---
title: "Pattern detail"
description: "Full single-pattern view drilled from the preview list: 24h line chart, cross-service bar chart, severity breakdown, and sample events."
icon: material/chart-timeline-variant
---

Composes a full single-pattern view by fetching data from three sources in parallel:

1. **event_lookup**: identity, first_seen, per-service cost breakdown
2. **pattern_trend**: 24h time series for the line chart
3. **pattern_examples**: sample events from the log analyzer (when available)

Returns a plain-text `must_render_verbatim` block with:

- pattern header + first-seen age
- 24h line chart
- cross-service ASCII bar chart
- severity breakdown
- 3-5 sample events truncated to 120 chars

Then asks: "Back to preview list" or "Apply with this in the picture."

## :material-code-braces: Example

!!! tenx-ask "You"

    drill into pattern #2

!!! tenx-answer "Log10x"

    Pattern: healthcheck_ok_pod_$
    First seen: 3 days ago

    Volume trend (24h)
    [line chart]

    Service distribution (30d)
    checkout-svc [INFO]  ████████████████░░░░░░░░░░░░  890MB
    payment-svc           ██░░░░░░░░░░░░░░░░░░░░░░░░░░  190MB

    Severity breakdown: INFO: 0.85GB (82%)  |  (none): 0.19GB (18%)

    Sample events (3 shown):
      1. {"level":"info","msg":"healthcheck ok","pod":"checkout-7f8d9-x2p"}

    What next?
      Back: return to the preview list
      Apply: proceed with applying the mode

## :material-check-decagram-outline: Prerequisites

Reporter deployed (for TSDB trend and service breakdown). SIEM connector configured for sample events (optional, skipped gracefully if absent).

## :material-code-json: Schema and samples

??? tenx-input-schema "Input schema"

    Agent-facing JSON Schema (the canonical shape the MCP server publishes via `tools/list`):

    ```json
    {
      "type": "object",
      "properties": {
        "pattern_hash": {
          "type": "string",
          "description": "The tenx_hash of the pattern to drill into. Obtained from log10x_preview_filter data.patterns[].tenx_hash. Preferred over pattern when available (skips a metrics lookup)."
        },
        "monthly_volume_gb": {
          "type": "number",
          "exclusiveMinimum": 0,
          "description": "What-if volume lens: model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. Real per-pattern shares and the pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. The envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor; a [Projected to X/mo] prefix marks a lensed run. Omit it for the environment's real measured volume."
        },
        "pattern": {
          "type": "string",
          "description": "Pattern name (Symbol Message, e.g. \"Payment_Gateway_Timeout\") as an alias for pattern_hash. Resolved to hash via metrics lookup. Provide either pattern or pattern_hash."
        },
        "include_samples": {
          "type": "boolean",
          "default": true,
          "description": "When true (default), attempts to fetch 3-5 sample events from the SIEM. Set false to skip the SIEM round-trip."
        },
        "timeRange": {
          "type": "string",
          "pattern": "^\d+[mhd]$",
          "default": "7d",
          "description": "Time window for the volume trend and sample events lookback. Default 7d. Pattern: ^\d+[mhd]$."
        },
        "environment": {
          "type": "string",
          "description": "Environment nickname for multi-env setups."
        }
      },
      "additionalProperties": false
    }
    ```

    Source: [`src/tools/pattern-detail.ts`](https://github.com/log-10x/log10x-mcp/blob/main/src/tools/pattern-detail.ts).

??? tenx-output-schema "Output schema"

    The `data` block inside the [StructuredOutput envelope](../index.md#json-by-default-output):

    ```typescript
    interface ToolData {
      pattern_hash: string;
      pattern_name: string | null;
      services: Array<{
        service: string;
        severity: string;
        bytes: number;
        share_pct: number;
      }>;
      total_bytes: number;
      first_seen_age_seconds: number | null;
      trend_time_series: Array<{ ts: number; bytes_per_sec: number }>;
      sample_events: string[];
      must_render_verbatim: string;
      must_ask_user: { question: string; options: string[] };
    }
    ```

    Envelope-level fields the agent should also read: `summary.headline`, `actions[]` (back to preview / apply), `schema_epoch`.