# System Log Parsing: A Survey

arXiv: https://arxiv.org/abs/2212.14277 · HTML: https://mlsanity.com/paper/2212.14277/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Dec 2022.

## Built on by (most cited first, 10 of 10)

- [Twin Graph-based Anomaly Detection via Attentive Multi-Modal Learning for Microservice System](https://mlsanity.com/paper/2310.04701/) (2023)
- [Demystifying and Extracting Fault-indicating Information from Logs for Failure Diagnosis](https://mlsanity.com/paper/2409.13561/) (2024)
- [AI for DevSecOps: A Landscape and Future Opportunities](https://mlsanity.com/paper/2404.04839/) (2024)
- [Log Parsing using LLMs with Self-Generated In-Context Learning and Self-Correction](https://mlsanity.com/paper/2406.03376/) (2024)
- [The Last Dependency Crusade: Solving Python Dependency Conflicts with LLMs](https://mlsanity.com/paper/2501.16191/) (2025)
- [LLMLogAnalyzer: A Clustering-Based Log Analysis Chatbot using Large Language Models](https://mlsanity.com/paper/2510.24031/) (2025)
- [TPLogAD: Unsupervised Log Anomaly Detection Based on Event Templates and Key Parameters](https://mlsanity.com/paper/2411.15250/) (2024)
- [Lost in Translation? Converting RegExes for Log Parsing into Dynatrace Pattern Language](https://mlsanity.com/paper/2506.19539/) (2025)
- [A global log for medical AI](https://mlsanity.com/paper/2510.04033/) (2025)
- [Resilient Concurrent Causal Discovery for Topological Event Sequences](https://mlsanity.com/paper/2608.21815/) (2026)

## Abstract (arXiv)

Modern information and communication systems have become increasingly challenging to manage. The ubiquitous system logs contain plentiful information and are thus widely exploited as an alternative source for system management. As log files usually encompass large amounts of raw data, manually analyzing them is laborious and error-prone. Consequently, many research endeavors have been devoted to automatic log analysis. However, these works typically expect structured input and struggle with the heterogeneous nature of raw system logs. Log parsing closes this gap by converting the unstructured system logs to structured records. Many parsers were proposed during the last decades to accommodate various log analysis applications. However, due to the ample solution space and lack of systematic evaluation, it is not easy for practitioners to find ready-made solutions that fit their needs. This paper aims to provide a comprehensive survey on log parsing. We begin with an exhaustive taxonomy of existing log parsers. Then we empirically analyze the critical performance and operational features for 17 open-source solutions both quantitatively and qualitatively, and whenever applicable discuss the merits of alternative approaches. We also elaborate on future challenges and discuss the relevant research directions. We envision this survey as a helpful resource for system administrators and domain experts to choose the most desirable open-source solution or implement new ones based on application-specific requirements.