10x Stable Patterns

Patterns from traffic break

Tools that count, budget or route logs group them into patterns (the fixed wording of a line, with only the values changing). Splunk, Datadog and Elastic each work their patterns out of the traffic itself, most with the open-source algorithm Drain, and patterns built that way are unstable. When traffic shifts, the same lines get filed under new patterns: an alert built on the old one stops firing, and a dashboard reads zero while the lines keep flowing.

Building patterns that hold

10x’s algorithm infers each line’s pattern from a vocabulary rather than from the surrounding traffic. The vocabulary is the words that framework and library code prints, compiled in advance from open-source projects, and you can extend it from your own environment. The same line gets the same pattern on every machine, and the pattern does not change as traffic shifts.

Acting on stable patterns

Stable patterns enable acting on log statements across hosts, restarts and deployments. Tier noise down and bring it back, compact repeats in place, offload whole patterns to your own S3 with instant retrieval.