detect_error_anomalies
Detect sudden error spikes in NDJSON logs via Z-score frequency analysis by time window, flagging anomalously high error counts for triage.
Instructions
Z-score frequency analysis to find sudden error spikes by time window.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| logFile | Yes | Absolute path to the NDJSON log file | |
| levelField | No | Field containing log level | level |
| errorValues | No | Level values to treat as errors | |
| windowMinutes | No | Aggregation window size in minutes | |
| timestampField | No | Field containing ISO timestamp | timestamp |
| zScoreThreshold | No | Z-score threshold above which a window is flagged as anomalous | |
| lineStartPattern | No | Regex that marks new log line start — enables multiline stack trace buffering |