly used as the final parsing results; instead, they are corrected through this corrector. The corrector validates and corrects the positions of variables in the LLM-generated log templates by using information entropy based on the log messages matched by the template. Our experiments were conducted on 16 publicly available log datasets, and the results reveal that LECUR achieves superior accuracy and robustness compared to existing state-of-the-art log parsing methods.