Welcome to InsightFinder Docs!

Log Analysis Legend

Technical Reference for Event, Pattern, Incident, and Compression Metrics

How to interpret the daily Log Analysis summary in InsightFinder AI

1  Legend overview

Each value in the legend is calculated for the selected Log Analysis time scope. The values should be interpreted as complementary signals rather than as a single severity score.

2  Volume and pattern intelligence

Total Logs

Total Logs is the count of individual log entries represented in the selected time interval. It is the raw activity denominator for the rest of the legend. A large Total Logs value can be completely healthy; it simply means more log activity was received and processed.

• Use Total Logs to understand traffic/telemetry volume and to normalize changes in event counts.
• A spike in Total Logs can make some event counts rise even when the percentage of anomalous behavior is unchanged.
• A sudden drop in Total Logs may be operationally important, but the count by itself does not identify the cause.

Total Patterns

InsightFinder groups structurally similar log messages into patterns. Total Patterns is the number of distinct patterns represented in the selected period. A pattern is a learned grouping of messages that the platform treats as the same underlying log behavior even when variable values differ.

• More patterns means greater message diversity, not necessarily more problems.
• Pattern count can rise after code changes, deployments, new integrations, or changes in log formatting.
• The relationship between Total Logs and Total Patterns provides useful context: many logs can collapse into relatively few recurring patterns.

New Patterns

New Patterns counts patterns that are new relative to the project’s learned history/model. Operationally, this is the first time InsightFinder has recognized that log structure as a known pattern.

• A new pattern may be harmless, such as a new deployment message, or important, such as a never-before-seen exception.
• New does not mean critical. It means previously unseen in the model’s learned context.
• The usefulness of New Pattern detection is highest when the project has an established baseline.

Rare Events

Rare Events identifies behavior that exists in the learned pattern space but occurs very few times relative to normal behavior. InsightFinder uses a configurable rare-event cluster-size threshold to decide when a pattern/event is rare.

• Rare is a frequency/novelty statement, not a severity judgment.
• Rare events are useful for one-off failures, unusual exception paths, and low-frequency conditions that rate-based rules can miss.
• The configured rare-event threshold determines how broad or narrow the definition of rare is.

3  Frequency and rule-based detections

Hot Events

A Hot Event occurs when the count of a log pattern increases significantly over a short period compared with its learned baseline. The detection is about frequency change, not just the message content.

• Typical interpretations include retry storms, repeated exceptions, connection failures, or a rapidly repeating warning.
• A common pattern can become hot if its rate suddenly increases.
• Hot-event sensitivity, thresholds, sampling interval, and number limits affect what is reported.

Cold Events

A Cold Event is the inverse frequency condition: a pattern occurs significantly less often than expected over a short period.

• Cold behavior can identify missing heartbeats, reduced transaction activity, disappearing success messages, or a service that stopped producing expected logs.
• A cold event is meaningful only when reduced frequency represents an abnormal operating condition.
• Cold-event sensitivity and thresholds determine how large a decrease must be before it is reported.

Critical Events

Critical Events are driven by configured critical-event rules or log labels rather than by novelty alone. They are intended for known conditions that should receive high-priority treatment when the configured criteria are met.

• Examples can include known critical strings such as fatal/error conditions when those rules are explicitly configured.
• A message can be common and still be critical if it matches a configured critical rule.
• The exact population of Critical Events depends on the project’s log labeling and critical-event configuration.

Keyword Alerts

Keyword Alerts are generated from configured keyword/whitelist/log-label rules. Instead of asking whether behavior is statistically unusual, this detector asks whether the log contains content the user explicitly configured as important.

• Useful for known error signatures, business-impact terms, vendor codes, or other deterministic conditions.
• Keyword Alerts depend on the project’s log-label/keyword configuration.
• Rule-driven alerts complement New/Rare/Hot/Cold detection by covering known-bad conditions.

4  Incidents and storage efficiency

Incidents

Incidents are downstream operational objects created when log detections meet the project’s incident criteria. A log anomaly or keyword match does not automatically imply an incident; promotion depends on the configured labels, scoring, escalation, and incident logic for the project/system.

• Multiple detections may contribute to or be consolidated into an incident.
• The Incident count can therefore be lower than the number of anomaly events.
• A zero Incident count does not mean no anomalous behavior occurred; it means no displayed log detections met the incident workflow criteria for that scope.

Original Size

Original Size is the approximate size of the log data represented before InsightFinder’s compressed log representation. It provides the baseline used to understand storage reduction.

Compressed Size

Compressed Size is the size of the compressed representation reported by InsightFinder Log Analysis after repetitive log data is represented more efficiently. The legend reports the resulting stored/represented size rather than the raw pre-compression size.

Decrease Ratio

Decrease Ratio expresses the percentage reduction between the original and compressed sizes.

Because the UI displays rounded units and a rounded percentage, recalculating from the displayed 7.2 MiB and 1000.9 KiB can differ slightly from the shown 86.3%. The system may calculate the ratio from more precise underlying byte values.

5  How to read the attached example

Useful context — without over-interpreting the counts

• 14 of the 92 displayed patterns are new, or about 15.2% of the pattern count. This is a descriptive ratio, not a severity score.
• 1,748 logs across 92 patterns is an average of about 19.0 logs per pattern, but actual pattern frequency can be highly uneven.
• The four Hot Events indicate frequency spikes somewhere in the learned pattern set; the legend alone does not identify which patterns or why they increased.
• The zero Incident count means the event activity did not result in a displayed incident for the selected scope; it does not erase the four Hot Event detections.

6  Detection relationship and quick reference

The easiest way to understand the legend is as a pipeline from raw log activity to learned behavior, detections, incidents, and storage reporting.

What to ask when a number changes