What's new

Surface patterns that first appeared inside a recency window, to find pattern identities that have no historical baseline. Call this in any of these situations:

• after a deploy
• during incident triage
• as part of weekly hygiene

Distinct from Top patterns (current cost ranking) and What's changing (delta vs baseline); new patterns have no baseline, so they get a clean home here.

Example

You

what's new in the last hour

Log10x

3 new patterns first seen within 1h. Newest: Checkout_Retry_Exhausted (4m ago, $12/h). Cart_Idempotency_Conflict (18m, $7/h). Coupon_Region_Mismatch (47m, $3/h).

More to ask

• "new patterns since yesterday's deploy"
• "anything new in payments-svc last 6h"
• "new ERROR patterns this week"

Prerequisites

This tool requires the Reporter deployed with at least 24h of metrics so the 30-day first-seen probe has data to compare against.

Schema and samples

Input example

Representative call (synthetic, not captured from the live demo env).

{
  "timeRange": "1h",
  "first_seen_within": "1h",
  "limit": 5,
  "view": "summary"
}

Input schema

Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):

{
  "type": "object",
  "properties": {
    "timeRange": {
      "type": "string",
      "pattern": "^\\d+[mhd]$",
      "default": "1h",
      "description": "Time range used to score current cost. Default 1h."
    },
    "first_seen_within": {
      "type": "string",
      "enum": [
        "1h",
        "6h",
        "12h",
        "1d",
        "7d",
        "14d",
        "30d"
      ],
      "default": "1d",
      "description": "Patterns whose first-seen timestamp is younger than this are \"new.\" Default `1d`. Use `1h` for incident triage, `1d` for daily-deploy review, `7d`+ for weekly observability hygiene."
    },
    "service": {
      "type": "string",
      "description": "Service name to scope the result. Omit for all services."
    },
    "severity": {
      "type": "string",
      "description": "Severity level to scope (e.g. `ERROR`, `CRITICAL`)."
    },
    "limit": {
      "type": "number",
      "minimum": 1,
      "maximum": 50,
      "default": 10,
      "description": "Max patterns to return. Default 10."
    },
    "analyzerCost": {
      "type": "number",
      "description": "SIEM ingestion cost in $/GB. Auto-detected from profile if omitted."
    },
    "environment": {
      "type": "string",
      "description": "Environment nickname (for multi-env setups)."
    },
    "view": {
      "type": "string",
      "enum": [
        "summary",
        "markdown"
      ],
      "default": "summary",
      "description": "Output format."
    }
  },
  "additionalProperties": false
}

Source: src/tools/whats-new.ts.

Output example

Representative envelope (synthetic, not captured from the live demo env). view: "summary" returns the full StructuredOutput with typed data.

Headline (the 1-line agent-facing answer):

3 new patterns first seen within 1h. Newest: a1b2c3d4e5f6 (4m ago, $12/1h).

{
  "schema_version": "1.0",
  "schema_epoch": "2026-05-25",
  "tool": "log10x_whats_new",
  "generated_at": "2026-06-05T14:22:10.512Z",
  "view": "summary",
  "summary": {
    "headline": "3 new patterns first seen within 1h. Newest: `a1b2c3d4e5f6` (4m ago, $12/1h)."
  },
  "data": {
    "time_range": "last hour",
    "first_seen_within": "1h",
    "first_seen_within_seconds": 3600,
    "patterns": [
      {
        "pattern_hash": "a1b2c3d4e5f6",
        "symbol_message": "Checkout retry exhausted for order $",
        "severities": ["ERROR"],
        "first_seen_unix": 1749132130,
        "first_seen_age_seconds": 240,
        "first_seen_age_label": "4m",
        "cost_now_usd": 12.4,
        "bytes_now": 8266667,
        "events_now": 1420,
        "services": [
          {
            "name": "checkout-svc",
            "severity": "ERROR",
            "cost_now_usd": 12.4,
            "bytes_now": 8266667,
            "events_now": 1420
          }
        ]
      },
      {
        "pattern_hash": "9f8e7d6c5b4a",
        "symbol_message": "Idempotency conflict on cart $",
        "severities": ["WARN"],
        "first_seen_unix": 1749131050,
        "first_seen_age_seconds": 1080,
        "first_seen_age_label": "18m",
        "cost_now_usd": 7.2,
        "bytes_now": 4800000,
        "events_now": 860,
        "services": [
          {
            "name": "cart-svc",
            "severity": "WARN",
            "cost_now_usd": 7.2,
            "bytes_now": 4800000,
            "events_now": 860
          }
        ]
      }
    ],
    "pattern_count_total": 3,
    "pattern_count_shown": 3
  },
  "actions": [
    {
      "tool": "log10x_pattern_examples",
      "args": {
        "pattern": "a1b2c3d4e5f6",
        "timeRange": "1h"
      },
      "reason": "see what the newest pattern actually looks like"
    },
    {
      "tool": "log10x_pattern_trend",
      "args": {
        "pattern": "a1b2c3d4e5f6",
        "timeRange": "1h"
      },
      "reason": "check the trajectory since first appearance"
    }
  ],
  "truncated": false,
  "warnings": []
}

Output schema

The data block inside the StructuredOutput envelope:

interface ToolData {
  time_range: string;
  first_seen_within: string;
  first_seen_within_seconds: number;
  patterns: Array<{
    pattern_hash: string;
    symbol_message: string;
    severities: string[];
    first_seen_unix: number;
    first_seen_age_seconds: number;
    first_seen_age_label: string;
    cost_now_usd: number;
    bytes_now: number;
    events_now: number;
    services: Array<{
      name: string;
      severity: string;
      cost_now_usd: number;
      bytes_now: number;
      events_now: number;
    }>;
  }>;
  pattern_count_total: number;
  pattern_count_shown: number;
}

Envelope-level fields the agent should also read: summary.headline (1-line answer), actions[] (next-call chain hints as {tool, args, reason}), truncated: boolean, images[] (PNG attachments where applicable), schema_epoch (engine-ID stability boundary).

Next: Identify