Drain3 does not extract text patterns?

[logpai]

Drain3 does not extract text patterns?

[davidohana]

Hello,

This question is better asked at the original Drain repo: https://github.com/logpai/logparser/issues
However, I can tell from my experience that:

• Simple and well-defined constructs like IP are better masked with regex before passing to Drain (use masking feature of drain3 for that)
• Drain might have difficulties with multiple-words variables like cmd. You might try to mask those too.
• The user variable ion your example should be de-templated without a problem.

[vikramriyer]

Thanks for answering and pointing me to the original repo, David. However, just a follow-up, I did not quite grasp what you meant by multuple-words variables.

[davidohana]

I meant variables that can hold multiple words, or a sentence, like cmd in your example

[vikramriyer]

Awesome, thanks. So should I assume that the pattern for the word user was correctly identified because it's an English dictionary valid word?

[davidohana]

No, no relation to a dictionary, just because it's a single word.

[vikramriyer]

Got it! Thanks for patiently answering David.