What's changing
Rank patterns by how much their cost moved since a baseline window. Answers "what grew (or shrank) the most since last week?" by joining current-window bytes against averaged baseline offsets per (pattern, service, severity) tuple, then applying dollar and contribution floors to drop noise-level changes. Brand-new patterns with no baseline are excluded and routed to What's new; for current-cost ranking with no baseline math use Top patterns.
Example
You
what's changing this week vs last week
Log10x
3 patterns moved >$500/wk.
Cart_Validation_Failed+$1,240 (+38%) · 7dInventory_Latency_Spike+$610 (+22%) · 7dCoupon_Lookup_Miss-$520 (-15%) · 7d
2 brand-new patterns excluded, see What's new.
More to ask
- "today vs yesterday, deploy delta"
- "what shrank in payments-svc over 30d"
- "top cost movers, min delta $200"
Prerequisites
This tool requires the Reporter deployed with at least one baseline window of metrics (1, 2, or 3 times the current timeRange).
Schema and samples
Input example
Representative call (synthetic, not captured from the live demo env).
Input schema
Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):
{
"type": "object",
"properties": {
"timeRange": {
"type": "string",
"enum": [
"1d",
"7d",
"30d"
],
"default": "7d",
"description": "Current window to evaluate. Day-level only — delta math requires day-aligned baseline offsets. For sub-day spike investigation use `log10x_pattern_trend` or `log10x_investigate`."
},
"comparison_window": {
"anyOf": [
{
"type": "string",
"enum": [
"1d",
"7d",
"14d",
"30d",
"auto"
]
},
{
"type": "string"
}
],
"default": "auto",
"description": "Baseline window to compare against. `\"auto\"` (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing. A specific offset like `\"7d\"` compares to that single anchor — e.g. `{timeRange: \"1d\", comparison_window: \"1d\"}` = today vs yesterday (deploy-delta); `{timeRange: \"7d\", comparison_window: \"7d\"}` = this week vs last week."
},
"service": {
"type": "string",
"description": "Service name to scope the result. Omit for all services."
},
"severity": {
"type": "string",
"description": "Severity level to scope (e.g. `ERROR`, `CRITICAL`)."
},
"limit": {
"type": "number",
"minimum": 1,
"maximum": 20,
"default": 10,
"description": "Max patterns to return. Default 10."
},
"min_delta_usd": {
"type": "number",
"description": "Dollar floor for delta. Rows with delta < min_delta_usd are dropped. Default 500 (the cost_drivers gate). Set to 0 to disable."
},
"min_delta_contribution_pct": {
"type": "number",
"minimum": 0,
"maximum": 100,
"description": "Contribution gate as a percentage. A row's delta must be at least this fraction of total positive delta to be surfaced. Default 5. Set to 0 to disable."
},
"analyzerCost": {
"type": "number",
"description": "SIEM ingestion cost in $/GB. Auto-detected from profile if omitted."
},
"environment": {
"type": "string",
"description": "Environment nickname (for multi-env setups)."
},
"view": {
"type": "string",
"enum": [
"summary",
"markdown"
],
"default": "summary",
"description": "Output format. `summary` returns the structured envelope; `markdown` returns a rendered table."
}
},
"additionalProperties": false
}
Source: src/tools/whats-changing.ts.
Output example
Representative envelope (synthetic, not captured from the live demo env). view: "summary" returns the full StructuredOutput with typed data.
Headline (the 1-line agent-facing answer):
3 patterns changed by >$500 over this week vs auto (3-window avg, offsets 7d/14d/21d). Top:
a1b2c3d+$1240 (+38%).
{
"schema_version": "1.0",
"schema_epoch": "2026-05-25",
"tool": "log10x_whats_changing",
"generated_at": "2026-06-05T14:12:00.000Z",
"view": "summary",
"summary": {
"headline": "3 patterns changed by >$500 over this week vs auto (3-window avg, offsets 7d/14d/21d). Top: `a1b2c3d` +$1240 (+38%).",
"callout": "2 brand-new patterns excluded — see `log10x_whats_new`."
},
"data": {
"time_range": "this week",
"comparison_window": "auto (3-window avg, offsets 7d/14d/21d)",
"baseline_offset_days": [7, 14, 21],
"gates_applied": {
"min_delta_usd": 500,
"min_delta_contribution_pct": 5
},
"total_positive_delta_usd": 2380,
"patterns": [
{
"pattern_hash": "a1b2c3d",
"symbol_message": "Cart_Validation_Failed user $ item $ rule $",
"severities": ["ERROR"],
"first_seen_age_seconds": 1209600,
"cost_now_usd": 4480,
"cost_baseline_usd": 3240,
"delta": 1240,
"delta_usd": 1240,
"delta_pct": 38.27,
"events_now": 92340,
"services": [
{
"name": "cart-svc",
"severity": "ERROR",
"cost_now_usd": 4480,
"cost_baseline_usd": 3240,
"delta_usd": 1240,
"delta_pct": 38.27,
"events_now": 92340
}
]
},
"... 2 more elided"
],
"pattern_count_total": 184,
"pattern_count_shown": 3,
"excluded_new_count": 2
},
"actions": [
{
"tool": "log10x_pattern_trend",
"args": {
"pattern": "a1b2c3d",
"timeRange": "7d"
},
"reason": "inspect the trajectory of the top changer"
},
{
"tool": "log10x_pattern_examples",
"args": {
"pattern": "a1b2c3d",
"timeRange": "7d"
},
"reason": "see real events for the top changer"
},
{
"tool": "log10x_whats_new",
"args": {
"timeRange": "7d"
},
"reason": "2 brand-new patterns excluded from this list — see whats_new"
}
],
"truncated": false,
"warnings": []
}
Output schema
The data block inside the StructuredOutput envelope:
interface ToolData {
time_range: string;
comparison_window: string;
baseline_offset_days: number[];
gates_applied: {
min_delta_usd: number;
min_delta_contribution_pct: number;
};
total_positive_delta_usd: number;
patterns: Array<{
pattern_hash: string;
symbol_message: string;
severities: string[];
first_seen_age_seconds: number | null;
cost_now_usd: number;
cost_baseline_usd: number;
delta: number;
delta_usd: number;
delta_pct: number;
events_now: number;
services: Array<{
name: string;
severity: string;
cost_now_usd: number;
cost_baseline_usd: number;
delta_usd: number;
delta_pct: number;
events_now: number;
}>;
}>;
pattern_count_total: number;
pattern_count_shown: number;
excluded_new_count: number;
}
Envelope-level fields the agent should also read: summary.headline (1-line answer), summary.callout (excluded-new-pattern nudge), actions[] (next-call chain hints as {tool, args, reason}), truncated: boolean, images[] (PNG attachments where applicable), schema_epoch (engine-ID stability boundary).