Modify templates and reload clusters into TemplateMiner?

[logpai]

Modify templates and reload clusters into TemplateMiner?

[davidohana]

If you manually edit templates, there might be inconsistency with the prefix tree, and results of further parsing calls may produce unpredicted results.

[KemptCode]

Got it...
I don't think I'd need to add templates after that point in my project.
What if I'm mostly trying to rid the templates of specific information?

e.g.
User="TheBoogieMan"
To become
User="<*>"

In this instance, I only have data for one user, but I would like it to apply to any user.

And, I'd like to use the .match() method provided (or something similar) to identify what category it would fit in or find if we've seen anything like it previously. I'm trying to identify rare events.

A friend suggested using .get_parameter_list() to compare each until we found the parameters. The time it takes isn't ideal but it works (with the exception of templates without masking). I take it that the speed of the .match() method is attributed to this tree you speak of? I see it relies on tree_search.

Any tips?

[KemptCode]

Thinking about it, perhaps I could create artificial data to condition the templates?

[davidohana]

The match function indeed uses the prefix tree and that's why it fast. If you change log clusters without adjusting the prefix tree it might not work properly. I agree that the "safest" thing can be artificially injecting logs to teach Drain to generalize stuff. For example:

User="dummy"

In the case you shown.

[KemptCode]

Thank you