Edge Delta Patterns Page

Patterns in the Edge Delta web application.

  4 minute read  

Patterns Page

Click Logs and select the Patterns tab to view the Patterns page.

This page displays detected patterns including those with a negative sentiment. It is populated based on the configurations of your Log to Pattern nodes. This processor type finds patterns in logs, and then groups (or clusters) these patterns based on similarities.

Note: Bear in mind the relationship between the reporting frequency (default 3 minutes) in the log to pattern node and the x-axis interval in the Patterns Explorer, which is 1 minute. A reporting frequency of 3 minutes results in no data for two intervals in the explorer followed by an aggregation of the past three minutes. This may be suitable for most use cases but you can reduce the reporting frequency to less than 1 minute to reduce graph variation and identify exact moments of anomalous behavior.

Negative Patterns Filter

A negative pattern is based on the negative terms in the Sentiment Patterns section of the Global Settings tab on the Admin page.

If any negative term is detected in a pattern, then that pattern will be considered a negative pattern; however, if a neutral term is also contained in the pattern, then the pattern will not be considered negative. In other words, if a pattern contains both a negative and a neutral term, then the neutral term will override the negative term.

Pattern Lifecycle

You can filter the patterns charts and table by the pattern lifecycle in the Filters pane. For example you can choose to view only new patterns that have appeared for the first time during the lookback period. Or you can select Gone to view only patterns that no longer appear compared to the previous lookback period. This status aligns with the Delta column in the patterns table.

Viewing Chart Details

Hover over a specific chart entry to view the Name, Count and Timestamp.

You can click on a specific chart entry to open the Cluster Samples page to view cluster-related information for the selected chart entry, including a breakdown of the detected pattern.

Top Negative Patterns Table

You can click a specific table entry to open the Cluster Samples page to view cluster-related information for the selected table entry, including a breakdown of the detected pattern.

Pattern

This column displays the name of the detected pattern. Pattern names are based on the agent’s configuration, specifically clustering processors.

Count

This column displays the number of detected instances of the pattern within the configured lookback period.

% Of Total

This column displays the percentage of the pattern that was detected in relation to all other detected patterns. For example, if this column displays 18%, then the corresponding pattern makes up 18% of all detected patterns.

Sentiment

This column displays the sentiment score for the corresponding pattern.

A sentiment score can range from a negative number to 0.

In this column:

  • A negative number is represented by a thumbs down.
  • A neutral number is represented by a double arrow <->.

Delta

This column displays a percentage to indicate if the pattern’s detection increased or decreased in the previous period specified in the Filter pane.

Filter Options

Add Facets

You can add a custom facet to the filter widget. Click one of the kebab icons on a group and select Create Facet.

You specify a dimension, for example, the group by parameter you set in the Log to Pattern node.

Group By

This option allows you to filter data based on data sources. The listed data sources are based on the selected tag and source type. To select a tag and source type, click Filters. Select a tag, and then select an input type. The Group By menu will refresh with data sources associated with the tag.

Compare to

  • Previous Period This option will add a Previous Period measure to the All Patterns chart to indicate if the pattern’s detection increased or decreased compared to the previous lookback period.

  • 24h Prior This option will add a new column in the Top Patterns table, named Delta 24h. This column will display a percentage to indicate if the pattern’s detection increased or decreased in the previous 24 hours.

  • 7d Prior This option will add a new column in the Top Patterns table, named Delta 7D. This column will display a percentage to indicate if the pattern’s detection increased or decreased in the previous 7 days.

Volatile

This option will display newly detected patterns or patterns with a high anomaly score.

Unique

This option will display one chart entry for each detected pattern; the chart will not display multiple entries for the same pattern. Specifically the label for the y-axis of the graphs will update to display Unique Counts.

Extra Filtering Options

Click on a particular dimension in the legend to show (or hide) it.

Alerts

You can create a monitor to analyze a pattern’s behavior. If an anomaly is detected with the pattern data, then the monitor will send an alert.