drain3
Persistent & streaming log template miner
Decision gist · record as of 2026-08-14
Yes, if you need online log template mining and can tolerate dormant maintenance. The package is stable, has no known vulnerabilities, and solves a real problem in log analysis pipelines. However, do not expect active support or updates—treat it as a mature, feature-complete tool rather than an actively developed library. High install friction (source-only) is a minor friction point but not a blocker for most environments.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.6 or later; no external runtime dependencies, but source-only distribution may require a C compiler on some platforms.
- High install friction due to source distribution only.
- Maintenance is dormant—last release was 2022-07-17 and no commits since 2025-02-04, so expect no active bug fixes or feature updates.
License · maintenance · safety
MIT (permissive) — MIT license is permissive; you may use, modify, and distribute this package freely in commercial or private projects with minimal restrictions.
last release 2022-07-17 (1489 days) · last repo commit 2025-02-04 · 856 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 556,376 downloads/mo, #6,021 on PyPI
Alternatives
Verify before relying
pip install drain3
from drain3 import TemplateMiner
miner = TemplateMiner()
result = miner.add_log_message('user alice logged in')
print(result['template_mined'])- Performance characteristics (throughput, latency) on typical log volumes and message sizes.
- Memory consumption and scalability limits when handling very large numbers of distinct templates.
- Compatibility with Python versions beyond 3.7 (classifiers list 3.6 and 3.7 only).
What it is and what it does
Drain3 is an online log template miner that continuously learns from a stream of raw log messages and groups them into clusters based on structural similarity. It uses a fixed-depth parse tree to efficiently guide the search process, avoiding the deep, unbalanced trees that plague naive clustering approaches. The core idea is to extract recurring patterns—templates—from logs by identifying which parts vary and which are constant, then replace variable portions with configurable masks (e.g., IP addresses become <:IP:>, integers become <:NUM:>).
The package supports both training and inference modes, persistence to file, Redis, or Kafka, and parameter extraction—pulling out the actual values that matched each variable slot in a template. It is designed for use in log aggregation, anomaly detection, and operational intelligence pipelines where you need to reduce noise and identify structural patterns in unstructured log data.
Use it for
- Reduce log volume by grouping similar messages into templates before storage or alerting.
- Extract structured fields (IPs, user IDs, error codes) from free-text logs for downstream analysis.
- Detect anomalies by identifying when a log message does not match any known template.
- Monitor for network or system outages by tracking changes in template frequency or emergence of new templates.
- Build a baseline of normal log patterns, then flag deviations as potential security or operational incidents.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need online log template mining and can tolerate dormant maintenance.
The package is stable, has no known vulnerabilities, and solves a real problem in log analysis pipelines. However, do not expect active support or updates—treat it as a mature, feature-complete tool rather than an actively developed library. High install friction (source-only) is a minor friction point but not a blocker for most environments.
Install
drain3 on PyPI
Before you install
High install friction due to source distribution only. Maintenance is dormant—last release was 2022-07-17 and no commits since 2025-02-04, so expect no active bug fixes or feature updates.
Requires Python 3.6 or later; no external runtime dependencies, but source-only distribution may require a C compiler on some platforms.
License in practice
MIT license is permissive; you may use, modify, and distribute this package freely in commercial or private projects with minimal restrictions.
Quickstart
pip install drain3
from drain3 import TemplateMiner
miner = TemplateMiner()
result = miner.add_log_message('user alice logged in')
print(result['template_mined'])Verify before relying
- Performance characteristics (throughput, latency) on typical log volumes and message sizes.
- Memory consumption and scalability limits when handling very large numbers of distinct templates.
- Compatibility with Python versions beyond 3.7 (classifiers list 3.6 and 3.7 only).
Package facts
| License | MIT permissive |
| Python support | Not specified |
| Install friction | High. Source build required |
| Runtime dependencies | None |
| Maintenance | Dormant 1,489 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 556,376 / month, #6,021 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | License :: OSI Approved :: MIT LicenseOperating System :: OS IndependentProgramming Language :: Python :: 3.6Programming Language :: Python :: 3.7Topic :: Software Development :: Libraries |
Evidence: drain3-0.9.11.tar.gz
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “log template mining”
- drain3Drain3 extracts recurring patterns (templates) from streams of log…
- pm4pyPM4Py implements process mining algorithms to discover, analyze, and…
- PyDrillerPyDriller extracts commit history, developer metadata, modified…
Give your agent the search over MCP, or paste the wish link into any chat.
More Libraries packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
Pluggy provides a plugin system that lets you define hook specifications and register implementations to be called in sequence, enabling extensible Python applications without tight coupling.
Install it if you're building an extensible application or framework.
Provides parsing, arithmetic, and recurrence rule computation for dates and times, with timezone support and iCalendar RFC compliance.
Install it if you need to parse flexible date strings, compute relative dates, handle timezones, or work with recurrence rules—it's the de facto choice for these tasks.
Six provides utility functions to write Python code that runs on both Python 2.7 and Python 3.3+, smoothing over language differences between the two versions.
pytest is a testing framework that lets you write test functions using plain assert statements and automatically discovers and runs them, with detailed failure reporting.
See also microsoft-security-utilities-secret-masker · river · regionmask · rush · drf-api-logger · mozleak · slurm-usage · mo-logs · commonregex · pygrok