Pattern diff (set diff across a time boundary)
log10x_pattern_diffIdentify what changed in log patterns between two time windows by comparing new, retired, persistent, and re-emerged sets, and detect co-emergence clusters for deploy fingerprinting.
Instructions
Set diff of patterns across a time boundary. Compares pattern presence in two windows (the most recent timeRange window as "after" vs the immediately preceding timeRange window as "before") and returns four sets: new (present after, absent before), retired (present before, absent after), persistent (present in both), and re_emerged (flagged as new but actually existed prior to the before-window — the "the bug we thought we fixed is back" case, derived by checking first_seen against the before-window boundary). Plus co_emergence_clusters: groups of 3+ patterns whose first_seen timestamps cluster within ±co_emergence_window_seconds (default 60s). That cluster is a deploy fingerprint — no CI/CD integration required; the agent can then query the customer's deploy system externally with the cluster timestamp. This tool is coherent ONLY because log10x pattern_hash is stable across queries; competitors that re-cluster per query (Datadog Log Patterns, Cribl, Edge Delta) can't answer the diff question because their "patterns" on either side of the boundary aren't comparable. Use for "what changed since last deploy", "which patterns disappeared this week", "did the rollback bring back the old errors", or paired with log10x_pattern_examples on a flagged hash to see slot distribution. Scoping: service and severity narrow the universe; limit caps rows per category. Returns structured envelope under data.diff with the four sets plus an incidents block when co_emergence clusters are detected.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. | summary |
| limit | No | Max rows per category (new / retired / persistent / re_emerged). Default 20. | |
| service | No | Service name to scope. Omit for all services. | |
| severity | No | Severity to scope (e.g. `ERROR`, `CRITICAL`). | |
| timeRange | No | Window size on both sides of the boundary. The tool compares the most recent `timeRange` ("after") against the immediately preceding `timeRange` ("before"). Example: `timeRange: "1d"` compares today vs yesterday. | 1d |
| environment | No | Environment nickname (for multi-env setups). | |
| analyzerCost | No | stack ingestion cost in $/GB. Auto-detected from profile. | |
| co_emergence_window_seconds | No | Time spread for clustering co-emergent patterns. Default 60s — tight enough to fingerprint a single deploy. | |
| min_co_emergence_cluster_size | No | Minimum cluster size to emit. Default 3 — 2 patterns sharing a timestamp is often coincidence. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| tool | Yes | ||
| view | No | summary | |
| images | No | ||
| actions | No | ||
| summary | Yes | ||
| warnings | No | ||
| truncated | No | ||
| next_cursor | No | ||
| render_hint | No | ||
| generated_at | Yes | ||
| schema_epoch | Yes | ||
| schema_version | Yes |