Is there any article introducing anomaly detection algorithms and algorithm performance? From my shallow understanding, this algorithm is more like whether this log has appeared in normal logs. For example, in my normal logs, there is "start to process something", while in abnormal logs there is "failed to process something", and the current anomaly detection algorithm cannot recognize it.

@busy-france-30579 may be able to comment on this as he has a better understanding of the models. From what I understand currently we have two models, drain which is a templating model, and then it uses the nulog model for parsing.