Triage

Groups a batch of log events (pasted, file, or log analyzer dump) into known patterns. Returns per pattern: event count, severity breakdown, template shape, and slot values (which tenants / users / keys are affected). Defaults to local processing — events never leave the machine.

Example

"triage /tmp/incident.log"

1,403 events → 27 patterns. Top:

1. Payment_Gateway_Timeout (412 events, ERROR) — affects 4 tenants: acme-corp, globex, initech, umbrella
2. GetCartAsync_called_with_userId (218 events, INFO)
3. Retry_Exhausted (174 events, WARN)

More to ask

• "triage this Slack dump" (paste events)
• "what's in /tmp/datadog-export.json?"
• "top 10 patterns from this kubectl logs output"

Prerequisites

Works at any tier, including CLI-only. Privacy mode (default) requires tenx (CLI) installed locally — brew install log10x/tap/tenx.

Tool schema (advanced)

Field	Type	Required	Default	Description
source	string	yes	—	One of: file, events, text.
path	string	when source=file	—	Local file path.
events	string[]	when source=events	—	Array of raw log lines.
text	string	when source=text	—	Raw blob, newline-separated.
top_n_patterns	number	no	20	Number of ranked patterns to return. 1–50.
include_next_actions	boolean	no	true	Generate next_action suggestions per pattern.
privacy_mode	boolean	no	true	Local tenx vs. public paste endpoint. Keep true for production log content.
environment	string	no	—	Environment nickname — used to build next_actions that call Investigate.