Skip to content

Turn a pattern into a monitor

You will learn how to keep watching one log pattern with its own recorded metric and monitor, and when a Findings monitor filtered to that pattern is the better choice.

Before you start

  1. Select a stream whose Patterns page lists the pattern you care about.
  2. Have the Settings stream role or higher — watching creates a metric and a monitor.

Option 1: Watch this pattern

Watch this pattern records the pattern as a metric and watches it with a Baseline monitor. It works whether or not anomaly detection is on.

  1. Open the pattern: on Patterns, click its row; or open a finding about it.
  2. Click Watch this pattern.
  3. The toast Watching pattern #… links to Open monitor and View metrics.

Cordo creates, both named Pattern #<id> · <template>:

What Setting
Metric Count of the pattern's events, recorded every 5 minutes
Monitor Baseline condition on that metric: fires when the last hour is more than 100% above its usual level, checked every 5 minutes

The new monitor has no channels yet. Open it from the toast, then attach channels as in Detect and alert.

Adjust it like any monitor. To be told when the pattern goes quiet instead of loud, edit the monitor's operator and threshold, for example below −50%.

If a metric or monitor with that name already exists, watching fails: the pattern is already watched.

Option 2: A Findings monitor for the pattern

On the pattern's panel, click Alert on findings. A new Findings monitor opens with Only these patterns set to that pattern. It alerts on any finding about the pattern — new, spike, or drop — with anomaly detection's baselines and sensitivity. See Alert on findings.

Which to choose

Watch this pattern Findings monitor
Needs anomaly detection on No Yes
Threshold Yours: edit the percent, window, and frequency The stream's sensitivity
Catches The direction you set Spikes and drops
Keeps a chartable series Yes, on Metrics No
Alerts during the learning period Yes No

Use Watch this pattern for a known, important line — payment failures, login errors — where you want a fixed rule and a long-lived chart. Use a Findings monitor when you want anomaly detection's judgement without tuning a threshold.

Next