What's changing — patterns ranked by delta vs baseline
log10x_whats_changingRank log patterns by cost delta versus a baseline window to reveal what grew or shrank most since a given time, filtering noise-level changes.
Instructions
Patterns ranked by delta vs a baseline window — the "what grew (or shrank) the most since X" question. Distinct from log10x_top_patterns which ranks by current cost; this tool ranks by delta and applies gates (min_delta_usd, min_delta_contribution_pct) that drop noise-level changes. comparison_window: "auto" (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing; specific offsets like "7d" compare to a single anchor — e.g. {timeRange: "1d", comparison_window: "1d"} is today vs yesterday (deploy-delta), {timeRange: "7d", comparison_window: "7d"} is this week vs last week. Brand-new patterns (no baseline samples) are EXCLUDED — they go to log10x_whats_new for clean separation of stories. Restores the capability of the deleted log10x_cost_drivers tool (commit 27dce7d, chk-15) using the modern StructuredOutput envelope and the shared baseline machinery in top-volume-extras.ts / gates in lib/gates.ts. Use for "what grew most this week", "which patterns regressed after the deploy", "what's driving cost up since yesterday". Returns patterns with per-row delta_usd, baseline_usd, current_usd, delta_pct, and a flag for whether each row crossed the contribution gate.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. `summary` returns the structured envelope; `markdown` returns a rendered table. | summary |
| limit | No | Max patterns to return. Default 10. | |
| service | No | Service name to scope the result. Omit for all services. | |
| severity | No | Severity level to scope (e.g. `ERROR`, `CRITICAL`). | |
| timeRange | No | Current window to evaluate. Day-level only — delta math requires day-aligned baseline offsets. For sub-day spike investigation use `log10x_pattern_trend` or `log10x_investigate`. | 7d |
| environment | No | Environment nickname (for multi-env setups). | |
| analyzerCost | No | SIEM ingestion cost in $/GB. Auto-detected from profile if omitted. | |
| min_delta_usd | No | Dollar floor for delta. Rows with delta < min_delta_usd are dropped. Default $500/wk scaled to the selected timeRange window. Set to 0 to disable. | |
| comparison_window | No | Baseline window to compare against. `"auto"` (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing. A specific offset like `"7d"` compares to that single anchor — e.g. `{timeRange: "1d", comparison_window: "1d"}` = today vs yesterday (deploy-delta); `{timeRange: "7d", comparison_window: "7d"}` = this week vs last week. | auto |
| min_delta_contribution_pct | No | Contribution gate as a percentage. A row's delta must be at least this fraction of total positive delta to be surfaced. Default 5. Set to 0 to disable. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| tool | Yes | ||
| view | No | summary | |
| images | No | ||
| actions | No | ||
| summary | Yes | ||
| warnings | No | ||
| truncated | No | ||
| next_cursor | No | ||
| render_hint | No | ||
| generated_at | Yes | ||
| schema_epoch | Yes | ||
| schema_version | Yes |