Top patterns
log10x_top_patternsRank log patterns by byte volume and cost over a time range, per service or all, to find expensive or noisy events, with trajectory badges.
Instructions
Rank log patterns by byte volume and cost per pattern (bytes priced at the destination's $/GB rate when one is set), over a time range, for one service or all. Each row carries a trajectory badge (NEW, ACUTE, GROWING, STABLE or SHRINKING) read against 7, 14 and 21 day baselines. Use for "what is expensive right now", "what are the noisy patterns in this hour", "give me a snapshot of my loudest events". For "what changed this week" or "did the deploy add cost", use log10x_whats_changing, which ranks patterns by change against a comparison_window baseline. Can be scoped by service label. timeRange accepts free-form <n><m|h|d> durations (e.g., 48h, 3d, 15m): there's no enum snap. Pass include to choose which cohort to rank: kept (default, what the Receiver forwarded), dropped (the offloaded / overflow cohort alone), or both (total ingest pre-receiver). Use dropped for "what is the receiver throwing away" and both for an apples-to-apples pre/post comparison. Accepts siem_lens (what-if destination): keeps the measured volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope. REQUIRES Reporter-tier metrics. Before anything is deployed, the POC tools answer the same question from the user's own logs.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary": the structured JSON envelope with patterns, incidents, totals, and chained-tool action hints. Field retained for backward-compat with callers that still pass `view: "summary"`. | summary |
| limit | No | Number of patterns to return. Default 10. | |
| offset | No | Skip the first N patterns of the ranked result (for pagination). Default 0. | |
| include | No | Which engine-decision cohort to scope to. `kept` (default) = events the engine forwarded as-is (routeState!="drop"): the pre-PL-12 behavior. `dropped` = events stamped routeState="drop" by the engine (the offload/down-tier cohort). `both` = the pre-decision union; per-row output adds kept_bytes / dropped_bytes / dropped_share_pct. Use `dropped` to verify post-deploy realised savings or to answer "which patterns are we offloading right now". Use `both` to compute the offload share denominator in a single call. | kept |
| service | No | Service name to scope the result. Omit for all services. | |
| verbose | No | When true, every card carries the full forwarder snippet inline, every CTA renders unconditionally, and the volume-trend chart shows on every top-3 card. Default: compact mode (snippet templated once at top, CTAs gated to where they earn their line, chart only on ACUTE/NEW patterns). | |
| severity | No | Severity level to scope the result (e.g., `ERROR`, `CRITICAL`, `DEBUG`). | |
| siemScope | No | Ignored: the summary envelope carries no verbatim sample line. Accepted so existing callers still validate. | |
| siem_lens | No | What-if destination lens: keep the measured volumes, price the $/mo columns at this destination's default rates (env-configured rates never cross destinations). Envelope stamps siem_actual vs siem_lens. | |
| timeRange | No | Time range to aggregate over. Default 1h. | 1h |
| environment | No | Environment nickname (for multi-env setups). | |
| analyzerCost | No | DEPRECATED: use effective_ingest_per_gb. stack ingestion cost in $/GB. Auto-detected from profile if omitted. | |
| include_chart | No | Set include_chart=true to embed the rendered chart inline (large; default false to avoid response truncation). | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. | |
| effective_ingest_per_gb | No | Customer-supplied $/GB rate used for the dollar overlay. When set, headline tags `rate_source=customer_supplied`. When absent, falls back to the destination default rate (`rate_source=list_price`; a list price only where the vendor sells logs per GB) or omits dollars entirely (`rate_source=unset`). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| tool | Yes | ||
| view | No | summary | |
| images | No | ||
| actions | No | ||
| summary | Yes | ||
| warnings | No | ||
| truncated | No | ||
| next_cursor | No | ||
| render_hint | No | ||
| generated_at | Yes | ||
| schema_epoch | Yes | ||
| schema_version | Yes |