@agentix-e/drain-ts

What is drain-ts?

drain-ts turns unstructured log messages into structured templates — in real time, with zero training. Given a stream of logs like "connection from 192.168.1.1 port 8080", it automatically identifies that the IP and port are variables, producing the template "connection from <IP> port <NUM>".

It implements the Drain algorithm (He et al., ICWS 2017) — the best-performing rule-based log parser in the LogPAI benchmark suite — using a fixed-depth prefix tree for efficient O((d+cm)n) online clustering.

This is the only TypeScript implementation with full Drain3 v0.9.11 feature parity: tree search, fast match, LRU eviction, inference mode, parameter extraction, and framework-agnostic persistence.

Key Features

30-Second Example

import { TemplateMiner, TemplateMinerConfig, DEFAULT_MASKING_INSTRUCTIONS } from "@agentix-e/drain-ts";

const miner = new TemplateMiner({
  config: TemplateMinerConfig.from({ maskingInstructions: DEFAULT_MASKING_INSTRUCTIONS }),
});

miner.addLogMessage("connection from 192.168.1.1 port 8080");
miner.addLogMessage("connection from 10.0.0.1 port 443");
// Both mapped to: "connection from <IP> port <NUM>"

// Extract the actual values:
const params = miner.extractParameters(
  "connection from <IP> port <NUM>",
  "connection from 192.168.1.1 port 8080"
);
// [{ value: "192.168.1.1", maskName: "IP" }, { value: "8080", maskName: "NUM" }]

Persistence in 3 Lines

import { TemplateMiner, FilePersistence } from "@agentix-e/drain-ts";

const miner = new TemplateMiner({
  persistenceHandler: new FilePersistence("./state.json"),
});
// State auto-saves on every template change
// On restart, model loads from state.json automatically

vs. Python Drain3

Quality