Summarise logs into message patterns
es_patternsCollapse raw log lines into message templates with counts to show what your logs contain or what changed, without reading every line.
Instructions
Collapse a window of raw log lines into the handful of message templates behind them, with a count for each. Use this to answer "what is in these logs" or "what changed" without reading individual lines — it turns millions of documents into a short list. Runs over a random sample, so counts are approximate.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Number of patterns to return | |
| index | No | Index or pattern; defaults to the allowlist | |
| filter | No | Optional phrase the line must contain, e.g. "EXCEPTION" — narrows before categorising | |
| window | No | Look-back as date math without "now-": 15m, 1h, 6h | 1h |
| probability | No | Sampling probability. Raise for accuracy, lower for speed. 1 disables sampling and will usually time out on a busy window. |