Low-cost and zero-shot online log parsing method based on large language model

Abstract

Disclosed in the present disclosure is a low-cost and zero-shot online log parsing method based on a large language model, including: firstly, extracting content of a log in a log message using regular expressions, then, performing regular expression matching with a log template in a database; if the matching is successful, updating a log sample corresponding to the log template; if the matching fails, conducting a dialogue with the large language model to obtain a new log template; performing template correction to prevent the log template generated by the large language model from being incapable of performing regular expression matching with the log message; performing template merging when a new template is generated; performing template splitting when the log sample is updated; and for all log templates to be added to the database, firstly, normalizing the log templates by post-processing, and then storing the log templates to the database. The log template generated by the present disclosure outperforms conventional methods in terms of word parsing accuracy, with significant advantages in speed and cost compared with the direct use of the large language model to perform log parsing tasks.