SLOPE: Fine-Grained Log Parser Combining Syntax with LLM-Distilled Semantic
TL;DR
This work proposes SLOPE, a fine-grained log parser combining syntax with semantics, which achieves an average parsing accuracy improvement of 61.2% and 5.9 times higher throughput over all baselines, exhibiting state-of-the-art robustness.
Abstract
Log parsing, which transforms unstructured log messages into structured formats, is a critical step in automated log analysis and directly impacts the effectiveness of downstream tasks. However, existing log parsers struggle to balance effectiveness with efficiency and show limited capability in handling log inconsistency, a common phenomenon in real-world systems where log messages follow different templates but contain semantically equivalent parameters. To address these challenges, we propose SLOPE, a fine-grained log parser combining syntax with semantics. Unlike coarse-grained template-level parsing and caching, SLOPE distills parameter-level semantics into reusable rules. Specifically, it first utilizes Large Language Models (LLMs) to extract parameters and their semantic and syntactic features from sampled logs, and stores these features in a Finite State Machine (FSM). During online parsing, SLOPE reuses these semantic-syntax rules for efficient and fine-grained parsing without relying on LLMs. We conduct comprehensive evaluations on 14 public datasets and a large-scale industrial dataset from Huawei's real-world business services on HarmonyOS. Results demonstrate that SLOPE achieves an average parsing accuracy improvement of 61.2% and 5.9 times higher throughput over all baselines. Furthermore, SLOPE maintains a high parsing accuracy with an average drop of only 1.4% under diverse log inconsistencies, exhibiting state-of-the-art robustness.