Restrictions on matching mode

[logpai]

Restrictions on matching mode

[davidohana]

Hi Boris,
So indeed, Drain uses word count at the root of the search tree, so a user name with multiple words will generate a new template.
I think that the suggestions you had are pretty fundamental and should be thoroughly tested before being integrated into Drain3.
Other simper options you might consider:
(1) Use regex masking if possible, to pre-mask usernames into a single token before Drain.
(2) Consolidate multiple sequential <*> into one . This can be an opt-in feature we can add to Drain3.

David

[Boris-2021]

Hi Boris, So indeed, Drain uses word count at the root of the search tree, so a user name with multiple words will generate a new template. I think that the suggestions you had are pretty fundamental and should be thoroughly tested before being integrated into Drain3. Other simper options you might consider: (1) Use regex masking if possible, to pre-mask usernames into a single token before Drain. (2) Consolidate multiple sequential <*> into one . This can be an opt-in feature we can add to Drain3.

David

Thank you for you advise

Boris