DeepParse: Hybrid LLM-Guided Pattern Mining for Accurate and Reproducible Log Parsing

Modern distributed systems produce massive, heterogeneous logs essential for reliability, security, and anomaly detection. Converting these free-form messages into structured templates and extracting variable fields, known as log parsing, is challenging due to evolving formats and limited labelled data. ML-based parsers like Drain are fast but brittle, while Large Language Models (LLMs) offer better generalization at high computational cost. This thesis presents DeepParse, a hybrid LLM-guided framework that automatically mines reusable variable patterns from small log samples and applies them deterministically through the Drain algorithm. By separating the LLMs reasoning phase from runtime parsing, DeepParse enables scalable, consistent, and cost-efficient log structuring without handcrafted rules or per-line LLMs inference. Across 16 benchmark datasets, DeepParse achieves higher accuracy in variable extraction and better clustering consistency, outperforming both heuristic and LLM-only baselines. Integrating DeepParse into LogBERT reduces false alarms by over 30% and improves throughput by 35% while cutting energy use by 78%. DeepParse demonstrates that combining LLM-guided pattern mining with deterministic execution yields an efficient and transparent foundation for intelligent observability systems.

Department dc:contributor.department

Electrical and Computer Engineering

Year dc:date.issued

2026

Author dc:creator

• Shetaia, Amir

Advisor dc:contributor.supervisor

• Kauffman, Sean

• DeepParse
• Drain
• Log Parsing
• Pattern Mining
• DeepSeek
• Large Language Models

Statement dc:rights

• Attribution 4.0 International

Licence dc:rights.uri

• https://creativecommons.org/licenses/by/4.0/

Language dc:language.iso

eng

Handle dc:identifier.uri

https://hdl.handle.net/1974/36138

OAI identifier oai:identifier

oai:queensu.scholaris.ca:1974/36138