Welcome to InsightFinder Docs!

Default: PrivateCloud

Default Value: UTC

Default Value: 600

Default Value: 90

Default Value: 90

Options:

• 0: Enable the anomaly detection (Default Value)
• -1: Disable  the anomaly detection

Default value: 60

Enable/Disable the system to automatically “escalate” incidents based on escalation_anomaly_score_threshold.

Options:

• false: Disable escalation logic. (Default value)
• true: Enable escalation logic.

If the calculated anomaly score is greater than or equal to this threshold, the system flags it for escalation.

Range: Typically between 0.0 and 1.0 (representing a percentage-based score).

• 1.0 would mean only the most extreme anomalies are escalated.
• 0.1 would mean almost any deviation is escalated.

Let the system ignore anomalies that have a score below this specific value.

• Default Value: 0.0
• Type: Float (Decimal).
• Range: Typically 0.0 to 1.0.
  • A value of 0.3 means any anomaly with a score of less than 0.3 will be completely discarded or ignored by the system.

Enable/Disable hot/rare event detection.

• Type: Boolean.
• Default Value: true
• Values:
  • true: The system will monitor for and report frequency-based log spikes. 
  • false: The system will ignore log frequency spikes for known patterns.

Sets the limit for the maximum allowable count of a specific log pattern within a sampling interval before it is classified as an anomaly.

• • Type: Integer.
• Default value: 50

• Range: Must be >= 0.
  • Setting it to a very high number effectively suppresses Hot Event alerts.

Once a specific log pattern triggers a “Hot Event” anomaly, the system starts a “calm down” timer. Any subsequent spikes of that same pattern within this period will be recorded but will not generate new alerts or incidents.

• • Type: Integer.
• Default value: 3

• Unit: Sampling intervals (multiples of your anomaly_sampling_interval).
• Range: Must be > 0.
  • If set to 0 or less, the system automatically falls back to the default value.

This option tells the system how to decide if a volume of logs is high enough to be considered “Hot.”

Default value: 0

Options:

• 0: Uses the standard detection logic (often combining static thresholds and basic heuristics)
• 1: Uses an advanced statistical approach or a different internal engine to detect spikes relative to moving averages.

It limits the total number of unique log patterns that can be classified as “Hot” within a single processing cycle or stored in the project’s state.

• • Type: String (internally parsed as an ). Integer
• Default value: 20

• Range: Must be a numeric string representing a positive integer.
• Behavior: If the value is empty or not set, the system effectively treats it as infinity (). Integer.MAX_VALUE

Defines the sensitivity for triggering “Cold Event” alerts.

• Type: Integer.
• Default value: 10
• Range: Must be >= 0.
  • Setting it to 0 essentially disables cold event detection, as a count cannot be lower than zero

The maximum number of cold events detected per day

Default value: 0

Defines how the system categorizes and handles “rare” (infrequent or new) log patterns during anomaly detection.

Default Value: 0

Options:

• 0: Default/All Rare Events: Detects both completely new patterns and known patterns that appear with very low frequency.
• 1: Only alerts when a log template is seen for the first time.
• 2: Only alerts when an existing template contains a new/rare value.

It sets a limit on the cluster size or frequency of a rare event before it triggers an alert.

• • Type: Integer.
• Default value: 1

• Range: Must be >= 0.
  • A higher value makes the system less sensitive (the event must occur more frequently to be considered a “rare anomaly”).
  • A lower value (like 1) makes the system highly sensitive, alerting on the very first occurrence of a rare pattern.

It limits the total number of unique log patterns that can be classified as “Rare” at once.

• Type: String
• Default value: 20
• Range: A numeric string representing a positive integer.

It determines whether the system should capture and store every single rare event it encounters or only a representative subset.

• • Type: Boolean.
• Default value: false

• Values:
  • true: Collect and analyze all rare events without exception.
  • false: Use standard (potentially sampled) collection for rare events.

• • Type: Boolean.
• Default value: false

• Values:
  • true: Emails will be sent when new alerts are generated.
  • false: Email notifications are suppressed (even if alerts are being generated in the UI).

A configuration for Log projects that manages how the system identifies and presents “new” vs. “recurring” anomalies in the UI and notification pipeline.

• • Type: Boolean.
• Default value: false

• Values:
  • true: The system specifically tracks and flags the “newness” of log alerts.
  • false: All anomalies are treated standardly without special “new” status flagging.

Determine the duration over which the system calculates average metric values when evaluating alert conditions.

• • Type: Integer.
  • Unit: Minutes (typically).
• Default value: 0

• Range: Must be > 0.
  • A value of 1 means virtually no smoothing (the most recent data point dominates).
  • A value of or 30 provides significant smoothing for stable, long-term trends. 15

• • Type: Float / Double (Decimal).
• Default value: 0.0

• Unit: Currency (e.g., USD per hour).
• Range: Must be >= 0.0.

It switches the metric detection engine from a traditional batch-processing mode (which might run every few minutes) to a Streaming Detection mode.

• • Type: Boolean.
• Default value: false

• Values:
  • true: Enables the streaming detection pipeline.
  • false: Uses the standard batch-based detection.

Default value: 10000

Example: Set this value to 10000

The log detection will be triggered immediately if at least 10000 log entries are available in a batch. Otherwise the log detection will wait until 3 minutes later.

Default value: 30000

Example: Set this value to 30000

The log detection will be triggered immediately if at most 30000 log entries are available in a batch. Otherwise the log detection will wait until 3 minutes later.

Default value:1024

The limit of different patterns. If the pattern generate more than the number, then the new pattern will be all assigned as MISC(-2) miscellaneous pattern

Default value: 10000

The number of the logs to train the model

Default value:200

The number of the feature vectors generated for training the model

Default value: -1

The keyword setting when collecting and using during the keyword query.

-1 is disabled as default. 0 is letter only, 1 is letter and number

Default value: 0

The keyword selection during the model training.

Default 0 is letter only, which only collects the keywords are pure alphabet.

1 is lettern and number

Default value: false

Collect the frequency of keywords for the model training

Default value: false

Setting to disable saving the log data

Default value: “[5,0.01,0.0075,0.01,1,100]”

Setting to adjust the anomaly score weight for different type of events

Rare, hot, cold, detection alert, new pattern, critical

Default value: false

To enable the regex multiline flag

Default value:false

This one is deprecated.  

Default value: false

Enable this the system will reform the invalid json data into valid one

• • Type: String (internally parsed as a non-negative Integer).
• Default value: 0

• Unit: Minutes.
• Range: Must be >= 0.

• • Type: String (internally parsed as an ). Integer
• Default value: 0

• Unit: Minutes.
• Range: Any non-negative integer.

It sets a numerical limit on the maximum number of predicted incidents that the system will track, display, or alert on within a single processing window.

• • Type: String (internally parsed as a non-negative Integer).
• Default value: 5

• Range: Must be >= 0.
  • The API validates this using . isNonNegativeNumString
  • A value of 0 would effectively suppress all predicted incident displays.

• • Type: String (internally parsed as a ). Long
  • Unit: Minutes (though internally converted to milliseconds for calculations).
  • Range: Any positive numeric string.
• Default value: The default value is typically 60 (1 hour) or matches the incident_prediction_window, depending on the project type.

• • Type: Integer.
• Default value: The default value is typically 10 or null (which the UI often interprets as a standard limit of 10).

• Range: Must be a non-negative integer (>= 0).
  • The API validates this using . isNonNegativeNumString
  • A value of 0 would effectively hide all root cause suggestions.

• Type: Double / Float (Percentage).
• Range: 0.0 to 1.0.
  • The API validates this using . isValidSettingPercentage
  • Values are often passed as strings (e.g., “0.5”) and parsed into doubles.
• Default value: The default value is 0.8 (80%).

• Type: String (internally parsed as an or ). Integer Long
• Unit: Minutes.
• Range: Must be a non-negative numeric string (>= 0).
  • The API validates this using . isNonNegativeNumString
• The default value is typically 60 (1 hour).

While other settings filter root causes by probability or count, this setting determines the ranking logic itself.

• Type: String (internally validated as a non-negative numeric string).
• Values: Typically integers representing internal modes:
  • 0: Default ranking logic (balanced).
  • 1+: Alternative ranking modes (e.g., higher weight on specific data types or different statistical models).
• The default value is typically 0.

It defines the absolute maximum number of root cause entries that the system will process and present to the user.

• Type: Integer.
• Range: Must be a non-negative integer (>= 0).
  • The API validates this using . isNonNegativeNumString
  • Setting it to 0 triggers the system to use a built-in global default.
• The default value is typically 20.

• Type: Float / Decimal.
• Unit: Currency (e.g., USD).
• Range: Any positive numeric value.
• The default value is 0.0.

Options:

• 0: Default. The most comprehensive mode. It looks for causal links both within the project and across all other accessible projects.
• 1:Restricts causal search to within the current project only. Faster, but might miss external root causes.
• 2:Only looks for relationships where the cause originates from a different project.

• Type: String (internally parsed as a ). Long
• Unit: Minutes (though internally converted to milliseconds for processing).
• Range: Any non-negative numeric string (>= 0).
  • The API validates this using . isNonNegativeNumString
• The default value is typically 0 (meaning no minimum delay is enforced), though in some contexts it falls back to a global default for “valid range” calculation.

A configuration for Log projects that controls the exhaustiveness of the data used during causal analysis and Root Cause Analysis (RCA).

It determines whether “normal” log events—those that are not flagged as anomalies—should be included as potential candidates when searching for the root cause of an incident.

• Type: Boolean.
• Values:
  • true: Include all events (normal and anomalous) in causal analysis.
  • false: Only use anomalous events for causal analysis.
• The default value is false.

It acts as a “frequency gate” for the predictive engine.

• Type: Integer.
• Range: Must be a non-negative integer (>= 0).
  • The API validates this using . isNonNegativeNumString
  • A value of 1 means any single piece of evidence is enough to trigger a prediction.
• The default value is 1.

It serves as a confidence filter for proactive incident forecasting.

• Type: Double / Float (Percentage).
• Range: 0.0 to 1.0.
  • The API validates this using . isValidSettingPercentage
  • A value of 0.9 means only incidents with a 90% or higher predicted likelihood will trigger an alert.
• The default value is 0.8 (80%).

• Type: Integer.
• Modes: Typically represents internal logic states:
  • 0: Unfiltered. Use all discovered rules for prediction immediately.
  • 1: Verified Only. Only use rules that have successfully predicted an event at least once in the past (verified by the ). IncidentRelationProcessor
  • 2+: High Confidence. Requires multiple historical verifications or specific statistical significance.
• The default value is typically 1 (Verified Only).

• Type: Double (Percentage).
• Range: 0.0 to 1.0.
  • The system validates that the must be greater than or equal to the to be valid. activeThresholdinactiveThreshold
• The default value is typically 0.7 (70%).

It defines the maximum allowable false-positive rate for a causal rule before the system stops using it for proactive alerting.

• Type: Double (Percentage).
• Range: 0.0 to 1.0.
  • 0.1 means a rule is disabled if more than 10% of its predictions are false positives.
  • 0.5 means a rule is kept until it is wrong more than half the time.
• The default value is typically 0.3 (30%).

It acts as the lower boundary for a causal rule’s confidence score. It is the counterpart to the prediction_rule_active_threshold.

• Type: Double (Percentage).
• Range: 0.0 to 1.0.
  • Logic Constraint: The must be less than or equal to the to be valid. inactiveThresholdactiveThreshold
• The default value is typically 0.5 (50%).

• Type: Boolean.
• Values:
  • true: Apply instance name conversion and normalization.
  • false: Keep instance names exactly as they appear in the raw log stream.
• The default value is false.

• Type: Boolean.
• Values:
  • true: The system will alert you if an instance stops reporting data.
  • false: The system will not generate alerts for missing data streams.
• The default value is false.

It determines whether “Instance Down” events should be displayed in the project’s dashboards, anomaly timelines, and incident reports.

• Type: Boolean.
• Values:
  • true: Display instance down events in the UI.
  • false: Hide instance down events from the UI.
• The default value is true.

• Type: Boolean.
• Values:
  • true: Isolate analysis by instance.
  • false: Aggregate analysis across the entire project.
• The default value is typically true.

• Type: Boolean.
• Values:
  • true: Ignore the instance name when matching against the Knowledge Base (match by pattern only).
  • false: Require the instance name to match for a KB lookup to be valid.
• The default value is false.

It acts as an environmental architectural flag that adjusts the system’s operational logic and resource consumption.

• Type: Boolean.
• Default value: false
• Values:
  • true: Project is treated as an “Edge” instance.
  • false: Project is treated as a standard “Brain/Cloud” instance.

It identifies the project as a Trace Prompt monitoring system. When enabled, it activates a suite of LLM-specific evaluation and observability features:

• Type: Boolean.
• The default value is false.
• Values:
  • true: The project is treated as an LLM Trace/Prompt evaluation project.
  • false: The project is treated as a standard system/application log project.

It defines the address of a proxy server that the InsightFinder platform must use when communicating with external systems or when an “Action” (like an automated remediation script) needs to be executed on a remote server.

• Type: String.
• Default value: The default value is null or an empty string.
• Format: Typically a URL or Hostname with an optional port (e.g., http://proxy.internal:8080).

It defines how many days of historical data the machine learning engine should look back on to create the baseline for “normal” behavior.

• Type: Integer.
• Unit: Days.
• Range: Must be >= 1.
  • A value of 1 means the model only uses the previous 24 hours of data.
  • Higher values (e.g., 14 or 30) provide a much more robust statistical baseline.
• The default value is 1.

It defines the minimum required duration (in milliseconds) of data that must be present in a model for it to be considered “valid” and ready for production use.

• Type: Long.
• Unit: Milliseconds.
• Range: Must be > 0.
• The default value is typically 21,600,000 ms (which equals 6 hours).

It defines the maximum amount of time (in minutes) the log anomaly detection engine will wait for late-arriving logs before proceeding with the analysis for a specific time window.

• Type: Long.
• Unit: Minutes (internally converted to milliseconds).
• Range: Typically between 1 and 60.
• The default value is typically 15 minutes.

It defines the degree of parallelism the system uses when executing heavy background tasks like log training, log detection, or log replay for a specific project.

• Type: Integer.
• Range: Typically 1 to 16.
  • The API enforces a minimum floor of 1 (via ). GlobalConstant.DEFAULT_MAXIMUM_THREAD_COUNT
  • Setting it to 1 forces sequential processing (Single Threaded).
• The default value is 1.

It defines the “depth” or “number of hops” the system traverses in the causal dependency graph to find a root cause.

• Type: Integer.
• Range: Must be a non-negative integer (>= 0).
  • The API validates this using . isNonNegativeNumString
  • A value of 0 effectively disables deep causal searching beyond the most obvious correlations.
• The default value is typically 1.

• Type: String (internally parsed as an ). Integer
• Range: Any positive numeric string.
• The default value is typically 10.

It sets a numerical cap on the number of unique, previously unseen log patterns that the system is allowed to identify and track during a single processing interval.

• Type: String (internally parsed as an ). Integer
• Range: A numeric string representing a positive integer.
• Behavior: If the value is empty or null, the system effectively treats it as infinity (). Integer.MAX_VALUE

t defines a temporal window or suppression period for alerts triggered by new log templates.

• Type: Integer.
• Unit: Sampling intervals (multiples of your anomaly_sampling_interval).
• Range: Must be >= 0.
• The default value is typically 3 (intervals).

It toggles between Local and Global pattern modeling for your logs.

• Type: Boolean.
• Values:
  • true: Share log patterns across all instances in the project (Project Model).
  • false: Isolate log pattern learning to each individual instance (Instance Model).
• The default value is typically true.

It informs the internal processing engine that the project contains an exceptionally large number of instances or a very high data throughput. Enabling this flag triggers several optimizations:

• Type: Boolean.
• Values:
  • true: Optimize the project for large-scale data and high instance counts.
  • false: Use standard processing logic for small to medium-sized projects.
• The default value is false.

It determines how similar two log messages must be for the system to group them under the same Log Template (Pattern).

Values:

• high: Very strict; logs must be almost exactly the same.
• medium: Default. Balanced approach for most standard application logs.
• low: Loose; groups logs even if they have significant differences.

In addition to analyzing message patterns, the system extracts numerical “features” from log messages (e.g., latency values, status codes, or thread counts). This setting controls the threshold for marking those values as outliers.

Values:

• high: Highly sensitive; flags minor statistical deviations.
• medium: Default. Balanced; flags significant deviations.
• low: Least sensitive; only flags extreme statistical outliers.

It defines a manual override or hard limit for numerical outlier detection.

• Type: Float.
• Range: Any numeric value.
• Behavior:
  • If set to 0.0, the system relies entirely on the statistical logic defined by feature_outlier_sensitivity.
  • If set to a positive value, it acts as a hard limit for detection.
• The default value is 0.0.

It acts as a historical filter for incident generation. When enabled, the system suppresses incidents that occur outside of a “known training window.”

• Type: Boolean.
• Values:
  • true: Filter incidents based on historical training windows.
  • false: Do not filter; allow all detected incidents to be reported regardless of historical training alignment.
• The default value is typically false.

Think of it like a “VIP list” for your logs. If a log message matches a pattern on this list, the system recognizes it as normal behavior and doesn’t flag it as an issue.

• Format: It accepts any whole number (e.g., 50, 100, 500).
• Default value: 100

It tells the AI which specific field (or “key”) in your logs contains the information about a “Zone.” A “Zone” usually refers to something like a Cloud Region (e.g., us-east-1), a Data Center (e.g., DC-01), or a specific environment area.

Available Values

• Format: This is a Text String.
• What to enter: You enter the name of the attribute as it appears in your log files (often in JSON logs).

JSON array string of log labels, for the log is json structure (e.g., ‘key=[“ERROR”,”WARN”]’ or ‘key=^\d+$’)