drain3

What it is and what it does

Drain3 is an online log template miner that continuously learns from a stream of raw log messages and groups them into clusters based on structural similarity. It uses a fixed-depth parse tree to efficiently guide the search process, avoiding the deep, unbalanced trees that plague naive clustering approaches. The core idea is to extract recurring patterns—templates—from logs by identifying which parts vary and which are constant, then replace variable portions with configurable masks (e.g., IP addresses become <:IP:>, integers become <:NUM:>).

The package supports both training and inference modes, persistence to file, Redis, or Kafka, and parameter extraction—pulling out the actual values that matched each variable slot in a template. It is designed for use in log aggregation, anomaly detection, and operational intelligence pipelines where you need to reduce noise and identify structural patterns in unstructured log data.

Use it for:

• Reduce log volume by grouping similar messages into templates before storage or alerting.
• Extract structured fields (IPs, user IDs, error codes) from free-text logs for downstream analysis.
• Detect anomalies by identifying when a log message does not match any known template.
• Monitor for network or system outages by tracking changes in template frequency or emergence of new templates.
• Build a baseline of normal log patterns, then flag deviations as potential security or operational incidents.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Drain3 extracts recurring patterns (templates) from streams of log messages, grouping similar logs and identifying variable parts with configurable masking rules.

Yes, if you need online log template mining and can tolerate dormant maintenance. The package is stable, has no known vulnerabilities, and solves a real problem in log analysis pipelines. However, do not expect active support or updates—treat it as a mature, feature-complete tool rather than an actively developed library. High install friction (source-only) is a minor friction point but not a blocker for most environments.

Install

drain3 on PyPI

pip install drain3

uv add drain3

poetry add drain3

Installing drain3

Before you install

High install friction due to source distribution only. Maintenance is dormant—last release was 2022-07-17 and no commits since 2025-02-04, so expect no active bug fixes or feature updates.

License in practice

MIT license is permissive; you may use, modify, and distribute this package freely in commercial or private projects with minimal restrictions.

Quickstart

pip install drain3

from drain3 import TemplateMiner
miner = TemplateMiner()
result = miner.add_log_message('user alice logged in')
print(result['template_mined'])

Requires Python 3.6 or later; no external runtime dependencies, but source-only distribution may require a C compiler on some platforms.

Verify before relying

• Performance characteristics (throughput, latency) on typical log volumes and message sizes.
• Memory consumption and scalability limits when handling very large numbers of distinct templates.
• Compatibility with Python versions beyond 3.7 (classifiers list 3.6 and 3.7 only).

Package facts

Evidence: drain3-0.9.11.tar.gz

Keywords: drain, log, parser, IBM, template, logs, miner

Tags

More Libraries packages