An environment-wide audit had log10x_investigate flagging patterns as "+100%" spikes; a per-service rerun on the same data found nothing crossed the noise floor. Two answers from the same tool, same data. The bug was in the topk rate-change query, where we divide the current
An earlier port shipped a Rust executable UDF, on the assumption a compiled binary would beat interpreted SQL. It lost by about 100x on bulk decode: roughly 5.8 s for the full 137K-row table against 60 ms for the SQL path. We deleted the binary. What replaced it
Open any Kubernetes control-plane log and you'll see lines like E1023 14:30:45.123456 controller.go:123 connection refused. That E is the severity. There's no word ERROR in the line. klog glues severity to the front of the timestamp as a single character.
Most pattern-detection in mature observability platforms runs at query time. Splunk's cluster command, Datadog's Log Patterns view, Elastic's categorize_text aggregation all work this way. Feed any of them the same log line through two different searches and you can land in two