alt Hacker NewsI sometimes find myself with thousands of log lines from a problematic execution and a known good reference, wondering nonspecifically if "something weird" happened in the first one. I don't think there's any matching-based solution there; you need a scan process that understands variations in execution time, object identifiers, etc. aren't meaningful.
You would need specific domain knowledge and a very clever parser, I've done one for a ridiculously over engineered system but a pain. That's fair but how often would you need it? Certainly not token maxing amounts!