Log Patterns

Log Patterns in LM Logs automatically group similar log messages, highlight high-frequency events, and surface trends and anomalies. This feature reduces log noise, accelerates troubleshooting, and helps identify the root cause of issues—especially in environments with high log volume.

Log Patterns are valuable for Managed Service Providers (MSPs), DevOps teams, and site reliability engineers by improving log visibility and reducing mean time to resolution (MTTR).

Log Patterns condense raw log data by identifying recurring structures. Each monitored resource generates a log profile, which stores the pattern structure, count, and timestamp of the first match. These profiles support both:

• Pattern grouping: Organizes logs with the same structure.
• Anomaly detection: Flags logs that do not match existing profiles.

For more information, see Log Anomaly Detection.

Log Patterns provide the following benefits:

• Automated log grouping—Reduces noise and simplifies identification of patterns and outliers.
• Pattern-based filtering—Highlights rare or unique logs by filtering on structure, not individual lines.
• Faster troubleshooting—Surfaces unusual logs quickly, improving MTTR and root cause analysis.

Log Patterns streamline analysis by surfacing only what is new or unusual. This approach makes it easier to detect early signs of issues and scale log monitoring effectively.

The following are some of the Log patterns use cases:

• Efficient issue troubleshooting in Alerts—In any LM alert with logs, use the Logs tab to filter and highlight rare messages. This helps teams focus on potential issues while ignoring common noise, making troubleshooting faster and more effective. Example: A rare log appearing just before an incident could reveal the root cause.
• Managing Log Overages and Costs—Exceeding log limits can lead to unexpected costs. Instead of disabling logs entirely, Log Patterns helps filter out unnecessary recurring logs, reducing ingestion without losing critical visibility. You can use the Logs tab on a Resource or the Logs Homepage to optimize costs efficiently.
• Anomaly Review & Log Hygiene—Many teams review logs weekly to keep them clean and error-free. Log Patterns helps by:
  • Identifying if an anomaly has become a recurring log
  • Confirming when an issue is resolved and no longer appears

Using Log Patterns within the alert workflow supports troubleshooting, while using them from the Logs page or Resource tree supports broader, proactive analysis.

Requirements for Accessing Logs Patterns

An active Logs subscription or trial SKU must be available.

Considerations for Accessing Logs Patterns

When viewing results from the Logs Home page, only the first 20,000 log entries are shown. To avoid missing data, narrow your query by adjusting the syntax or selecting a smaller time range. No message appears if your query exceeds the 20,000-entry limit.

Accessing Logs Patterns from Alerts page

1. In LogicMonitor, go to Alerts, and select the alert you want.
2. From the alert details panel, select the Logs tab.
   
3. Toggle the Show as Patterns switch to view logs in pattern.

Accessing Logs Patterns from Resource Tree

1. In LogicMonitor, go to Resource Tree, and select the resource or resource group you want.
2. From the resource details panel, select the Logs tab.
   
3. Toggle the Show as Patterns switch to view logs in pattern.

4. To view the query profile of the log pattern, select the more menu, and then select Query profile.
   
   The selected query is displayed in a new window.
   

The logs table lists the aggregated count of log profiles for the current query, for the selected time range. You can see profiles for any selected time range up to 30 days, default is 5 minutes.  For example, a current query shows a total of X log events registered within the last 5 minutes. These are reduced to X log profiles that can be further investigated.