Log Patterns

Thousands of log lines are usually a few dozen messages with different numbers in them. Patterns groups those lines, so instead of scrolling the view shows:

~5,221  payment declined for order * (card ending *)   error
~3,441  worker * picked up job * after *               debug

In Explore, switch the list to Patterns. The view groups the log lines and events the search finds, from every Stream in scope (stream:checkout narrows the scope), and follows the time range above.

Reading a pattern

• The template: the fixed words, with the parts that vary shown as *. Numbers, IDs, UUIDs, IP addresses, URLs, emails and timestamps always vary.
• Volume: roughly how many matching lines fell in the whole range, and the pattern's share.
• Severity: the levels those lines were logged at.
• Trend: how volume moved across the range, so a pattern that just started (or just stopped) stands out.
• Examples: a few real lines, shown on click.

Acting on a pattern

Search	Show exactly the lines in this pattern.
Exclude	Hide this pattern from the search, to find what's left.
Create Monitor	Alert when this pattern's volume crosses a threshold. See Telemetry Monitors.

Tuning

Patterns come from a sample of the lines matching the search (5,000 by default, up to 20,000), drawn from across the whole time range rather than only the newest lines, so a burst at the end can't hide what happened earlier. Each part of the range counts for real volume, which is how estimates and trends are worked out. Merge decides how alike lines must be to share a pattern: lower merges more.

API

The telemetry patterns query, with the Stream (or none, for all), logs, events or both, time range and search returns patterns with counts, estimated volume, levels, trend and examples.