What's new
Surface patterns that first appeared inside a recency window, to find pattern identities that have no historical baseline. Call this in any of these situations:
- after a deploy
- during incident triage
- as part of weekly hygiene
Distinct from Top patterns (current cost ranking) and What's changing (delta vs baseline); new patterns have no baseline, so they get a clean home here. An engine upgrade that changes the naming rules renames the patterns it affects once, so the first windows after the upgrade list them here as new.
Example
You
what's new in the last hour
Log10x
3 new patterns first seen within 1h.
Newest: Checkout_Retry_Exhausted (4m ago, $12/h).
Cart_Idempotency_Conflict (18m, $7/h).
Coupon_Region_Mismatch (47m, $3/h).
More to ask
- "new patterns since yesterday's deploy"
- "anything new in
payments-svclast 6h" - "new ERROR patterns this week"
Prerequisites
This tool requires the Reporter deployed with at least 24h of metrics so the 30-day first-seen probe has data to compare against.
Schema and samples
Input example
Representative call (synthetic, not captured from the live demo env).
Input schema
Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):
{
"type": "object",
"properties": {
"timeRange": {
"type": "string",
"pattern": "^\\d+[mhd]$",
"default": "1h",
"description": "Time range used to score current cost. Default 1h."
},
"first_seen_within": {
"type": "string",
"enum": [
"1h",
"6h",
"12h",
"1d",
"7d",
"14d",
"30d"
],
"default": "1d",
"description": "Patterns whose first-seen timestamp is younger than this are \"new.\" Default `1d`. Use `1h` for incident triage, `1d` for daily-deploy review, `7d`+ for weekly observability hygiene."
},
"service": {
"type": "string",
"description": "Service name to scope the result. Omit for all services."
},
"severity": {
"type": "string",
"description": "Severity level to scope (e.g. `ERROR`, `CRITICAL`)."
},
"limit": {
"type": "number",
"minimum": 1,
"maximum": 50,
"default": 10,
"description": "Max patterns to return. Default 10."
},
"analyzerCost": {
"type": "number",
"description": "SIEM ingestion cost in $/GB. Auto-detected from profile if omitted."
},
"environment": {
"type": "string",
"description": "Environment nickname (for multi-env setups)."
},
"view": {
"type": "string",
"enum": [
"summary",
"markdown"
],
"default": "summary",
"description": "Output format."
}
},
"additionalProperties": false
}
Source: src/tools/whats-new.ts.
Output example
Representative envelope (synthetic, not captured from the live demo env). view: "summary" returns the full StructuredOutput with typed data.
Headline (the 1-line agent-facing answer):
3 new patterns first seen within 1h. Newest:
a1b2c3d4e5f6(4m ago, $12/1h).
{
"schema_version": "1.0",
"schema_epoch": "2026-05-25",
"tool": "log10x_whats_new",
"generated_at": "2026-06-05T14:22:10.512Z",
"view": "summary",
"summary": {
"headline": "3 new patterns first seen within 1h. Newest: `a1b2c3d4e5f6` (4m ago, $12/1h)."
},
"data": {
"time_range": "last hour",
"first_seen_within": "1h",
"first_seen_within_seconds": 3600,
"patterns": [
{
"pattern_hash": "a1b2c3d4e5f6",
"symbol_message": "Checkout retry exhausted for order $",
"severities": ["ERROR"],
"first_seen_unix": 1749132130,
"first_seen_age_seconds": 240,
"first_seen_age_label": "4m",
"cost_now_usd": 12.4,
"bytes_now": 8266667,
"events_now": 1420,
"services": [
{
"name": "checkout-svc",
"severity": "ERROR",
"cost_now_usd": 12.4,
"bytes_now": 8266667,
"events_now": 1420
}
]
},
{
"pattern_hash": "9f8e7d6c5b4a",
"symbol_message": "Idempotency conflict on cart $",
"severities": ["WARN"],
"first_seen_unix": 1749131050,
"first_seen_age_seconds": 1080,
"first_seen_age_label": "18m",
"cost_now_usd": 7.2,
"bytes_now": 4800000,
"events_now": 860,
"services": [
{
"name": "cart-svc",
"severity": "WARN",
"cost_now_usd": 7.2,
"bytes_now": 4800000,
"events_now": 860
}
]
}
],
"pattern_count_total": 3,
"pattern_count_shown": 3
},
"actions": [
{
"tool": "log10x_pattern_examples",
"args": {
"pattern": "a1b2c3d4e5f6",
"timeRange": "1h"
},
"reason": "see what the newest pattern actually looks like"
},
{
"tool": "log10x_pattern_trend",
"args": {
"pattern": "a1b2c3d4e5f6",
"timeRange": "1h"
},
"reason": "check the trajectory since first appearance"
}
],
"truncated": false,
"warnings": []
}
Output schema
The data block inside the StructuredOutput envelope:
interface ToolData {
time_range: string;
first_seen_within: string;
first_seen_within_seconds: number;
patterns: Array<{
pattern_hash: string;
symbol_message: string;
severities: string[];
first_seen_unix: number;
first_seen_age_seconds: number;
first_seen_age_label: string;
cost_now_usd: number;
bytes_now: number;
events_now: number;
services: Array<{
name: string;
severity: string;
cost_now_usd: number;
bytes_now: number;
events_now: number;
}>;
}>;
pattern_count_total: number;
pattern_count_shown: number;
}
Envelope-level fields the agent should also read: summary.headline (1-line answer), actions[] (next-call chain hints as {tool, args, reason}), truncated: boolean, images[] (PNG attachments where applicable), schema_epoch (engine-ID stability boundary).
Datadog change report
log10x_datadog_change_report is the weekly report for a Datadog install. The report reads the per-pattern series that the engine's Datadog metric output publishes and lists the statements new in each service since since; a statement is new when it had no line in its service in the lookback before that point. Each statement comes with its lines a day, its estimated Standard indexing cost a month at Datadog list price, whether a rule held it, and the rule that did, read from caps.csv and actions.csv in the GitOps repo or the policy ConfigMap. The owning team shows when the series carry tenx_team, which the team label sets.
The report ends with a proposed rule per service in the plan's form, <service>: any statement above N lines a day goes to Flex. Today that is these K statements, about $X a month. For a service with no history of its own, the proposed limit is the fleet's largest kept statement times headroom. Each report returns next_since; passing it back as since continues where the last report ended.
view: "monitors" returns two Datadog monitor definitions as JSON for the account owner to apply: a metric monitor that fires when a statement's route turns tier_down or offload, and an anomaly monitor with weekly seasonality that fires when a statement's volume rises above its weekly baseline. That view reads nothing.
The tool only reads, with GET requests to Datadog's query API and reads of the engine files; nothing is written to Datadog or to the repo.
Prerequisites: the engine's Datadog metric output posting to the account, and DD_API_KEY and DD_APP_KEY in the MCP session, with DD_SITE when the account is not on datadoghq.com. The keys need read access to metrics only.
Input example
Representative calls (synthetic, not captured from the live demo env).
Input schema
Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):
{
"type": "object",
"properties": {
"view": {
"type": "string",
"enum": [
"markdown",
"summary",
"monitors"
],
"default": "markdown",
"description": "`markdown` (default): the weekly change report. `summary`: the same data without the rendered page. `monitors`: two Datadog monitor definitions as JSON (a statement turning tier_down or offload; a statement above its weekly baseline), for the account owner to apply. `monitors` reads nothing."
},
"since": {
"type": "string",
"default": "7d",
"description": "Start of the report: a duration back from now (`7d`, `36h`) or a date or ISO timestamp (`2026-10-06`). A statement is new when it had no line in its service in the `lookback` before this point. Pass the previous report's `next_since` to continue where it ended. Default `7d`."
},
"lookback": {
"type": "string",
"pattern": "^\\d+d$",
"default": "28d",
"description": "How far before `since` to look for earlier lines of a statement. Default `28d`, at most `90d`."
},
"tenx_env": {
"type": "string",
"description": "`tenx_env` tag value to scope the series to. Omit for every environment."
},
"team_tag": {
"type": "string",
"description": "Team tag key on the series (e.g. `tenx_team`). Omit to detect `tenx_team` on the series; the team is shown only when present."
},
"action": {
"type": "string",
"enum": [
"tier_down",
"offload"
],
"default": "tier_down",
"description": "Where a proposed row sends a statement: `tier_down` (Flex, the default) or `offload` (S3) for an account without Flex."
},
"headroom": {
"type": "number",
"minimum": 1,
"maximum": 10,
"default": 2,
"description": "Multiplier on the fleet's largest kept statement, for a service with no history of its own. Default 2."
},
"limit": {
"type": "integer",
"minimum": 1,
"maximum": 100,
"default": 25,
"description": "Most new statements listed. Default 25."
},
"site": {
"type": "string",
"description": "Datadog site (e.g. `us5.datadoghq.com`). Defaults to DD_SITE, then `datadoghq.com`."
},
"notify": {
"type": "array",
"items": {
"type": "string"
},
"description": "Notification handles for the monitors view (e.g. `@slack-log-cost`)."
},
"environment": {
"type": "string",
"description": "MCP environment nickname, used to find the gitops repo holding caps.csv and actions.csv."
}
},
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}
Source: src/tools/datadog-change-report.ts.
Output schema
data.payload inside the StructuredOutput envelope for view: "summary". view: "markdown" adds the rendered report as markdown; view: "monitors" returns monitors, group_by, docs and markdown instead.
interface ChangeReportPayload {
since_iso: string;
until_iso: string;
next_since: string; // pass as `since` for the next report
window_days: number;
team_tag: string | null;
statements: Array<{
pattern: string;
pattern_hash: string;
container: string;
service: string;
team: string | null;
routes: string[];
first_seen_iso: string | null;
lines_a_day: number;
held_lines_a_day: number;
standard_usd_month: number;
held: boolean;
rule: {
kind: 'statement_row' | 'service_row' | 'fleet_default' | 'not_read';
container: string;
action: string;
text: string;
} | null;
}>;
statement_count_total: number;
held_count: number;
standard_usd_month_total: number;
proposed_rows: Array<{
container: string;
lines_a_day_limit: number;
basis: 'service' | 'fleet';
action: 'tier_down' | 'offload';
statements: Array<{ pattern: string; pattern_hash: string; lines_a_day: number; standard_usd_month: number }>;
standard_usd_month: number;
sentence: string;
}>;
services_without_proposal: string[];
policy_source: string | null;
pricing: { standard_usd_per_million_events: number; text: string };
caveats: string[];
site: string;
queries: { current: string; prior: string };
}