{"categories":[{"label":"Libraries","url":"https://skillfed.io/packages/category/software-development-libraries/5"}],"enrichment":{"capability":"Drain3 extracts recurring patterns (templates) from streams of log messages, grouping similar logs and identifying variable parts with configurable masking rules.","skillfed_tags":["log-analysis","pattern-mining","streaming"],"use_cases":["Reduce log volume by grouping similar messages into templates before storage or alerting.","Extract structured fields (IPs, user IDs, error codes) from free-text logs for downstream analysis.","Detect anomalies by identifying when a log message does not match any known template.","Monitor for network or system outages by tracking changes in template frequency or emergence of new templates.","Build a baseline of normal log patterns, then flag deviations as potential security or operational incidents."],"what_it_does":"Drain3 is an online log template miner that continuously learns from a stream of raw log messages and groups them into clusters based on structural similarity. It uses a fixed-depth parse tree to efficiently guide the search process, avoiding the deep, unbalanced trees that plague naive clustering approaches. The core idea is to extract recurring patterns\u2014templates\u2014from logs by identifying which parts vary and which are constant, then replace variable portions with configurable masks (e.g., IP addresses become <:IP:>, integers become <:NUM:>).\n\nThe package supports both training and inference modes, persistence to file, Redis, or Kafka, and parameter extraction\u2014pulling out the actual values that matched each variable slot in a template. It is designed for use in log aggregation, anomaly detection, and operational intelligence pipelines where you need to reduce noise and identify structural patterns in unstructured log data.","worth_installing":"Yes, if you need online log template mining and can tolerate dormant maintenance. The package is stable, has no known vulnerabilities, and solves a real problem in log analysis pipelines. However, do not expect active support or updates\u2014treat it as a mature, feature-complete tool rather than an actively developed library. High install friction (source-only) is a minor friction point but not a blocker for most environments."},"id":"drain3","links":{"html":"https://skillfed.io/packages/drain3","md":"https://skillfed.io/packages/drain3.md","pypi":"https://pypi.org/project/drain3/"},"maintenance":{"status":"dormant"},"meta":{"latest_release":"2022-07-17","license_spdx":null,"license_treatment":"permissive","name":"drain3","python_support":"unspecified","summary":"Persistent & streaming log template miner"},"popularity":{"monthly_downloads":556376,"position":6021,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.9.11"}