Skip to content

Get recurring log patterns, clustered by normalised message template.

GET
/logs/patterns
curl --request GET \
--url https://api.siteqwality.com/logs/patterns \
--header 'Authorization: Bearer <token>'

Clustered log patterns

Media type application/json
object
patterns
required
Array<object>
object
template
required

Normalised message template, e.g. “Connection timeout to {IP}:{NUM} after {NUM}ms”

string
count
required

Total count of log entries matching this template in the query window

integer format: int64
first_seen
required

ISO 8601 timestamp of the earliest matching log in the window

string
last_seen
required

ISO 8601 timestamp of the most recent matching log in the window

string
samples
required

Up to 3 raw message samples from the matching logs

Array<string>
investigate_search
required

Pre-built search term for the “Investigate” button: distinctive non-placeholder tokens from the template, joined.

string
previous_count

Count of this template in the previous equal-length window. Absent when the request has no time range, so no comparison ran.

integer | null format: int64
change_pct

Integer percent change vs the previous window: (count - previous) * 100 / previous. Absent when previous_count is missing or zero (a new pattern has no percentage).

integer | null format: int64
is_new
required

True when the comparison ran and this template was absent from the previous window.

boolean
messages_examined
required

Total distinct messages examined before clustering

integer format: int64
generated_at
required
string
previous_window_start

Start of the previous equal-length window used for is_new / change_pct.

string | null
previous_window_end

End of the previous equal-length window (equals the current window start).

string | null
Example generated
{
"patterns": [
{
"template": "example",
"count": 1,
"first_seen": "example",
"last_seen": "example",
"samples": [
"example"
],
"investigate_search": "example",
"previous_count": 1,
"change_pct": 1,
"is_new": true
}
],
"messages_examined": 1,
"generated_at": "example",
"previous_window_start": "example",
"previous_window_end": "example"
}

Missing or invalid authentication

Internal server error