# dcm-dcm-dcm/eagerlog architecture

> Architecture diagram of the GitHub repository dcm-dcm-dcm/eagerlog, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/dcm-dcm-dcm/eagerlog
- Repository: https://github.com/dcm-dcm-dcm/eagerlog

## Overview

EagerLog is an active-learning, retrieval-augmented log anomaly detector. Its main workflow prepares and parses a configured dataset, embeds reference log windows, retrieves similar evidence for each test window, asks Qwen to explain and classify it, and selectively adds uncertain examples to the evolving reference set. Results and metrics are written at the end. The graph preserves the three dataset-specific Drain parsers and prompt roles; unsampled utilities and config details are represented only where the excerpts or README support them.

Main entry points: [`main.py`](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/main.py) (Detection loop), [`utils/preprocessing.py`](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/preprocessing.py) (Dataset preprocessing), [`utils/utils.py`](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/utils.py) (Detection utilities), [`llm/chat.py`](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/llm/chat.py) (Qwen client)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_workflow["Detection workflow"]
  node_main["Detection loop<br/>[main.py]"]
  node_config["Experiment config<br/>[BGL.yaml]"]
  node_results["Result files"]
end

subgraph group_data["Dataset preparation"]
  node_preprocess["Dataset preprocessing<br/>[preprocessing.py]"]
  node_bgl["BGL Drain parser<br/>[DrainBGL.py]"]
  node_thunderbird["Thunderbird parser"]
  node_zookeeper["Zookeeper parser<br/>[DrainZookeeper.py]"]
end

subgraph group_retrieval["Retrieval and utilities"]
  node_utils["Detection utilities<br/>[utils.py]"]
  node_dpr["DPR encoder"]
end

subgraph group_generation["LLM prompting"]
  node_explanation["Explanation template"]
  node_evidence["Evidence template<br/>[evidence.txt]"]
  node_analysis["Analysis template"]
  node_chat["Qwen client<br/>[chat.py]"]
end

node_user(("Experiment runner"))
node_dataset["LogHub datasets"]
node_qwen["Qwen API"]

node_user -->|"runs"| node_main
node_main -->|"loads"| node_config
node_main -->|"prepares data"| node_preprocess
node_preprocess -->|"downloads"| node_dataset
node_preprocess -->|"parses BGL"| node_bgl
node_preprocess -->|"parses Thunderbird"| node_thunderbird
node_preprocess -->|"parses Zookeeper"| node_zookeeper
node_main -->|"retrieves and evaluates"| node_utils
node_utils -->|"invokes parsing"| node_preprocess
node_main -->|"encodes windows"| node_dpr
node_main -->|"loads"| node_explanation
node_main -->|"loads"| node_evidence
node_main -->|"loads"| node_analysis
node_main -->|"requests generations"| node_chat
node_chat -->|"calls API"| node_qwen
node_main -->|"writes CSV"| node_results

click node_main "https://github.com/dcm-dcm-dcm/eagerlog/blob/main/main.py"
click node_config "https://github.com/dcm-dcm-dcm/eagerlog/blob/main/config/BGL.yaml"
click node_preprocess "https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/preprocessing.py"
click node_bgl "https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/DrainBGL.py"
click node_thunderbird "https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/DrainThunderbird.py"
click node_zookeeper "https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/DrainZookeeper.py"
click node_utils "https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/utils.py"
click node_explanation "https://github.com/dcm-dcm-dcm/eagerlog/blob/main/prompts/explanation_prompt.txt"
click node_evidence "https://github.com/dcm-dcm-dcm/eagerlog/blob/main/prompts/evidence.txt"
click node_analysis "https://github.com/dcm-dcm-dcm/eagerlog/blob/main/prompts/analysis_prompt.txt"
click node_chat "https://github.com/dcm-dcm-dcm/eagerlog/blob/main/llm/chat.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_config,node_results toneBlue
class node_preprocess,node_bgl,node_thunderbird,node_zookeeper toneAmber
class node_utils,node_dpr,node_qwen toneMint
class node_explanation,node_evidence,node_analysis,node_chat toneRose
class node_user,node_dataset toneIndigo
```

## Components

### Detection workflow

- [Detection loop](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/main.py): `main.py`
- [Experiment config](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/config/BGL.yaml): `config/BGL.yaml`
- **Result files**

### Dataset preparation

- [Dataset preprocessing](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/preprocessing.py): `utils/preprocessing.py`
- [BGL Drain parser](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/DrainBGL.py): `utils/DrainBGL.py`
- [Thunderbird parser](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/DrainThunderbird.py): `utils/DrainThunderbird.py`
- [Zookeeper parser](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/DrainZookeeper.py): `utils/DrainZookeeper.py`

### Retrieval and utilities

- [Detection utilities](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/utils/utils.py): `utils/utils.py`
- **DPR encoder**

### LLM prompting

- [Explanation template](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/prompts/explanation_prompt.txt): `prompts/explanation_prompt.txt`
- [Evidence template](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/prompts/evidence.txt): `prompts/evidence.txt`
- [Analysis template](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/prompts/analysis_prompt.txt): `prompts/analysis_prompt.txt`
- [Qwen client](https://github.com/dcm-dcm-dcm/eagerlog/blob/main/llm/chat.py): `llm/chat.py`

### Other components

- **Experiment runner**
- **LogHub datasets**
- **Qwen API**

## Connections

- Experiment runner → Detection loop: runs (evidence: `README.md`)
- Detection loop → Experiment config: loads (evidence: `main.py`)
- Detection loop → Dataset preprocessing: prepares data (evidence: `main.py`)
- Dataset preprocessing → LogHub datasets: downloads (evidence: `utils/preprocessing.py`)
- Dataset preprocessing → BGL Drain parser: parses BGL (evidence: `utils/preprocessing.py`)
- Dataset preprocessing → Thunderbird parser: parses Thunderbird (evidence: `utils/preprocessing.py`)
- Dataset preprocessing → Zookeeper parser: parses Zookeeper (evidence: `utils/preprocessing.py`)
- Detection loop → Detection utilities: retrieves and evaluates (evidence: `main.py`)
- Detection utilities → Dataset preprocessing: invokes parsing (evidence: `utils/utils.py`)
- Detection loop → DPR encoder: encodes windows (evidence: `main.py`)
- Detection loop → Explanation template: loads (evidence: `main.py`)
- Detection loop → Evidence template: loads (evidence: `main.py`)
- Detection loop → Analysis template: loads (evidence: `main.py`)
- Detection loop → Qwen client: requests generations (evidence: `main.py`)
- Qwen client → Qwen API: calls API (evidence: `llm/chat.py`)
- Detection loop → Result files: writes CSV (evidence: `main.py`)