DeepParse: Hybrid Log Parsing with LLM-Synthesized Regex Masks
TLDR
DeepParse is a hybrid log parser using LLMs to synthesize regex masks for the Drain algorithm, achieving high accuracy and efficiency.
Key contributions
- Hybrid framework uses LLMs to synthesize reusable regex masks for the Drain algorithm.
- Separates LLM reasoning from execution for accurate, scalable, and cost-efficient parsing.
- Achieves 97.6% parsing accuracy and better consistency across 16 benchmark datasets.
- Reduces false alarms by 30% and inference latency by 36% in anomaly detection pipelines.
Why it matters
Modern systems need efficient log parsing, but existing methods struggle with accuracy or cost. DeepParse offers a practical solution by combining LLM generalization with fast deterministic execution. This significantly improves log structuring, benefiting anomaly detection and system reliability.
Original Abstract
Modern distributed systems produce massive, heterogeneous logs essential for reliability, security, and anomaly detection. Converting these free-form messages into structured templates (log parsing) is challenging due to evolving formats and limited labeled data. Machine-learning-based parsers like Drain are fast but accuracy often degrades on complex variables, while Large Language Models (LLMs) offer better generalization but incur prohibitive inference costs. This paper presents DeepParse, a hybrid framework that automatically mines reusable variable patterns from small log samples using an LLM, then applies them deterministically through the Drain algorithm. By separating the reasoning phase from execution, DeepParse enables accurate, scalable, and cost-efficient log structuring without relying on brittle handcrafted rules or per-line neural inference. Across 16 benchmark datasets, DeepParse achieves higher accuracy in variable extraction (97.6% average Parsing Accuracy) and better consistency than both heuristic and LLM-only baselines. Integrating DeepParse into an anomaly detection pipeline reduced false alarms by over 30% and reduced inference latency by 36% compared to heuristic baselines.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.