🤖 AI Summary
This work addresses the challenge of enabling low-cost natural language question answering over massive log streams in resource-constrained, self-hosted environments. The authors propose an end-to-end system featuring a training-free, two-tier cost-aware routing mechanism that dynamically selects one of four execution paths based on a keyword vocabulary. Within the semantic path, the system adaptively invokes either a 14B or 32B large language model and leverages a specialized Coder model to generate SQL queries. The architecture integrates PySpark with Drain3 for log parsing, GPU-accelerated embeddings, and dual-index storage using Apache Druid and PostgreSQL/pgvector. Evaluated on four LogHub datasets, the system achieves an average accuracy of 88.4% (reaching 94.7% on Linux logs), with an end-to-end latency of 18.6 seconds—55% lower than a fixed 32B baseline—and demonstrates significantly higher RAGAS Faithfulness compared to a fixed 14B baseline.
📝 Abstract
Production log analytics in self-hosted, resource-constrained environments requires natural-language access to massive log streams without the cost of routing every query through a large language model. We present LogRouter, an end-to-end log question-answering system deployed on TUBITAK BILGEM's national big data platform that combines a PySpark-based Drain3 ingestion pipeline, GPU-accelerated embeddings, and dual-index storage in Apache Druid and PostgreSQL with pgvector. A two-level cost-aware router dispatches each query along one of four execution paths: direct response, Druid keyword search, template lookup with SQL generation, and pgvector semantic retrieval, while a Level-2 router selects either a 14B-class or 32B-class generator for the semantic path. A dedicated coder LLM handles text-to-SQL generation. We evaluate the system on four LogHub datasets (Linux, Apache, Windows, and Mac; 70 questions in total) under both an online full-pipeline configuration and an offline configuration that isolates the generator. The router reaches 88.4% mean accuracy across datasets and 94.7% on Linux, while the full pipeline attains a mean ROUGE-1 of 0.373, BERTScore of 0.879, RAGAS Faithfulness of 0.779, and an end-to-end latency of 18.6 s. In an apples-to-apples offline comparison, the routed system reduces mean latency by 55% versus a Fixed-32B baseline (46.3 s vs. 102.1 s) while preserving Answer Correctness within 5.8 points and exceeding a Fixed-14B baseline on RAGAS Faithfulness across every dataset. Cost-aware dispatching is therefore a practical mechanism for production log QA: routing recovers most of the quality of an always-32B configuration at less than half the latency, and the L1 keyword vocabulary makes that routing decision with high precision without a learned classifier.