Skip to content

Top patterns

Top N log patterns (Payment_Gateway_Timeout-style names for recurring log shapes) by current cost. Snapshot view, no baseline.

Example

"top 20 patterns in checkout-svc, last hour"

  1. Cart_Validation_Failed $890/h · ERROR · 12K events
  2. Inventory_Check_Latency $640/h · INFO · 18K events
  3. Coupon_Lookup_Miss $410/h · INFO · 7K events ... 17 more

Top 20 = 64% of total volume in scope / 36% in the long tail.

More to ask

  • "loudest patterns right now"
  • "top 10 patterns by event count, 1h"
  • "top patterns in payments-svc this hour"

Prerequisites

This tool requires the Reporter deployed.

Tool schema (advanced)
Field Type Required Default Description
timeRange string no 7d One of: 15m, 1h, 6h, 1d, 7d, 30d. Sub-day values for incident investigation.
service string no — Scope to a single service. Omit for all services.
limit number no 10 Max patterns to return. 1–50.
analyzerCost number no from profile log analyzer ingestion cost in $/GB.
environment string no — Environment nickname.

Coverage line. A Top N = X% of total volume in scope / Y% in the long tail line appears below the ranked list. At high volume this is load-bearing — Top-10 capturing 18% vs 92% changes the next-action recommendation entirely.

Newly-emerged section. Patterns firing now (last 5 min) that were silent 1h ago surface in their own block, regardless of their cumulative cost. Catches retry-storm canaries that the cost-weighted ranking otherwise buries.

Structured next-actions block. A trailing single-line HTML comment (<!-- NEXT_ACTIONS:[...] -->) lists the recommended next tool calls as {tool, args, reason} entries. Programmatic callers extract it without regex-parsing markdown.