What's new

Surface patterns that first appeared inside a recency window. Call this after a deploy, during incident triage, or as part of weekly hygiene to find pattern identities that have no historical baseline. Distinct from Top patterns (current cost ranking) and What's changing (delta vs baseline); new patterns have no baseline, so they get a clean home here.

Example

You

what's new in the last hour

Log10x

3 new patterns first seen within 1h. Newest: Checkout_Retry_Exhausted (4m ago, $12/h). Cart_Idempotency_Conflict (18m, $7/h). Coupon_Region_Mismatch (47m, $3/h).

More to ask

• "new patterns since yesterday's deploy"
• "anything new in payments-svc last 6h"
• "new ERROR patterns this week"

Prerequisites

This tool requires the Reporter deployed with at least 24h of metrics so the 30-day first-seen probe has data to compare against.

Schema and samples

Input example

Representative call (synthetic, not captured from the live demo env).

{
  "timeRange": "1h",
  "first_seen_within": "1h",
  "limit": 5,
  "view": "summary"
}

Input schema

Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):

{
  "type": "object",
  "properties": {
    "timeRange": {
      "type": "string",
      "pattern": "^\\d+[mhd]$",
      "default": "1h",
      "description": "Time range used to score current cost. Default 1h."
    },
    "first_seen_within": {
      "type": "string",
      "enum": [
        "1h",
        "6h",
        "12h",
        "1d",
        "7d",
        "14d",
        "30d"
      ],
      "default": "1d",
      "description": "Patterns whose first-seen timestamp is younger than this are \"new.\" Default `1d`. Use `1h` for incident triage, `1d` for daily-deploy review, `7d`+ for weekly observability hygiene."
    },
    "service": {
      "type": "string",
      "description": "Service name to scope the result. Omit for all services."
    },
    "severity": {
      "type": "string",
      "description": "Severity level to scope (e.g. `ERROR`, `CRITICAL`)."
    },
    "limit": {
      "type": "number",
      "minimum": 1,
      "maximum": 50,
      "default": 10,
      "description": "Max patterns to return. Default 10."
    },
    "analyzerCost": {
      "type": "number",
      "description": "SIEM ingestion cost in $/GB. Auto-detected from profile if omitted."
    },
    "environment": {
      "type": "string",
      "description": "Environment nickname (for multi-env setups)."
    },
    "view": {
      "type": "string",
      "enum": [
        "summary",
        "markdown"
      ],
      "default": "summary",
      "description": "Output format."
    }
  },
  "additionalProperties": false
}

Source: src/tools/whats-new.ts.

Output example

Representative envelope (synthetic, not captured from the live demo env). view: "summary" returns the full StructuredOutput with typed data.

Headline (the 1-line agent-facing answer):

3 new patterns first seen within 1h. Newest: a1b2c3d4e5f6 (4m ago, $12/1h).

{
  "schema_version": "1.0",
  "schema_epoch": "2026-05-25",
  "tool": "log10x_whats_new",
  "generated_at": "2026-06-05T14:22:10.512Z",
  "view": "summary",
  "summary": {
    "headline": "3 new patterns first seen within 1h. Newest: `a1b2c3d4e5f6` (4m ago, $12/1h)."
  },
  "data": {
    "time_range": "last hour",
    "first_seen_within": "1h",
    "first_seen_within_seconds": 3600,
    "patterns": [
      {
        "pattern_hash": "a1b2c3d4e5f6",
        "symbol_message": "Checkout retry exhausted for order $",
        "severities": ["ERROR"],
        "first_seen_unix": 1749132130,
        "first_seen_age_seconds": 240,
        "first_seen_age_label": "4m",
        "cost_now_usd": 12.4,
        "bytes_now": 8266667,
        "events_now": 1420,
        "services": [
          {
            "name": "checkout-svc",
            "severity": "ERROR",
            "cost_now_usd": 12.4,
            "bytes_now": 8266667,
            "events_now": 1420
          }
        ]
      },
      {
        "pattern_hash": "9f8e7d6c5b4a",
        "symbol_message": "Idempotency conflict on cart $",
        "severities": ["WARN"],
        "first_seen_unix": 1749131050,
        "first_seen_age_seconds": 1080,
        "first_seen_age_label": "18m",
        "cost_now_usd": 7.2,
        "bytes_now": 4800000,
        "events_now": 860,
        "services": [
          {
            "name": "cart-svc",
            "severity": "WARN",
            "cost_now_usd": 7.2,
            "bytes_now": 4800000,
            "events_now": 860
          }
        ]
      }
    ],
    "pattern_count_total": 3,
    "pattern_count_shown": 3
  },
  "actions": [
    {
      "tool": "log10x_pattern_examples",
      "args": {
        "pattern": "a1b2c3d4e5f6",
        "timeRange": "1h"
      },
      "reason": "see what the newest pattern actually looks like"
    },
    {
      "tool": "log10x_pattern_trend",
      "args": {
        "pattern": "a1b2c3d4e5f6",
        "timeRange": "1h"
      },
      "reason": "check the trajectory since first appearance"
    }
  ],
  "truncated": false,
  "warnings": []
}

Output schema

The data block inside the StructuredOutput envelope:

interface ToolData {
  time_range: string;
  first_seen_within: string;
  first_seen_within_seconds: number;
  patterns: Array<{
    pattern_hash: string;
    symbol_message: string;
    severities: string[];
    first_seen_unix: number;
    first_seen_age_seconds: number;
    first_seen_age_label: string;
    cost_now_usd: number;
    bytes_now: number;
    events_now: number;
    services: Array<{
      name: string;
      severity: string;
      cost_now_usd: number;
      bytes_now: number;
      events_now: number;
    }>;
  }>;
  pattern_count_total: number;
  pattern_count_shown: number;
}

Envelope-level fields the agent should also read: summary.headline (1-line answer), actions[] (next-call chain hints as {tool, args, reason}), truncated: boolean, images[] (PNG attachments where applicable), schema_epoch (engine-ID stability boundary).

Next: Identify