{"id":{"repo_id":"queens","oai_identifier":"oai:queensu.scholaris.ca:1974/36138"},"canonical_url":"https://search.dev.ndltd.org/etd/queens/oai:queensu.scholaris.ca:1974/36138","repository":{"repo_id":"queens","name":"Queens University","base_url":"https://qspace.library.queensu.ca/server/oai/request"},"display":{"title":"DeepParse: Hybrid LLM-Guided Pattern Mining for Accurate and Reproducible Log Parsing","abstract":"Modern distributed systems produce massive, heterogeneous logs essential for reliability, security, and anomaly detection. Converting these free-form messages into structured templates and extracting variable fields, known as log parsing, is challenging due to evolving formats and limited labelled data. ML-based parsers like Drain are fast but brittle, while Large Language Models (LLMs) offer better generalization at high computational cost. This thesis presents DeepParse, a hybrid LLM-guided framework that automatically mines reusable variable patterns from small log samples and applies them deterministically through the Drain algorithm. By separating the LLMs reasoning phase from runtime parsing, DeepParse enables scalable, consistent, and cost-efficient log structuring without handcrafted rules or per-line LLMs inference. Across 16 benchmark datasets, DeepParse achieves higher accuracy in variable extraction and better clustering consistency, outperforming both heuristic and LLM-only baselines. Integrating DeepParse into LogBERT reduces false alarms by over 30% and improves throughput by 35% while cutting energy use by 78%. DeepParse demonstrates that combining LLM-guided pattern mining with deterministic execution yields an efficient and transparent foundation for intelligent observability systems.","abstract_html":"Modern distributed systems produce massive, heterogeneous logs essential for reliability, security, and anomaly detection. Converting these free-form messages into structured templates and extracting variable fields, known as log parsing, is challenging due to evolving formats and limited labelled data. ML-based parsers like Drain are fast but brittle, while Large Language Models (LLMs) offer better generalization at high computational cost. This thesis presents DeepParse, a hybrid LLM-guided framework that automatically mines reusable variable patterns from small log samples and applies them deterministically through the Drain algorithm. By separating the LLMs reasoning phase from runtime parsing, DeepParse enables scalable, consistent, and cost-efficient log structuring without handcrafted rules or per-line LLMs inference. Across 16 benchmark datasets, DeepParse achieves higher accuracy in variable extraction and better clustering consistency, outperforming both heuristic and LLM-only baselines. Integrating DeepParse into LogBERT reduces false alarms by over 30% and improves throughput by 35% while cutting energy use by 78%. DeepParse demonstrates that combining LLM-guided pattern mining with deterministic execution yields an efficient and transparent foundation for intelligent observability systems.","abstract_has_math":false,"creators":["Shetaia, Amir"],"institution":null,"degree_name":null,"degree_level":null,"degree_discipline":null,"degree_department":"Electrical and Computer Engineering","school":null,"contributors":[],"advisors":["Kauffman, Sean"],"committee_chairs":[],"committee_members":[],"year":2026,"date_issued":"2026-03-05","date_published":"2026-03-05","updated_at":"2026-07-27T20:35:33Z","subjects":["DeepParse","Drain","Log Parsing","Pattern Mining","DeepSeek","Large Language Models"],"languages":["eng"],"rights":["Attribution 4.0 International"],"rights_urls":["https://creativecommons.org/licenses/by/4.0/"],"identifier_entries":[]},"links":{"outbound_url":"https://hdl.handle.net/1974/36138","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.department","label":"Department","values":["Electrical and Computer Engineering"]},{"key":"dc:contributor.supervisor","label":"Supervisor","values":["Kauffman, Sean"]},{"key":"dc:creator","label":"Author","values":["Shetaia, Amir"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2026-03-05T18:32:23Z"]},{"key":"dc:date.issued","label":"Date","values":["2026-03-05"]},{"key":"dc:type","label":"Dc Type","values":["thesis"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["DeepParse","Drain","Log Parsing","Pattern Mining","DeepSeek","Large Language Models"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language.iso","label":"Language (ISO)","values":["eng"]},{"key":"dc:rights","label":"Dc Rights","values":["Attribution 4.0 International"]},{"key":"dc:rights.uri","label":"Rights URI","values":["https://creativecommons.org/licenses/by/4.0/"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://hdl.handle.net/1974/36138"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["Modern distributed systems produce massive, heterogeneous logs essential for reliability, security, and anomaly detection. Converting these free-form messages into structured templates and extracting variable fields, known as log parsing, is challenging due to evolving formats and limited labelled data. ML-based parsers like Drain are fast but brittle, while Large Language Models (LLMs) offer better generalization at high computational cost. This thesis presents DeepParse, a hybrid LLM-guided framework that automatically mines reusable variable patterns from small log samples and applies them deterministically through the Drain algorithm. By separating the LLMs reasoning phase from runtime parsing, DeepParse enables scalable, consistent, and cost-efficient log structuring without handcrafted rules or per-line LLMs inference. Across 16 benchmark datasets, DeepParse achieves higher accuracy in variable extraction and better clustering consistency, outperforming both heuristic and LLM-only baselines. Integrating DeepParse into LogBERT reduces false alarms by over 30% and improves throughput by 35% while cutting energy use by 78%. DeepParse demonstrates that combining LLM-guided pattern mining with deterministic execution yields an efficient and transparent foundation for intelligent observability systems."]},{"key":"dc:description.degree","label":"Dc Description Degree","values":["M.A.Sc."]},{"key":"dc:title","label":"Title","values":["DeepParse: Hybrid LLM-Guided Pattern Mining for Accurate and Reproducible Log Parsing"]}]}],"canonical_facts":{"dc:contributor.department":["Electrical and Computer Engineering"],"dc:contributor.supervisor":["Kauffman, Sean"],"dc:creator":["Shetaia, Amir"],"dc:date.accessioned":["2026-03-05T18:32:23Z"],"dc:date.issued":["2026-03-05"],"dc:description.abstract":["Modern distributed systems produce massive, heterogeneous logs essential for reliability, security, and anomaly detection. Converting these free-form messages into structured templates and extracting variable fields, known as log parsing, is challenging due to evolving formats and limited labelled data. ML-based parsers like Drain are fast but brittle, while Large Language Models (LLMs) offer better generalization at high computational cost. This thesis presents DeepParse, a hybrid LLM-guided framework that automatically mines reusable variable patterns from small log samples and applies them deterministically through the Drain algorithm. By separating the LLMs reasoning phase from runtime parsing, DeepParse enables scalable, consistent, and cost-efficient log structuring without handcrafted rules or per-line LLMs inference. Across 16 benchmark datasets, DeepParse achieves higher accuracy in variable extraction and better clustering consistency, outperforming both heuristic and LLM-only baselines. Integrating DeepParse into LogBERT reduces false alarms by over 30% and improves throughput by 35% while cutting energy use by 78%. DeepParse demonstrates that combining LLM-guided pattern mining with deterministic execution yields an efficient and transparent foundation for intelligent observability systems."],"dc:description.degree":["M.A.Sc."],"dc:identifier.uri":["https://hdl.handle.net/1974/36138"],"dc:language.iso":["eng"],"dc:rights":["Attribution 4.0 International"],"dc:rights.uri":["https://creativecommons.org/licenses/by/4.0/"],"dc:subject":["DeepParse","Drain","Log Parsing","Pattern Mining","DeepSeek","Large Language Models"],"dc:title":["DeepParse: Hybrid LLM-Guided Pattern Mining for Accurate and Reproducible Log Parsing"],"dc:type":["thesis"]},"updated_at":"2026-07-27T20:35:33Z"}