Log Patterns

Log Patterns in LM Logs automatically group recurring log messages, highlight their frequency, and reveal trends. Use Log Patterns to organize similar log entries to focus on raw logs, anomalies, and outliers that could indicate the root cause of issues. Log Patterns is a major advancement in LM Logs that helps MSPs, IT teams, and engineers quickly surface insights from high-volume logs. It reduces noise, speeds up troubleshooting, and lowers costs—making it essential for teams using LM Logs at scale.

Log patterns represent a condensed view of raw log event data. Log profiles are stored internally for every resource, and contain information about structure, counts and time of first match. The profiles are used for both Log Pattern functionality as well as Log Anomaly detection. Logs that do not match a profile are flagged as an anomaly. For more information, see Log Anomaly Detection. Log patterns enables you visibility into these log profiles and are helpful when investigating issues as they let you break down profiles with the same structure, but different parameters.

Log Patterns provide the following benefits:

• Automated Log Grouping – Organizes similar log entries, cutting down noise and making trends and outliers easy to identify.
• Pattern-Based Filtering – Filters logs by recurring patterns instead of individual lines, highlighting rare logs to identify potential issues.
• Faster Troubleshooting & MTTR Reduction -Helps teams focus on uncommon logs, speeding up root cause analysis and detecting issues early.

By leveraging Log Patterns, you can streamline your log analysis, detect early warning signs of issues, and significantly reduce incident response times.

The following are some of the Log patterns use cases:

• Efficient issue troubleshooting in Alerts – In any LM alert with logs, use the Logs tab to filter and highlight rare messages. This helps teams focus on potential issues while ignoring common noise, making troubleshooting faster and more effective. Example: A rare log appearing just before an incident could reveal the root cause.
• Managing Log Overages and Costs – Exceeding log limits can lead to unexpected costs. Instead of disabling logs entirely, Log Patterns helps filter out unnecessary recurring logs, reducing ingestion without losing critical visibility. You can use the Logs tab on a Resource or the Logs Homepage to optimize costs efficiently.
• Anomaly Review & Log Hygiene – Many teams review logs weekly to keep them clean and error-free. Log Patterns helps by:
  • Identifying if an anomaly has become a recurring log
  • Confirming when an issue is resolved and no longer appears

Considerations for Accessing Logs Patterns

When viewing results from the Logs Home page, only the first 20,000 log entries are shown. To avoid missing data, narrow your query by adjusting the syntax or selecting a smaller time range. No message appears if your query exceeds the 20,000-entry limit.

Accessing Logs Patterns from Alerts page

1. In LogicMonitor, go to Alerts, and select the alert you want.
2. From the alert details panel, select the Logs tab.
   
3. Toggle the Show as Patterns switch to view logs in pattern.

Accessing Logs Patterns from Resource Tree

1. In LogicMonitor, go to Resource Tree, and select the resource or resource group you want.
2. From the resource details panel, select the Logs tab.
   
3. Toggle the Show as Patterns switch to view logs in pattern.

4. To view the query profile of the log pattern, select the more menu, and then select Query profile.
   
   The selected query is displayed in a new window.
   

The logs table lists the aggregated count of log profiles for the current query, for the selected time range. You can see profiles for any selected time range up to 30 days, default is 5 minutes.  For example, a current query shows a total of X log events registered within the last 5 minutes. These are reduced to X log profiles that can be further investigated.