EVALUATING ONLINE LOG PARSERS FOR KUBERNETES LOGS

Sammanfattning

System logs are widely used to evaluate and investigate system behavior through log mining and log analysis. Log parsing is an important pre-processing step that converts unstructured log lines into structured data templates that are used as input to log mining and log analysis tools. Many studies propose new log parsers and new algorithms for log parsing. However, to the best of our knowledge, no previous study applies these log-parsers to Kubernetes based datasets. There is also a lack of studies applying these parsers to real industry practices. In this thesis we apply six state-of-the-art log parsers on openly available benchmarking datasets and one industry based Kubernetes dataset. Our results highlight one challenge for log parsers in practice: metadata heavy key-value pairs. Current parsers performs sub-optimally since they do not consider various key-value pairs when tokenizing log messages. In this thesis we propose an optimization step to the best performing parser, improving its ability to parse log lines containing key-value pairs, trying to improve the overall accuracy of the Kubernetes dataset. We evaluate the effectiveness of our optimization on 16 public datasets and our own Kubernetes dataset. The results show that our optimization improves the performance for the parsers on roughly half of all datasets containing key-value pairs. We finally conclude our observations and state possible and more sophisticated improvements for key-value pair optimization for future log parsers.