Skip to content

Machine Learning Overview

LogSys uses ML to assign priorities (P1–P4) to log templates rather than to every raw message — a 1000× efficiency win. The pipeline runs a compact RoBERTa sequence classifier in-process, backed by a multi-layer cache and a deterministic rule fallback.

Why Template-Level Classification?

Approach Inferences Feasibility
Per-message classification ~2,000 events/sec Expensive, wasteful
Per-template classification Only new templates O(unique templates), ~1000× fewer calls

Because Drain3 groups semantically identical messages into templates, ML only runs once per unique template; every subsequent event of that template reads the cached priority.

ML Pipeline Stages

flowchart LR
  RAW[Raw message] --> D[Drain3 Parser]
  D -->|template_id| T[Template Cache]
  T -->|CACHE HIT| FAST[Priority from cache<br/><1ms]
  T -->|CACHE MISS| M[RoBERTa Classifier]
  M -->|prediction| T2[Persist to template_priority]
  T2 --> T
  M -->|failure| R[Rule fallback<br/>severity → priority]
  1. Parse — Drain3 maps message → template_id
  2. Cache lookup — L1 dict (RAM) → L2 Redis → L3 PostgreSQL (all loaded in memory at startup)
  3. Classify (miss only) — RoBERTa predicts P1–P4 with confidence
  4. Persist — prediction written to template_priority (source of truth) + Redis
  5. Fallback — if ML errors, deterministic severity_rank → priority map applies

Model

Property Value
Architecture AutoModelForSequenceClassification (RoBERTa)
Labels P1, P2, P3, P4
Max length 512 tokens (truncated)
Inference CPU-friendly, torch.no_grad()
Model path /app/model/log_priority_roberta (mounted in container)
Default version roberta_v1.1

Confidence & Source Tracking

Every priority is recorded with provenance:

Field Values
priority_source ml (model), rule (fallback), manual (human override)
priority_confidence Model softmax confidence, 1.0 for rules/manual
model_version Which model produced it

This provenance powers the Labeling Pipeline and human correction workflows.

Performance Budget

Stage Latency
Drain3 parse ~1 ms
Cache hit (RAM dict) ~0 ms
Redis hit < 1 ms
RoBERTa inference (miss) ~2 ms
Rule fallback ~0 ms

Because classification is per-template and cached, ~99% of events never touch the model.

Components

Doc Covers
Drain3 Parser Log template mining with state persistence
RoBERTa Classifier Sequence classification details
Priority System P1–P4 semantics + rule fallback
Labeling Pipeline Training-data feedback loop
Template Cache L1/L2/L3 caching layers