LogNLQ Natural-Language Log Querying with Parser-Induced and Semantically Grounded Schemas

Jul 16, 2026

Upload by Hazel

Logs are critical for system monitoring and failure diagnosis, yet natural-language querying of logs remains unresolved. Existing methods either treat logs as plain text, target schema-light backends, or rely on predefined relational schemas, leaving a core gap: raw logs provide no executable schema for structured querying. LogNLQ addresses this by parsing raw logs into template-partitioned relational tables, then using dual-granularity semantic grounding to name templates and parameter columns. Retrieved schema context is fed to an LLM to generate executable, constrained SQL, evaluated on LogNLQ-Bench with 8,895 verified queries across four datasets.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages11

Reading Time28 min

Introduction

Natural-language log querying gap

Related approaches and shared limitation

Core prerequisite: induced executable schema

LogNLQ: Natural-Language Log Querying with Parser-Induced and Semantically Grounded Schemas Juepeng Wang Sun Yat-sen University Zhuhai, China [wangjp39@mail2.sysu.edu.cn](wangjp39@mail2.sysu.edu.cn) Jinyang Liu The Chinese University of Hong Kong Hong Kong, China [jyliu@cse.cuhk.edu.hk](jyliu@cse.cuhk.edu.hk) Zhuangbin Chen∗ Sun Yat-sen University Zhuhai, China [chenzhb36@mail.sysu.edu.cn](chenzhb36@mail.sysu.edu.cn) Zibin Zheng Sun Yat-sen University Zhuhai, China [zhzibin@mail.sysu.edu.cn](zhzibin@mail.sysu.edu.cn) arXiv :2607 .03884v 1 [ cs . SE] 4 Jul 2026 Abstract Logs are essential for system monitoring and failure diagnoses in modern software systems, yet querying them through natural language remains an open challenge. Existing approaches either treat logs as plain text, generate queries for schema-light backends, or assume predefined relational schemas, but none addresses a fundamental obstacle: raw logs carry no executable schema over which structured queries can be defined and run. To address these limitations, we present LogNLQ, a framework that formulates naturallanguage log querying as executable SQL generation over parserinduced and semantically grounded schemas. LogNLQ parses raw logs into template-partitioned relational tables, then applies dualgranularity semantic grounding to annotate both templates and parameter columns with interpretable names and descriptions. At query time, relevant schema candidates are retrieved via semantic search, and a large language model (LLM) generates executable SQL constrained to the retrieved context. To support rigorous evaluation, we introduce LogNLQ-Bench, an execution-verified benchmark of 8,895 queries over four real-world log datasets. Experimental results demonstrate that LogNLQ consistently outperforms all representative baselines by wide margins, with especially pronounced gainson analytically complex scenario queries. CCS Concepts • Software and its engineering → Software maintenance tools; • Information systems → Relational database query languages. Keywords Log Analysis, Natural Language Querying, Text-to-SQL, Log Parsing, Observability, AIOps ACM Reference Format: Juepeng Wang, Jinyang Liu, Zhuangbin Chen, and Zibin Zheng. 2018. LogNLQ: Natural-Language Log Querying with Parser-Induced and Semantically Grounded Schemas. In Proceedings of Make sure to enter the correct conference title from your rights confirmation email (Conference acronym ’XX) . ACM, New York, NY, USA, 11 pages. [https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX) ∗ Zhuangbin Chen is the corresponding author. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission [and/or a fee. Request permissions from permissions@acm.org](and/or a fee. Request permissions from permissions@acm.org). Conference acronym ’XX, Woodstock, NY © 2018 Copyright held by the owner/author(s) . Publication rights licensed to ACM. ACM ISBN 978-1-4503-XXXX-X/2018/06 [https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX) 1 Introduction Logs are a foundational source of runtime observability in modern software systems [9, 21], routinely produced at scales of millions to billions of lines per day. Engineers rely on them to diagnose failures, inspect anomalies [2], audit system behavior, and understand operational trends [3, 10, 11] . Although modern observability platforms provide powerful search and analytics capabilities, these are typically exposed through backend-specific query languages

FAQs

What fundamental obstacle prevents natural-language log querying from working reliably today?

Raw logs lack an executable schema, so structured queries cannot be defined and run over well-typed table and column definitions.

How does LogNLQ turn raw logs into something that SQL can query?

It parses raw logs into template-partitioned relational tables, then applies dual-granularity semantic grounding to annotate templates and parameter columns with interpretable names and descriptions.

How is LogNLQ evaluated and how well does it perform?

LogNLQ-Bench provides execution-verified evaluation with 8,895 queries across four real-world log datasets, and LogNLQ outperforms representative baselines, especially on analytically complex scenario queries.

Jul 16, 2026

Upload by Hazel