Pattern Intelligence

ScryWatch automatically groups your log lines into patterns — so instead of reading 500 identical error lines, you see one pattern with a count of 500.

What you’ll need

• At least a few log events ingested (see Getting Started)

Step 1: Open the Patterns page

Click Patterns in the left sidebar.

You’ll see a table of patterns for your project, ranked by frequency (most common first). Each row shows:

• Pattern — the normalized message template (e.g. token validation failed for user {id})
• Level — the predominant log level for this pattern
• Count — total events matching this pattern
• First seen — when this message shape first appeared in your system
• Last seen — the most recent occurrence
• Services — which services emit this pattern

Note: Variable parts of your message (user IDs, request IDs, numeric values, file paths) are automatically replaced with {id}, {n}, {path}, etc. Two messages with different user IDs become one pattern.

Step 2: Read the frequency table

The Count column shows total events. Use it to identify your noisiest patterns — these are often benign (health checks, routine requests) but are worth confirming.

Sort by First seen (ascending) to see which patterns appeared earliest — these are your oldest recurring behaviors.

Step 3: Spot new patterns

Patterns marked New appeared for the first time within the last 24 hours. A new pattern is almost always worth a look — it means a message shape your system had never produced before just showed up.

Tip: After a deploy, check the Patterns page for new patterns. A new error pattern appearing right after a release is a signal worth investigating.

Step 4: Open a pattern detail

Click any pattern row to open the detail view.

The detail page shows:

• Registry metadata — first seen, last seen, total event count, which services emit it
• 48-hour hourly chart — event count per hour for the last 48 hours

Read the chart to understand:

• Spike then silence — a one-time event (common after deploys that were quickly rolled back)
• Steady baseline — a recurring pattern that’s been around for days (probably fine)
• Growing trend — frequency increasing over time (worth investigating)
• Sudden drop — pattern stopped appearing (could mean the service is down, or the bug was fixed)

Step 5: View raw events for a pattern

From the pattern detail, click View Logs to jump to Log Explorer pre-filtered to this fingerprint. You’ll see the raw events that matched this pattern.

You’re done

You now know how to:

• Read the patterns table and identify noisy, new, or trending patterns
• Interpret the 48-hour frequency chart
• Drill from a pattern into raw log events

Related docs

Pattern API reference — query patterns by frequency, get hourly breakdowns, and retrieve pattern registry metadata.