10x Stable Patterns

A pattern for every log line, worked out from the code that prints it, the same on every host.

The same log message repeats millions of times with only the timestamp or request ID changing, so any tool that counts, budgets or routes logs first collapses the repeats into one message type, a pattern. Volume and cost attach to the pattern, not to any single line.

Splunk, Datadog and Elastic build each pattern from the traffic itself, most of them with the open-source algorithm Drain: lines that look alike form a group, the words they all share become the pattern, and a new line that disagrees blanks the spot where it disagrees. Patterns built this way are unstable, and everything keyed on one quietly stops matching as traffic shifts.

10x reads its patterns out of the code of the frameworks and libraries that print the lines. A line matches its pattern the first time it appears, every host matches it to the same pattern, and the pattern stands still while the traffic changes.