On Sequence-to-Sequence Models for Automated Log Parsing
Preprint
Abstract
Log parsing is a critical standard operating procedure in software systems, enabling monitoring, anomaly detection, and failure diagnosis. However, automated log parsing remains challenging due to heterogeneous log formats, distribution shifts between training and deployment data, and the brittleness of rule-based approaches. This study aims to systematically evaluate how sequence modelling architecture, representation choice, sequence length, and training data availability influence automated log parsing performance and computational cost. We conduct a controlled empirical study comparing four sequence modelling architectures: Transformer, Mamba state-space, monodirectional LSTM, and bidirectional LSTM models. In total, 396 models are trained across multiple dataset configurations and evaluated using relative Levenshtein edit distance with statistical significance testing. Transformer achieves the lowest mean relative edit distance (0.111), followed by Mamba (0.145), mono-LSTM (0.186), and bi-LSTM (0.265), where lower values are better. Mamba provides competitive accuracy with substantially lower computational cost. Character-level tokenization generally improves performance, sequence length has negligible practical impact on Transformer accuracy, and both Mamba and Transformer demonstrate stronger sample efficiency than recurrent models. Overall, Transformers reduce parsing error by 23.4%, while Mamba is a strong alternative under data or compute constraints. These results also clarify the roles of representation choice, sequence length, and sample efficiency, providing practical guidance for researchers and practitioners.Keywords
All Related Versions
This publication has 31 references indexed in Scilit:
- Anomaly Detection in Large-Scale Cloud Systems: An Industry Case and Dataset2025
- LogBERT: Log Anomaly Detection via BERT2021
- Anomaly Detection in a Large-Scale Cloud Platform2021
- On Automatic Parsing of Log Records2021
- Tools and Benchmarks for Automated Log Parsing2019
- Log-based Abnormal Task Detection and Root Cause Analysis for Spark2017
- Drain: An Online Log Parsing Approach with Fixed Depth Tree2017
- LogCluster - A data clustering and pattern mining algorithm for event logs2015
- Industry Practices and Event Logging: Assessment of a Critical Software Development Process2015
- Experimentation in Software Engineering2012