AI Log Patterns

How it works

As logs are ingested, our Dash0 the log messages to:

1. Identify recurring patterns across similar log messages
2. Extract the variable portions as named attributes, which can be strings, numerics (floating point) or booleans
3. Make both the pattern and extracted attributes available for querying

For example, log messages like:

• User alice123 logged in from 192.168.1.100Copy
• User bob456 logged in from 10.0.0.25Copy

Would be recognized as following the pattern: User <username> logged in from <ip_address>Copy

The extracted attributes would be:

• username: alice123Copy or bob456Copy
• ip_address: 192.168.1.100Copy or 10.0.0.25Copy

Using Log Patterns

In the Patterns tab

Navigate to the Dash0 logging view and click on the Patterns tab.

• The list shows a count of matching logs by pattern, with a breakdown by severity. The counts also reflect the selected timeframe and filters
• You can hover over a pattern and click on +/- to update the filters, showing only logs that match/don't match that pattern

In the Log record panel

Navigate to the Dash0 logging view and click on a log record. The log record details are displayed in a panel on the right had side.

• When hovering over the log body, a pop up shows whether it matches a pattern, and which. You can click on +/- to filter by that pattern
• In the attributes section, the variables extracted via log pattern are listed under the tab that says "AI Derived". You can click on +/- to filter by any of those attributes

In queries and filters

• Use the attribute dash0.log.patternCopy to filter or group logs by pattern
• Use attributes like dash0.log.attributes.<key>Copy to filter or group logs by an extracted attribute

Example:

PromQL query grouping logs by ad_category attribute
123456
sum(increase(
    dash0_logs_total{
        dash0_log_pattern = "Requesting ad for <ad_category>"
    }[10m]
))
by(dash0_log_attribute_ad_category)

In the Check Rules

Patterns and extracted attributes can be referenced in the query builder, as well as in the check rule summary and description.

Limitations

Beta stage

This feature is currently in open beta as we work on model improvements to increase pattern accuracy and attribute extraction quality.

JSON logs

The focus of this feature is to understand unstructured logs; logs with structure body, like JSON logs, are not modified.

Pattern selection

For performance reasons, we limit the number of patterns per instrumented workload, selecting the ones that the model considers to be more relevant at the moment of ingestion.

Pattern updates

If the logging behavior of your workload(s) change, it may take a couple hours until the new patterns are identified.

We also limit the amount of weekly pattern inferences per organization, so if your workload(s) recently had many changes to their logging behavior, it is possible that the new patterns take a bit longer than usual to come up.

Resource attribute dependency

This feature only applies to logs that have enough resource attributes for contaxtualization. Please find here our recommended best practices for ensuring resource attribute sufficiency.