用分层路由让大模型高效回答日志问题，兼顾速度与准确率。
LogRouter: Adaptive Two-Level LLM Routing for Log Question Answering in Big Data Systems
- 两级路由根据查询类型选择不同处理路径，智能分配算力。
- 在四类日志数据上平均准确率达88.4%，端到端延迟仅18.6秒。
- 无需训练分类器，关键词匹配即可精准路由，适合资源受限环境。
在自托管、资源受限的生产环境中进行日志分析，需通过自然语言访问海量日志流，同时避免将每条查询都送入大语言模型带来的高昂成本。我们提出LogRouter，一个部署于TUBITAK BILGEM国家大数据平台的端到端日志问答系统，结合基于PySpark的Drain3日志解析流水线、GPU加速嵌入计算，以及Apache Druid与PostgreSQL/pgvector的双索引存储。系统采用两级成本感知路由机制，将每条查询分发至四个执行路径之一：直接响应、Druid关键词搜索、模板查表生成SQL，或pgvector语义检索；其中二级路由在14B与32B级生成器间动态选择。专用编码器大模型负责文本转SQL。我们在四个LogHub数据集（Linux、Apache、Windows、Mac）上评估，共70个问题。路由模块在各数据集上平均准确率达88.4%，Linux达94.7%；完整系统端到端延迟为18.6秒，平均ROUGE-1为0.373，BERTScore为0.879，RAGAS Faithfulness为0.779。离线对比显示，相比固定32B基线（102.1秒），该系统平均延迟降低55%（46.3秒），答案正确性下降不足5.8分，且在所有数据集上均超过固定14B基线的RAGAS Faithfulness表现。
原文摘要 · Abstract (English)
Production log analytics in self-hosted, resource-constrained environments requires natural-language access to massive log streams without the cost of routing every query through a large language model. We present LogRouter, an end-to-end log question-answering system deployed on TUBITAK BILGEM's national big data platform that combines a PySpark-based Drain3 ingestion pipeline, GPU-accelerated embeddings, and dual-index storage in Apache Druid and PostgreSQL with pgvector. A two-level cost-aware router dispatches each query along one of four execution paths: direct response, Druid keyword search, template lookup with SQL generation, and pgvector semantic retrieval, while a Level-2 router selects either a 14B-class or 32B-class generator for the semantic path. A dedicated coder LLM handles text-to-SQL generation. We evaluate the system on four LogHub datasets (Linux, Apache, Windows, and Mac; 70 questions in total) under both an online full-pipeline configuration and an offline configuration that isolates the generator. The router reaches 88.4% mean accuracy across datasets and 94.7% on Linux, while the full pipeline attains a mean ROUGE-1 of 0.373, BERTScore of 0.879, RAGAS Faithfulness of 0.779, and an end-to-end latency of 18.6 s. In an apples-to-apples offline comparison, the routed system reduces mean latency by 55% versus a Fixed-32B baseline (46.3 s vs. 102.1 s) while preserving Answer Correctness within 5.8 points and exceeding a Fixed-14B baseline on RAGAS Faithfulness across every dataset. Cost-aware dispatching is therefore a practical mechanism for production log QA: routing recovers most of the quality of an always-32B configuration at less than half the latency, and the L1 keyword vocabulary makes that routing decision with high precision without a learned classifier.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。