Summary
MatchTemplate currently returns the first template whose wildcard tokens fit a log line. When Drain produces overlapping templates (e.g. two patterns that both match the same line), this first-match rule can assign lines to the wrong cluster depending on template iteration order.
Since BuildWorkspace relies on MatchTemplate for counts and samples, overlapping templates can produce incorrect summary/error statistics.
Proposed Improvement
Instead of returning the first match, score all matching templates and pick the best one. A simple heuristic: prefer the template with the fewest wildcards (most specific match). Ties could be broken by template count (prefer higher-count clusters).
Reference
Originated from PR review: #9 (comment)
Summary
MatchTemplatecurrently returns the first template whose wildcard tokens fit a log line. When Drain produces overlapping templates (e.g. two patterns that both match the same line), this first-match rule can assign lines to the wrong cluster depending on template iteration order.Since
BuildWorkspacerelies onMatchTemplatefor counts and samples, overlapping templates can produce incorrect summary/error statistics.Proposed Improvement
Instead of returning the first match, score all matching templates and pick the best one. A simple heuristic: prefer the template with the fewest wildcards (most specific match). Ties could be broken by template count (prefer higher-count clusters).
Reference
Originated from PR review: #9 (comment)