Log Patterns

Log Patterns show you the shapes of log actually arriving in your project. Before you can parse a log source you need to know what you are receiving, and in what form — pattern detection answers that without anyone having to go and look at raw events.

Once a pattern is identified, you can build a log parser for it directly, or check whether a parser template already covers it.

Log Patterns

Log Patterns represent automated detection of common log structures. This feature enables state-of-the-art automated log enrichment by identifying patterns in your log data and allowing you to build parsers from them.

How Log Patterns Work

1. Pattern Detection: The log pattern detector container (deployed separately) analyzes incoming log data
2. Pattern Identification: Common structures are identified and normalized into patterns with wildcards (<*>) representing variable fields
3. Pattern Review: You can review detected patterns in the Log Patterns page
4. Parser Building: Select a pattern and use the interactive builder to extract fields and create parsers

Example Pattern

A detected pattern might look like:

<190>1 <*> <*> nginx - - - 2026/01/12 <*> [info] <*> <*> client <*> closed keepalive connection

The <*> symbols indicate fields that vary between log entries. You can:

• Click on <*> positions to define them as extractable fields
• Name the fields (e.g., timestamp, log_level, client_ip)
• Build a parser that automatically extracts these fields from matching logs

Interactive Parser Builder

When working with Log Patterns, the portal provides an interactive parser builder:

1. Pattern Display: The detected pattern is shown with clickable elements
2. Field Selection: Click on <*> wildcards to mark them for extraction
3. Field Naming: Provide meaningful names for extracted fields
4. Condition Configuration: Set when the parser should apply (e.g., “Always” or based on specific field values)
5. VRL Generation: The system automatically generates VRL code based on your selections
6. Static Fields: Optionally add static key-value pairs to all parsed events
7. Target Parser: Choose to add to an existing parser or create a new one

Deploying the Log Pattern Detector

The log pattern detector is a separate container that must be deployed alongside your collector. Documentation for deploying and configuring the log pattern detector will be available separately.