Pith. sign in

REVIEW 3 major objections 7 minor 38 references

Natural-language log querying works only after raw logs are turned into parser-induced, semantically grounded relational schemas so an LLM can emit correct SQL.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-11 23:15 UTC pith:VI66C7VK

load-bearing objection Solid systems paper: schema induction + grounding is the real lever for NL log analytics, with a large execution-verified bench and clean ablations; the main soft spot is LLM-built gold that may favor SQL-shaped intents. the 3 major comments →

arxiv 2607.03884 v1 pith:VI66C7VK submitted 2026-07-04 cs.SE

LogNLQ: Natural-Language Log Querying with Parser-Induced and Semantically Grounded Schemas

Juepeng Wang , Jinyang Liu , Zhuangbin Chen , Zibin Zheng This is my paper
classification cs.SE
keywords Log AnalysisNatural Language QueryingText-to-SQLLog ParsingObservabilityAIOps
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper claims the real obstacle to natural-language log querying is not language understanding but the fact that raw logs have no executable schema. Text QA, LogQL-style generators, and ordinary Text-to-SQL therefore fail at counting, role-aware filtering, and aggregation. LogNLQ first parses logs into template-partitioned tables, then labels both event templates and parameter columns with readable names and descriptions. At query time it retrieves the relevant schema pieces and has an LLM write SQL constrained to those pieces only. On an execution-verified benchmark of 8,895 queries over four real-world datasets, this approach reaches retrieval F1 above 0.89 on basic queries (baselines below 0.25) and much larger gains on complex diagnostic scenario queries.

Core claim

Parser-induced relational structuring is an absolute prerequisite for executable natural-language log analytics. Once that structure exists, dual-granularity semantic grounding of templates and parameter columns lets an LLM map user intent onto the correct physical fields and generate executable SQL that substantially outperforms text-based QA, Log-DSL generation, and schema-free Text-to-SQL on both retrieval and aggregation, especially for multi-event diagnostic scenarios.

What carries the argument

The schema document: a per-template package holding the event id, template string, natural-language event summary, and for each parameter column its physical name, canonical semantic name, description, and statistical profile. Dual-granularity grounding (template summaries plus vocabulary-anchored parameter labels) makes these documents the retrieval units and the only legal context for constrained SQL generation.

Load-bearing premise

The benchmark questions, largely written by an LLM from sampled log windows and only lightly hand-checked, faithfully represent real operator intent and do not favor systems that reason like the question generator.

What would settle it

An independent set of human SRE queries written without access to the induced schemas yields LogNLQ retrieval F1 and aggregation match rates that fall to the level of the schema-free baselines.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Without first inducing relational structure from log templates, corpus-level aggregation and parameter-role filtering stay unreliable.
  • Semantic labels on positional columns are required for an LLM to map phrases like “source IP” onto the right physical field.
  • Constraining SQL generation to a small retrieved set of grounded schema documents sharply reduces field hallucination.
  • Template-partitioned columnar storage can shrink footprint relative to raw logs while still supporting analytical execution.
  • Cross-template diagnostic queries become tractable once a shared parameter vocabulary aligns columns for UNION or JOIN.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same induce-then-ground pattern could be applied to other semi-structured operational data such as traces or metrics that lack stable human-authored schemas.
  • Because end-to-end latency is dominated by LLM SQL generation, faster or cheaper generators would improve interactive use without changing the schema layer.
  • Human-authored industrial query logs would be a stronger external test of whether the large measured gains transfer beyond LLM-written benchmarks.
  • A stable global parameter vocabulary may eventually support multi-system log federation if services can be grounded into shared role names.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. LogNLQ reformulates natural-language log querying as executable SQL generation over schemas that are first induced from raw logs by parsing and then annotated by dual-granularity semantic grounding (template summaries plus parameter names/descriptions, with a global parameter vocabulary for cross-template consistency). Offline, logs are materialized as template-partitioned columnar tables with statistical profiles; online, FAISS retrieves Top-K schema documents and an LLM generates schema-constrained SQL executed by DuckDB. The authors introduce LogNLQ-Bench (8,895 execution-verified retrieval and aggregation queries on OpenSSH, HDFS, Spark, and BGL, basic and scenario) and report large gains over text QA, Log-DSL, and schema-free Text-to-SQL baselines (Table 2), with ablations arguing that parser-induced structure is an absolute prerequisite and semantic grounding the next major contributor (Figure 8).

Significance. The paper addresses a real gap in observability tooling: raw logs lack an executable schema, so conventional Text-to-SQL and DSL generation fail for parameter-role filtering and corpus-level aggregation. Framing log parsing as execution-oriented schema induction, plus dual-granularity grounding and constrained SQL, is a clear and useful systems contribution. Strengths include an execution-verified (not surface-form) evaluation, a large multi-dataset benchmark, hierarchical ablations, Top-K and multi-backbone sensitivity, and practical storage/latency measurements showing compression relative to raw logs and index backends. If the central claim holds under stronger human validation of the benchmark, the work would be a solid reference for NL interfaces over semi-structured operational data.

major comments (3)
  1. Section 4.1 / construct validity of LogNLQ-Bench: Questions and gold answers are produced by an LLM that, from a sampled raw-log window, jointly invents a diagnostic question and an executable analysis program; only instances with successful non-empty program execution are kept, and only ~2% (200) instances are manually inspected, with no reported human-SRE agreement or ticket-distribution comparison. This selection can systematically retain intents that already admit structured programmatic solutions and under-represent local span/label queries that text QA or Log-DSL handle well. The strong claim that parser-induced structuring is an “absolute prerequisite” (RQ1/RQ3, Table 2, Figure 8) therefore partly rests on a generator that may share inductive biases with the SQL agent. Please add a human-authored or human-rewritten control subset (or inter-annotator study with SREs), report failur
  2. Section 5.3 / Figure 8 ablation design: The “w/o parsing-based structuring” variant is equated with the DIN-SQL baseline over monolithic Content storage rather than ablating structure inside the LogNLQ pipeline (same retrieval/generation stack, only without template partitions and parameter columns). DIN-SQL differs in decomposition, prompting, and schema linking, so the collapse of Aggregation RO-Match to ~0.03 confounds “no structure” with “different system.” A true ablation—e.g., LogNLQ-style generation over a single raw-text table, or over parser tables without semantic index—would isolate the structural claim. Please replace or supplement this variant and restate the hierarchical-dependency conclusion accordingly.
  3. Section 4.2 baseline fairness and Section 5.1 error analysis: Baselines are evaluated under native schema-light assumptions (by design), but the paper does not report whether giving Elasticsearch/Loki/LogQLLM access to the same parser-extracted fields (even without full dual-granularity grounding) would close much of the gap. Without that control, Table 2’s wide margins support “structure helps” more cleanly than “only LogNLQ’s full stack works.” A minimal structured-field baseline (or LogQL/ES over induced columns) would make the contribution of semantic grounding vs. mere field exposure clearer and strengthen the comparison.
minor comments (7)
  1. Front matter still uses ACM placeholder metadata (Conference acronym ’XX, Woodstock, NY, 2018 copyright year). Replace with the target venue’s correct title, year, and rights block.
  2. Section 4.4 cites “LILAC [?]” with an unresolved reference; complete the bibliography entry and ensure all LogHub/parser citations are consistent with Section 6.
  3. Figure 1 panel labels in the text (Text-based QA / Log-DSL / Text-to-SQL) appear swapped relative to the failure modes described in the surrounding paragraphs; align figure callouts with the narrative.
  4. Definition 1 and Section 3.3: clarify whether statistical profiles σ_i are ever used in retrieval embeddings or only at generation time (text says not indexed; ensure the prompt template in the artifact matches).
  5. Table 2: report Precision/Recall alongside F1 for retrieval, and confidence intervals or per-scenario-type breakdowns for the 1,139 scenario queries (Alert/Triage/Mitigation/RCA/Audit/Report) claimed to be nearly uniform.
  6. Section 5.4 acknowledges multi-table join quality as future work; a short quantitative note on how often generated SQL uses UNION/JOIN and its RO-Match would help readers gauge current limits.
  7. Data Availability points to a Zenodo DOI; ensure the camera-ready includes scripts to regenerate Table 2/Figures 8–10 from the released bench for reproducibility.

Circularity Check

1 steps flagged

No definitional or fitted circularity in the method or claims; only minor non-load-bearing self-use of the authors' prior LILAC parsing infrastructure as an implementation substrate.

specific steps
  1. self citation load bearing [Section 4.4 Implementation Details]
    "The offline pipeline is implemented using a custom schema induction component whose streaming template extraction builds on the cache-tree dispatch mechanism of LILAC [?], extended to support execution-oriented relational structuring."

    LILAC is prior work by overlapping authors; the paper uses it as the substrate for the central schema-induction step. This is ordinary self-use of infrastructure rather than a load-bearing uniqueness or derivation claim, so it raises the score only to the minor level (2) and does not force any empirical result.

full rationale

LogNLQ's core chain (parse raw logs into template-partitioned tables, dual-granularity grounding into schema documents, retrieve, constrain LLM SQL, execute, score by F1/RO-Match against independent execution outputs) does not reduce any claimed result to its inputs by construction. The absolute-prerequisite claim for parser-induced structure is an empirical ablation result (Fig. 8 / RQ3) against DIN-SQL and other baselines on LogNLQ-Bench, not a tautology. Benchmark construction (Sec. 4.1) uses an LLM to propose questions and raw-log analysis programs, retaining only successfully executing non-empty cases, then evaluates systems by match to those outputs; this is a validity/selection concern (acknowledged in threats) but not circular derivation, because ground-truth programs operate over raw logs independently of the induced schema and LogNLQ must still produce matching results via SQL. Self-citations to the authors' parsing line (LILAC and related) supply infrastructure only; they are not invoked as uniqueness theorems that force the central claims. No fitted parameters are renamed predictions, no ansatz is smuggled, and no known result is merely renamed. Score 2 reflects only the ordinary, non-load-bearing self-citation of prior tooling.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 3 invented entities

The central claim rests on standard log-parsing regularity, the choice of SQL as the execution target, LLM reliability for naming/retrieval/generation, and a self-built benchmark. Free parameters are mostly engineering knobs (Top-K, sample sizes, model choice). Invented entities are engineering abstractions (schema documents, global parameter vocabulary), not physical postulates; they are operationally defined by the pipeline.

free parameters (3)
  • Top-K schema candidates = 5 (default)
    Default K=5 chosen from sensitivity sweep; performance depends on this retrieval budget (Figure 9).
  • LLM backbone and temperature = doubao-seed-2.0-pro, T=0.0
    Main results fix doubao-seed-2.0-pro at temperature 0.0; RQ3 shows material sensitivity to weaker backbones on scenario queries.
  • Statistical profile top-K frequent values and sampling for grounding
    Profiles and representative instances fed to grounding/generation are design choices that affect predicate construction quality; exact K and sample sizes are implementation details.
axioms (4)
  • domain assumption Raw logs are produced by logging statements and therefore admit recurring templates with typed dynamic parameters that can be mapped to relational tables.
    Stated in Introduction and Section 3.2 as the structural basis for schema induction; fails for fully free-form or highly irregular logs.
  • domain assumption Executable SQL over induced partitions is an adequate and preferable target for analytical NL log queries versus span QA or backend DSLs.
    Core problem reformulation in Sections 1–2; evaluation metrics assume SQL execution semantics.
  • ad hoc to paper LLM-based dual-granularity grounding plus a global parameter vocabulary yields sufficiently consistent semantic names for retrieval and cross-template SQL.
    Section 3.3; no external proof of naming consistency beyond ablation gains.
  • ad hoc to paper Nearest-neighbor retrieval over FAISS-encoded schema documents surfaces the templates needed for correct SQL within small Top-K.
    Section 3.4 and error analysis pattern (4): residual failures are retrieval misses.
invented entities (3)
  • Schema Document D_k no independent evidence
    purpose: Unit of retrieval and grounded prompt context combining physical template structure, summaries, parameter names/descriptions, and stats.
    Definition 1; engineering abstraction defined by the pipeline, not independently measured outside LogNLQ.
  • Global parameter vocabulary G with vocabulary-anchored grounding no independent evidence
    purpose: Enforce cross-template consistent semantic labels for equivalent parameters in different positions.
    Section 3.3; internal consistency mechanism without external gold parameter ontology.
  • LogNLQ-Bench (8,895 execution-verified NL queries) no independent evidence
    purpose: Provide retrieval and aggregation evaluation under basic and scenario settings.
    Section 4.1; new artifact, but largely LLM-synthesized from log windows with limited manual audit.

pith-pipeline@v1.1.0-grok45 · 22569 in / 3469 out tokens · 32358 ms · 2026-07-11T23:15:26.174423+00:00 · methodology

0 comments
read the original abstract

Logs are essential for system monitoring and failure diagnoses in modern software systems, yet querying them through natural language remains an open challenge. Existing approaches either treat logs as plain text, generate queries for schema-light backends, or assume predefined relational schemas, but none addresses a fundamental obstacle: raw logs carry no executable schema over which structured queries can be defined and run. To address these limitations, we present LogNLQ, a framework that formulates natural-language log querying as executable SQL generation over parser-induced and semantically grounded schemas. LogNLQ parses raw logs into template-partitioned relational tables, then applies dual-granularity semantic grounding to annotate both templates and parameter columns with interpretable names and descriptions. At query time, relevant schema candidates are retrieved via semantic search, and a large language model (LLM) generates executable SQL constrained to the retrieved context. To support rigorous evaluation, we introduce LogNLQ-Bench, an execution-verified benchmark of 8,895 queries over four real-world log datasets. Experimental results demonstrate that LogNLQ consistently outperforms all representative baselines by wide margins, with especially pronounced gains on analytically complex scenario queries.

Figures

Figures reproduced from arXiv: 2607.03884 by Jinyang Liu, Juepeng Wang, Zhuangbin Chen, Zibin Zheng.

Figure 1
Figure 1. Figure 1: Motivating Example of NL Log Querying. As illustrated in [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of the LogNLQ Pipeline. importantly, this materialization step turns parser output from a de￾scriptive artifact into an executable database substrate. The induced templates are no longer merely mined patterns; they become the actual relational units over which downstream querying operates. Statistical profiling. While the induced schema provides the structural context that an LLM needs to identify… view at source ↗
Figure 3
Figure 3. Figure 3: End-to-End Walkthrough of LogNLQ. 3.3 Dual-Granularity Semantic Grounding The relational structure induced by parsing is executable, but it is not yet a usable schema for LLM-based query generation. Positional columns such as p_1 and p_2 expose structural boundaries without revealing semantic roles, making the induced database legible to the execution engine but largely opaque to the model. LogNLQ therefor… view at source ↗
Figure 6
Figure 6. Figure 6: LLM API Call Scalability. are registered, then rises sharply and stabilizes once the template vo￾cabulary converges. The cold-start duration tracks template count: HDFS (46 templates) converges quickly while BGL (319 templates) takes longer. After convergence, the two largest datasets sustain throughputs of hundreds of thousands of lines per minute, com￾pleting on a single machine in approximately 30 minut… view at source ↗
Figure 5
Figure 5. Figure 5: Offline Build Throughput. size (log scale) and size relative to raw logs. The key finding is that LogNLQ consistently compresses relative to raw logs, ranging from 33% to 62% of the original size, while Elasticsearch and Loki both expand beyond the raw-log baseline (108%–133%). For example, on HDFS, LogNLQ requires 247 MB, compared with around 1.5 GB for Elasticsearch and 1.3 GB for Loki. This result shows… view at source ↗
Figure 9
Figure 9. Figure 9: Top-𝐾 Sensitivity. 0.7 0.8 0.9 OpenSSH HDFS BGL Spark (a) Basic Queries 0.4 0.6 0.8 OpenSSH HDFS BGL Spark (b) Scenario Queries doubao-seed-2.0-pro (Main) deepseek-v3.2 GLM-4.7 doubao-seed-1.6 F1 Score Track RO-Match Track [PITH_FULL_IMAGE:figures/full_fig_p009_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: LLM Backbone Sensitivity. execution boundaries but cannot be reliably aligned to user intent without interpretable semantic annotations. Finally, removing only parameter-level grounding causes a more targeted degradation (F1 −0.105, RO-Match −0.054), with a proportionally larger impact on aggregation, consistent with the intuition that aggregation tasks require precise column-level alignment for correct g… view at source ↗
Figure 8
Figure 8. Figure 8: Component Analysis on Scenario Queries. The results reveal a clear hierarchical dependency among LogNLQ’s three components. The full system achieves a Retrieval F1 of 0.763 and an Aggregation RO-Match of 0.621. The most striking finding is the near-complete collapse of aggregation when parsing-based structuring is removed. Aggregation RO-Match drops to 0.032 while Retrieval F1 falls to 0.092. This confirms… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

38 extracted references · 3 canonical work pages

  1. [1]

    2016.Site Reliability Engineering: How Google Runs Production Systems(1st ed.)

    Betsy Beyer, Chris Jones, Jennifer Petoff, and Niall Richard Murphy. 2016.Site Reliability Engineering: How Google Runs Production Systems(1st ed.). O’Reilly Media, Inc. Available at https://sre.google/sre-book/

    2016

  2. [2]

    Zhuangbin Chen, Jinyang Liu, Wenwei Gu, Yuxin Su, and Michael R Lyu. 2021. Ex- perience report: Deep learning-based system log analysis for anomaly detection. arXiv preprint arXiv:2107.05908(2021)

    Pith/arXiv arXiv 2021

  3. [3]

    Min Du, Feifei Li, Guineng Zheng, and Vivek Srikumar. 2017. Deeplog: Anomaly detection and diagnosis from system logs through deep learning. InProceedings of the 2017 ACM SIGSAC conference on computer and communications security. 1285–1298

    2017

  4. [4]

    Elastic. 2026. Elasticsearch: The Heart of the Free and Open Elastic Stack. https: //www.elastic.co/elasticsearch/. Accessed: 2026-03-27

    2026

  5. [5]

    2023.LogQL: Log Query Language

    Grafana Labs. 2023.LogQL: Log Query Language. https://grafana.com/docs/loki/ latest/logql/ Accessed: 2026-03-20

    2023

  6. [6]

    Grafana Labs. 2026. Loki: Like Prometheus, but for logs. https://grafana.com/ oss/loki/. Accessed: 2026-03-27

    2026

  7. [7]

    Pinjia He, Zhuangbin Chen, Shilin He, and Michael R. Lyu. 2018. Characterizing the natural language descriptions in software logging statements. InProceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, ASE 2018, Montpellier, France, September 3-7, 2018, Marianne Huchard, Christian Kästner, and Gordon Fraser (Eds.). AC...

    doi:10.1145/3238147.3238193 2018

  8. [8]

    Pinjia He, Jieming Zhu, Zibin Zheng, and Michael R Lyu. 2017. Drain: An online log parsing approach with fixed depth tree. In2017 IEEE international conference on web services (ICWS). IEEE, 33–40

    2017

  9. [9]

    Shilin He, Pinjia He, Zhuangbin Chen, Tianyi Yang, Yuxin Su, and Michael R. Lyu. 2022. A Survey on Automated Log Analysis for Reliability Engineering. ACM Comput. Surv.54, 6 (2022), 130:1–130:37. doi:10.1145/3460345

    doi:10.1145/3460345 2022

  10. [10]

    Shilin He, Xu Zhang, Pinjia He, Yong Xu, Liqun Li, Yu Kang, Minghua Ma, Yining Wei, Yingnong Dang, Saravanakumar Rajmohan, et al. 2022. An empirical study of log analysis at Microsoft. InProceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 1465–1476

    2022

  11. [11]

    Shilin He, Jieming Zhu, Pinjia He, and Michael R Lyu. 2016. Experience re- port: System log analysis for anomaly detection. In2016 IEEE 27th international symposium on software reliability engineering (ISSRE). IEEE, 207–218

    2016

  12. [12]

    Junjie Huang, Zhihan Jiang, Zhuangbin Chen, and Michael R. Lyu. 2025. No More Labelled Examples? An Unsupervised Log Parser with LLMs.Proc. ACM Softw. Eng.2, FSE (2025), 2406–2429. doi:10.1145/3729377

    doi:10.1145/3729377 2025

  13. [13]

    Shaohan Huang, Yi Liu, Carol Fung, Jiaxing Qi, Hailong Yang, and Zhongzhi Luan. 2023. Logqa: Question answering in unstructured logs.arXiv preprint arXiv:2303.11715(2023)

    Pith/arXiv arXiv 2023

  14. [14]

    Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Yejin Bang, Andrea Madotto, and Pascale Fung. 2023. Survey of Hallucination in Natural Language Generation.ACM Comput. Surv.55, 12 (2023), 248:1–248:38. doi:10.1145/3571730

    doi:10.1145/3571730 2023

  15. [15]

    Zhihan Jiang, Jinyang Liu, Zhuangbin Chen, Yichen Li, Junjie Huang, Yintong Huo, Pinjia He, Jiazhen Gu, and Michael R Lyu. 2024. Lilac: Log parsing using llms with adaptive parsing cache.Proceedings of the ACM on Software Engineering 1, FSE (2024), 137–160

    2024

  16. [16]

    Zhihan Jiang, Jinyang Liu, Junjie Huang, Yichen Li, Yintong Huo, Jiazhen Gu, Zhuangbin Chen, Jieming Zhu, and Michael R Lyu. 2024. A large-scale evaluation for log parsing techniques: How far are we?. InProceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis. 223–234

    2024

  17. [17]

    Yichen Li, Jinyang Liu, Junsong Pu, Zhihan Jiang, Zhuangbin Chen, Xiao He, Tieying Zhang, Jianjun Chen, Yi Li, Rui Shi, and Michael R. Lyu. 2025. Automated Proactive Logging Quality Improvement for Large-Scale Codebases. In40th IEEE/ACM International Conference on Automated Software Engineering, ASE 2025, Seoul, Korea, Republic of, November 16-20, 2025. I...

    arXiv 2025

  18. [18]

    Yilun Liu, Shimin Tao, Weibin Meng, Feiyu Yao, Xiaofeng Zhao, and Hao Yang

  19. [19]

    InProceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings, ICSE Companion 2024, Lisbon, Portugal, April 14-20, 2024

    LogPrompt: Prompt Engineering Towards Zero-Shot and Interpretable Log Analysis. InProceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings, ICSE Companion 2024, Lisbon, Portugal, April 14-20, 2024. ACM, 364–365. doi:10.1145/3639478.3643108

    work page doi:10.1145/3639478.3643108 2024

  20. [20]

    Zeyang Ma, Dong Jae Kim, and Tse-Hsun Peter Chen. 2025. LibreLog: Accurate and Efficient Unsupervised Log Parsing Using Open-Source Large Language Models. In47th IEEE/ACM International Conference on Software Engineering, ICSE 2025, Ottawa, ON, Canada, April 26 - May 6, 2025. IEEE, 924–936. doi:10.1109/ ICSE55347.2025.00103

    arXiv 2025

  21. [21]

    Microsoft. 2023. Kusto Query Language (KQL) Overview. https://learn.microsoft. com/en-us/azure/data-explorer/kusto/query/. Accessed: 2026-03-20

    2023

  22. [22]

    Oliner, Archana Ganapathi, and Wei Xu

    Adam J. Oliner, Archana Ganapathi, and Wei Xu. 2012. Advances and challenges in log analysis.Commun. ACM55, 2 (2012), 55–61. doi:10.1145/2076450.2076466

    work page doi:10.1145/2076450.2076466 2012

  23. [23]

    Mohammadreza Pourreza and Davood Rafiei. 2023. Din-sql: Decomposed in- context learning of text-to-sql with self-correction.Advances in neural information processing systems36 (2023), 36339–36348

    2023

  24. [24]

    Jiaxing Qi, Zhongzhi Luan, Shaohan Huang, Carol Fung, and Hailong Yang. 2024. LogSay: An Efficient Comprehension System for Log Numerical Reasoning.IEEE Trans. Comput.73, 7 (2024), 1809–1821

    2024

  25. [25]

    Vishwanath Seshagiri, Siddharth Balyan, Vaastav Anand, Kaustubh Dhole, Ishan Sharma, Avani Wildani, José Cambronero, and Andreas Züfle. 2024. Chatting with logs: An exploratory study on finetuning llms for logql.arXiv preprint arXiv:2412.03612(2024)

    Pith/arXiv arXiv 2024

  26. [26]

    Shiwen Shan, Yintong Huo, Yuxin Su, Yichen Li, Dan Li, and Zibin Zheng. 2024. Face It Yourselves: An LLM-Based Two-Stage Strategy to Localize Configuration Errors via Logs. InProceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2024, Vienna, Austria, September 16-20, 2024, Maria Christakis and Michael Pradel ...

    arXiv 2024

  27. [27]

    Shiwen Shan, Yintong Huo, Hongzhan Zhong, Zhining Wang, Yuxin Su, and Zibin Zheng. 2026. LogFold: Compressing Logs with Structured Tokens and Hybrid Encoding.arXiv preprint arXiv:2603.20618(2026)

    arXiv 2026

  28. [28]

    Xinye Tang, Amir H Abdi, Jeremias Eichelbaum, Mahan Das, Alex Klein, Ni- hal Irmak Pakis, William Blum, Daniel L Mace, Tanvi Raja, Namrata Padmanab- han, et al. 2024. Nl2kql: From natural language to kusto query.arXiv preprint arXiv:2404.02933(2024)

    Pith/arXiv arXiv 2024

  29. [29]

    Jiabo Wang, Guojun Chu, Jingyu Wang, Haifeng Sun, Qi Qi, Yuanyi Wang, Ji Qi, and Jianxin Liao. 2024. LogExpert: Log-based Recommended Resolutions Generation using Large Language Model. InProceedings of the 2024 ACM/IEEE 44th International Conference on Software Engineering: New Ideas and Emerging Results, NIER@ICSE 2024, Lisbon, Portugal, April 14-20, 202...

    arXiv 2024

  30. [30]

    Yilun Wang, Pengfei Chen, Haiyu Huang, Zilong He, Gou Tan, Chuanfu Zhang, Jingkai He, and Zibin Zheng. 2025. InferLog: Accelerating LLM Inference for Online Log Parsing via ICL-oriented Prefix Caching.CoRRabs/2507.08523 (2025). arXiv:2507.08523 doi:10.48550/ARXIV.2507.08523

    doi:10.48550/arxiv.2507.08523 2025

  31. [31]

    Yidan Wang, Zhouruixing Zhu, Qiuai Fu, Yuchi Ma, and Pinjia He. 2024. MRCA: Metric-level Root Cause Analysis for Microservices via Multi-Modal Data. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, ASE 2024, Sacramento, CA, USA, October 27 - November 1, 2024, Vladimir Filkov, Baishakhi Ray, and Minghui Zhou (...

    doi:10.1145/3691620.3695485 2024

  32. [32]

    Pei Xiao, Chiming Duan, Minghua He, Tong Jia, Yifan Wu, Jing Xu, Gege Gao, Lingzhe Zhang, Weijie Hong, Ying Li, and Gang Huang. 2025. CoorLog: Efficient- Generalizable Log Anomaly Detection via Adaptive Coordinator in Software Evolution. In40th IEEE/ACM International Conference on Automated Software Engineering, ASE 2025, Seoul, Korea, Republic of, Novemb...

    doi:10.1109/ase63991.2025.00097 2025

  33. [33]

    Yongzheng Xie, Hongyu Zhang, and Muhammad Ali Babar. 2024. LogSD: De- tecting Anomalies from System Logs through Self-Supervised Learning and Frequency-Based Masking.Proc. ACM Softw. Eng.1, FSE (2024), 2098–2120. doi:10.1145/3660800

    work page doi:10.1145/3660800 2024

  34. [34]

    Junjielong Xu, Ruichun Yang, Yintong Huo, Chengyu Zhang, and Pinjia He. 2024. DivLog: Log Parsing with Prompt Enhanced In-Context Learning. InProceedings of the 46th IEEE/ACM International Conference on Software Engineering, ICSE 2024, Lisbon, Portugal, April 14-20, 2024. ACM, 199:1–199:12. doi:10.1145/3597503. 3639155

    doi:10.1145/3597503 2024

  35. [35]

    Siyu Yu, Yifan Wu, Ying Li, and Pinjia He. 2024. Unlocking the Power of Num- bers: Log Compression via Numeric Token Parsing. InProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, ASE 2024, Sacramento, CA, USA, October 27 - November 1, 2024, Vladimir Filkov, Baishakhi Ray, and Minghui Zhou (Eds.). ACM, 919–930. doi...

    doi:10.1145/3691620.3695474 2024

  36. [36]

    Tao Yu, Rui Zhang, Kai Yang, Michihiro Yasunaga, Dongxu Wang, Zifan Li, James Ma, Irene Li, Qingning Yao, Shanelle Roman, et al. 2018. Spider: A large-scale human-labeled dataset for complex and cross-domain semantic parsing and text- to-sql task. InProceedings of the 2018 conference on empirical methods in natural language processing. 3911–3921

    2018

  37. [37]

    Ding Yuan, Soyeon Park, and Yuanyuan Zhou. 2012. Characterizing logging practices in open-source software. In34th International Conference on Software Engineering, ICSE 2012, June 2-9, 2012, Zurich, Switzerland, Martin Glinz, Gail C. Murphy, and Mauro Pezzè (Eds.). IEEE Computer Society, 102–112. doi:10.1109/ ICSE.2012.6227202

    arXiv 2012

  38. [38]

    Chenbo Zhang, Wenying Xu, Jinbu Liu, Lu Zhang, Guiyang Liu, Jihong Guan, Qi Zhou, and Shuigeng Zhou. 2025. LogBase: A Large-Scale Benchmark for Semantic Log Parsing.Proc. ACM Softw. Eng.2, ISSTA (2025), 2091–2112. doi:10. 1145/3728969

    2025