Skip to main content
Glama
log-10x

Log10x MCP Server

Official
by log-10x

Pattern diff (set diff across a time boundary)

log10x_pattern_diff
Read-onlyIdempotent

Identify what changed in log patterns between two time windows by comparing new, retired, persistent, and re-emerged sets, and detect co-emergence clusters for deploy fingerprinting.

Instructions

Set diff of patterns across a time boundary. Compares pattern presence in two windows (the most recent timeRange window as "after" vs the immediately preceding timeRange window as "before") and returns four sets: new (present after, absent before), retired (present before, absent after), persistent (present in both), and re_emerged (flagged as new but actually existed prior to the before-window — the "the bug we thought we fixed is back" case, derived by checking first_seen against the before-window boundary). Plus co_emergence_clusters: groups of 3+ patterns whose first_seen timestamps cluster within ±co_emergence_window_seconds (default 60s). That cluster is a deploy fingerprint — no CI/CD integration required; the agent can then query the customer's deploy system externally with the cluster timestamp. This tool is coherent ONLY because log10x pattern_hash is stable across queries; competitors that re-cluster per query (Datadog Log Patterns, Cribl, Edge Delta) can't answer the diff question because their "patterns" on either side of the boundary aren't comparable. Use for "what changed since last deploy", "which patterns disappeared this week", "did the rollback bring back the old errors", or paired with log10x_pattern_examples on a flagged hash to see slot distribution. Scoping: service and severity narrow the universe; limit caps rows per category. Returns structured envelope under data.diff with the four sets plus an incidents block when co_emergence clusters are detected.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
viewNoOutput format.summary
limitNoMax rows per category (new / retired / persistent / re_emerged). Default 20.
serviceNoService name to scope. Omit for all services.
severityNoSeverity to scope (e.g. `ERROR`, `CRITICAL`).
timeRangeNoWindow size on both sides of the boundary. The tool compares the most recent `timeRange` ("after") against the immediately preceding `timeRange` ("before"). Example: `timeRange: "1d"` compares today vs yesterday.1d
environmentNoEnvironment nickname (for multi-env setups).
analyzerCostNostack ingestion cost in $/GB. Auto-detected from profile.
co_emergence_window_secondsNoTime spread for clustering co-emergent patterns. Default 60s — tight enough to fingerprint a single deploy.
min_co_emergence_cluster_sizeNoMinimum cluster size to emit. Default 3 — 2 patterns sharing a timestamp is often coincidence.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
dataNo
toolYes
viewNosummary
imagesNo
actionsNo
summaryYes
warningsNo
truncatedNo
next_cursorNo
render_hintNo
generated_atYes
schema_epochYes
schema_versionYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.30.7

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint, idempotentHint, openWorldHint), so the bar is lower, and the description still adds real behavioral context: how re_emerged is derived (checking first_seen against the before-window boundary), how co-emergence clusters fingerprint a deploy with default 60s window, and that an incidents block is emitted when clusters are found. It stops short of noting limits, auth, or large-window cost behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core definition and the labeled sets are front-loaded and the Scoping/Returns structure helps. But roughly a third of the text is competitive marketing ('coherent ONLY because log10x pattern_hash is stable... competitors that re-cluster per query') that does not help an agent select or invoke the tool, so several sentences do not earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter tool with an output schema and read-only annotations, the description is complete: it explains usage triggers, scoping, defaults, the semantics of each returned set, and the conditions under which an incidents block appears. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all nine parameters, and the description largely restates them (timeRange window pairing, limit rows-per-category, service/severity scoping). The re_emerged boundary semantics and cluster-fingerprint framing add a little meaning beyond the schema, but not enough to rise above the baseline for full coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource+scope ('Set diff of patterns across a time boundary') and enumerates exactly what is computed: the new/retired/persistent/re_emerged sets plus co_emergence_clusters. This is unambiguous and clearly distinguishable from look-alike siblings such as log10x_pattern_trend or log10x_whats_changing, which do not produce a set diff.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Concrete trigger phrases are given ('what changed since last deploy', 'which patterns disappeared this week', 'did the rollback bring back the old errors') and it names a specific companion call (log10x_pattern_examples on a flagged hash). However it never explicitly distinguishes itself from the similarly-purposed siblings log10x_whats_changing and log10x_pattern_trend, leaving that disambiguation to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.