LogNLQ: Natural-Language Log Querying with Parser-Induced and Semantically Grounded Schemas

2026-07-04

AI Summary

Natural language log querying remains challenging due to the absence of structured schemas, hindering accurate SQL generation. This work proposes a novel approach that first parses raw logs into templated relational tables and then enriches both templates and parameter columns with interpretable semantics through dual-granularity semantic grounding. By integrating semantic search with constrained decoding in large language models, the method generates context-aware, executable SQL queries. The study introduces the first semantically grounded log schema and releases LogNLQ-Bench, the inaugural benchmark for natural language log querying featuring execution-based validation. Experimental results demonstrate that the proposed method significantly outperforms existing techniques on LogNLQ-Bench, particularly excelling in complex analytical queries.

Abstract

Logs are essential for system monitoring and failure diagnoses in modern software systems, yet querying them through natural language remains an open challenge. Existing approaches either treat logs as plain text, generate queries for schema-light backends, or assume predefined relational schemas, but none addresses a fundamental obstacle: raw logs carry no executable schema over which structured queries can be defined and run. To address these limitations, we present LogNLQ, a framework that formulates natural-language log querying as executable SQL generation over parser-induced and semantically grounded schemas. LogNLQ parses raw logs into template-partitioned relational tables, then applies dual-granularity semantic grounding to annotate both templates and parameter columns with interpretable names and descriptions. At query time, relevant schema candidates are retrieved via semantic search, and a large language model (LLM) generates executable SQL constrained to the retrieved context. To support rigorous evaluation, we introduce LogNLQ-Bench, an execution-verified benchmark of 8,895 queries over four real-world log datasets. Experimental results demonstrate that LogNLQ consistently outperforms all representative baselines by wide margins, with especially pronounced gains on analytically complex scenario queries.

Problem

• natural-language log querying
• executable schema
• log parsing
• structured query
• semantic grounding

Innovation

• natural-language log querying
• parser-induced schema
• semantic grounding
• executable SQL generation
• log parsing