Log Patterns
Incident Management is now generally available! Incident Management is now generally available!

Log Patterns


Investigating large volumes of log data can be time consuming: you can spend hours on them and still understand only a fraction of them. However, application logs often look the same with some fraction of them varying. These are what we call patterns.

In the Log Explorer, patterns can be surfaced automatically to bring structure to the problem and help you quickly see what matters—exclude what’s irrelevant.

The patterns view is helpful for detecting and filtering noisy error patterns that might cause you to miss other issues. It shows the number of logs matching a pattern, split by service and status.

Switch to the patterns view to automatically see your log patterns for the selected context. A context is composed of a time range and a search query. Each pattern comes with highlights, to get you straight to its characteristic features:

  • A mini graph displays a rough timeline for the volume of its logs, to help you identify how that pattern differs from other patterns.
  • Sections of logs that vary within the pattern are highlighted to help you quickly identify differences across log lines.

Click on a pattern to see a sample of underlying logs, and eventually display one single log.

Note: The pattern detection is based on 10,000 log samples. Refine the search to see patterns limited to a specific subset of logs.

Pattern Actions

Selecting a pattern opens a contextual panel that displays a sample of underlying logs. Three buttons are available in the top-right corner:

  • Parsing Rule: See an automatically generated parsing rule associated to this pattern (see screenshot below).
  • View All: View all logs matching the pattern query.
  • Graph: Graph the evolution of this pattern over time.

Further Reading