Logs are an essential source of information for people to understand the
running status of a software system. Due to the evolving modern software
architecture and maintenance methods, more research efforts have been devoted
to automated log analysis. In particular, machine learning (ML) has been widely
used in log analysis tasks. In ML-based log analysis tasks, converting textual
log data into numerical feature vectors is a critical and indispensable step.
However, the impact of using different log representation techniques on the
performance of the downstream models is not clear, which limits researchers and
practitioners' opportunities of choosing the optimal log representation
techniques in their automated log analysis workflows. Therefore, this work
investigates and compares the commonly adopted log representation techniques
from previous log analysis research. Particularly, we select six log
representation techniques and evaluate them with seven ML models and four
public log datasets (i.e., HDFS, BGL, Spirit and Thunderbird) in the context of
log-based anomaly detection. We also examine the impacts of the log parsing
process and the different feature aggregation approaches when they are employed
with log representation techniques. From the experiments, we provide some
heuristic guidelines for future researchers and developers to follow when
designing an automated log analysis workflow. We believe our comprehensive
comparison of log representation techniques can help researchers and
practitioners better understand the characteristics of different log
representation techniques and provide them with guidance for selecting the most
suitable ones for their ML-based log analysis workflow.

通过对以往日志分析研究所采用的常见日志表示技术进行研究和比较，本文选择了六种日志表示技术，并结合七种机器学习模型和四个公共日志数据集，在基于日志的异常检测背景下进行评估，同时分析了日志解析过程和不同特征聚合方法的影响，从而为未来研究人员和开发者在设计自动化日志分析工作流程时提供一些启发性指南，以更好地理解不同日志表示技术的特点，并指导选择最合适的技术进行基于机器学习的日志分析工作流程。