  Log parsing, which involves log template extraction from semi-structured logs
to produce structured logs, is the first and the most critical step in
automated log analysis. However, current log parsers suffer from limited
effectiveness for two reasons. First, traditional data-driven log parsers
solely rely on heuristics or handcrafted features designed by domain experts,
which may not consistently perform well on logs from diverse systems. Second,
existing supervised log parsers require model tuning, which is often limited to
fixed training samples and causes sub-optimal performance across the entire log
source. To address this limitation, we propose DivLog, an effective log parsing
framework based on the in-context learning (ICL) ability of large language
models (LLMs). Specifically, before log parsing, DivLog samples a small amount
of offline logs as candidates by maximizing their diversity. Then, during log
parsing, DivLog selects five appropriate labeled candidates as examples for
each target log and constructs them into a prompt. By mining the semantics of
examples in the prompt, DivLog generates a target log template in a
training-free manner. In addition, we design a straightforward yet effective
prompt format to extract the output and enhance the quality of the generated
log templates. We conducted experiments on 16 widely-used public datasets. The
results show that DivLog achieves (1) 98.1% Parsing Accuracy, (2) 92.1%
Precision Template Accuracy, and (3) 92.9% Recall Template Accuracy on average,
exhibiting state-of-the-art performance.
