Why it matters
Logs repeat themselves. A busy service writes the same few dozen messages over and over with different IDs, times and numbers, so reading the raw file hides what's actually happening. Grouping lines into templates shows the shape: which messages dominate, which errors recur and which lines appear only once.
This miner uses Drain, a fixed-depth parse tree that groups lines by their length and first words, then by how many words match. Parts that differ become <*>. Masking first turns numbers, IPs and IDs into placeholders, so lines that only differ in those join the same pattern. It runs in your browser, so production logs stay on your machine.
How to use it
- Paste log lines or choose a log file.
- Pick which values to mask and adjust the similarity if needed.
- Read the patterns, most common first, and the rare and error ones in the notes.
- Export the patterns as CSV.
FAQ
What is the Drain algorithm?
A log parsing method by Pinjia He and others (ICWS 2017) that groups lines with a fixed-depth tree: first by how many words they have, then by their leading words, then by word-by-word similarity. It's fast and is used by tools such as drain3 and logparser.
What does the similarity setting do?
A line joins a pattern when at least that share of its words match the pattern's fixed words. The default of 0.4 is drain3's. Raise it to split patterns, lower it to merge them.
Why mask values first?
Lines that only differ in numbers or IDs belong together. Masking replaces them with <NUM>, <IP> and so on, so Drain groups them even when the varying value is one of the leading words.
Are my logs uploaded?
No. The file is read and mined in your browser.
