Patterns and findings

You will learn how Cordo groups log lines into patterns, how anomaly detection turns changes in those patterns into findings, and why every finding can explain itself.

Monitors watch the signals you chose in advance. Anomaly detection watches the ones you did not think of: Cordo compares a stream with its own history and lists anything unusual on Findings, without you writing a rule first.

The nouns

Noun	What it is
Pattern	A log line template with the variable parts masked, such as `payment <*> declined for <EMAIL>`. Every event that fits the template counts towards the pattern.
Finding	Something unusual the anomaly scan spotted: a new pattern, a spike or drop in one, a shift in error rate or volume, or a recorded metric far from its usual value.
Incident	A group of findings first detected in the same scan (and later findings that share a service or pattern with that group). Shown as one expandable row on Findings; Findings monitors can alert once per incident.
Mute	A rule that stops new findings for a pattern, a service, or a kind of finding, for 24 hours, 7 days, or always.
Findings monitor	A monitor whose source is findings, so they reach Slack, email, PagerDuty, or a webhook.

Patterns

Cordo reads each event's log message — message, msg, log, body, text, or event in any capitalisation, or the field bound to Message on the Fields page — and masks the parts that change between events: numbers, ids, UUIDs, email addresses, IP addresses, URLs, timestamps, durations, and secrets. Lines that then look alike share one pattern.

Events without a message still get a pattern when they look like an HTTP request or a background job. These Structured patterns are built from the method, route, and status class (for example GET /orders/{id} → 5xx (error)) or from the job name and outcome.

Patterns are grouped as events are stored, so only events ingested while pattern mining is on have one.
Each pattern keeps its level mix (error, warn, info, debug), its top services, and a recent redacted example.
Patterns do not expire. A stream can hold up to 1,000; past that, new kinds of log line are not grouped. Lines with ids or values baked into the text are the usual cause of a large pattern count.

The Patterns page ranks a stream's patterns for the last hour, day, or week. You can also filter Query and live tail by pattern.

Findings

When anomaly detection is on, Cordo scans the stream every 15 minutes or every hour. Each scan compares the latest complete window with the same window in the stream's history and records what stands out.

Kind	Raised when
New pattern	A kind of log line appears for the first time.
Spike	A pattern is far busier than usual for this time.
Drop	A pattern that is normally busy almost disappears.
Error rate	A service's share of error events rises well above usual.
Volume	The whole stream is far busier or quieter than usual, or goes silent.
Metric	A series of a recorded metric moves far from its usual value.

Exact rules are in Anomaly detection reference.

Severity

Every finding is Info, Warning, or Critical. Most are Warning. Findings become Critical when errors dominate (a new pattern or spike that is mostly errors, or a service whose error share reaches 50%), when the stream goes silent, or when a metric reaches three times its usual value or drops to zero. A new pattern with no errors or warnings is Info.

Severity only ever rises: when the same thing is detected again more strongly, the finding escalates; a calmer repeat keeps the worst severity.

Lifecycle

Status	Meaning
Open	Still happening, or not yet confirmed over. Seeing it again adds a detection instead of creating a new finding.
Resolved	Cordo closed it: not seen in the next two scans, a new pattern that is more than 24 hours old, or the stream reached 500 open findings and the least severe closed first.
Dismissed	Someone closed it with a reason, or a mute dismissed it. A dismissed finding never alerts unless it is reopened.

Closed findings are kept for 30 days.

Learning period

For the first seven days after a stream's first pattern appears, Cordo is still learning what normal looks like. Findings from this period appear on Findings with a Learning tag but never trigger alerts. If the stream already has more than a week of patterns when you turn detection on, there is no learning period.

How baselines work

A finding compares the window with the same time of day on each of the last seven days. When a stream has a weekly rhythm — quiet weekends, a Monday spike — and at least four weeks of history, Cordo uses the same time on the same weekday over the last four weeks instead, whichever fits the history better.

From those earlier windows Cordo takes the median as the usual value and measures how far the window is from it, scaled by how much the history normally varies (a robust z-score). A noisy pattern needs a bigger change to count than a steady one, and a single odd day in the history does not move the baseline much.

Small numbers are ignored: a pattern needs Minimum events in the window (20 by default) before a spike counts, and a drop needs a usual value of at least twice that.

What sensitivity changes

Sensitivity sets how far from usual a change must be.

Sensitivity	Effect
Low	Only large, clear changes. Fewest findings.
Medium	The default balance.
High	Also smaller changes. More findings, more of them noise.

Each kind also has fixed floors that sensitivity does not change — a spike must at least double the usual count, and a metric or volume change must be at least 50% — so high sensitivity does not turn small wobbles into findings.

Why findings explain themselves

Every finding shows its evidence, not just a score:

a headline in plain language, such as Payment declined spiked to 412 (usually 38);
the reasons it was flagged, with the observed value, the usual value, how many earlier periods were compared, and the deviation against the sensitivity threshold;
a chart of the last 24 hours or 7 days with the usual value and normal range;
the events in the detection window, with the stream's redaction applied;
a timeline of detections, escalations, dismissals, and reopens.

Findings and Baseline monitors

Both compare with history, but they answer different questions.

	Findings	Baseline monitor
Setup	Turn on once per stream	One per metric or view you choose
Watches	Every busy pattern, every service's error rate, stream volume, every recorded metric	One signal
Output	Findings in the app; alerts only through a Findings monitor	An alert on its channels
Best for	Finding what you did not know to watch	A signal you already know matters

When a finding points at a pattern you want to keep watching, Watch this pattern turns it into a recorded metric with a Baseline monitor. See Turn a pattern into a monitor.

What anomaly detection is not

Not a replacement for monitors: findings stay in the app until you add a Findings monitor, and they never alert during the learning period.
Not a root-cause tool: a finding tells you what changed and shows the events; deciding why is still your call.
Not retroactive: events stored before pattern mining reached them have no pattern, and scans only look forward from when detection is turned on.
Not related to Insights "families": Insights groups events by their field structure, while patterns group them by their log message.