--- title: "Triage" description: "Groups a batch of log events into known patterns, with severity, frequency, and field-value distribution per pattern." icon: material/format-list-bulleted --- Paste a batch of events (a file, `kubectl logs` dump, or log analyzer export) and group them by pattern. Returns per-pattern: - event count, - severity breakdown, - template shape, - slot values (which tenants, users, or keys are affected). The local 10x engine processes the batch, so events never leave the machine. ## :material-code-braces: Example !!! tenx-ask "You" triage `/tmp/incident.log` !!! tenx-answer "Log10x" 1,403 events → 27 patterns. Top: 1. `Payment_Gateway_Timeout` (412 events, ERROR), affects 4 tenants: `acme-corp`, `globex`, `initech`, `umbrella` 2. `GetCartAsync_called_with_userId` (218 events, INFO) 3. `Retry_Exhausted` (174 events, WARN) ## :material-chat-question-outline: More to ask - *"triage this Slack dump"* (paste events) - *"what's in `/tmp/datadog-export.json`?"* - *"top 10 patterns from this `kubectl logs` output"* ## :material-check-decagram-outline: Prerequisites Works at any tier, including CLI-only. The local 10x engine processes the batch, so events never leave the machine: - the `tenx` CLI **1.0.22+** ([install for macOS/Linux/Windows](../../../../install/)), or - a local Docker container (`LOG10X_TENX_MODE=docker`). When `LOG10X_TENX_MODE` is unset and Docker is running, Docker is auto-detected and preferred; otherwise the native `tenx` binary is used. The local path invokes `tenx @apps/mcp` over stdin/stdout, with no temp files written to disk. **When no patterns resolve.** A zero-pattern result has two causes, and the tool names both so the right one gets fixed: 1. The input was not raw log lines. The engine expects one event per line, not a pre-formatted JSON blob. Re-paste the raw lines and re-run. 2. Engine and MCP output-format version skew. The local engine image emits a format this MCP build cannot parse, so even valid input returns nothing. Run `log10x_doctor` to check the installed engine image version, then upgrade to a compatible `tenx` (see [Install](../../../../install/)). The second cause is the one to suspect when reformatting the input keeps failing: no input will resolve against a skewed engine image. ## :material-code-json: Schema and samples ??? tenx-input-example "Input example" Real call against the demo env (captured by [`scripts/capture-tool-envelopes.mjs`](https://github.com/log-10x/log10x-mcp/blob/main/scripts/capture-tool-envelopes.mjs)). ```json { "source": "events", "events": [ "2026-05-26 10:00:00 ERROR payments-svc Connection timeout to db-replica-2", "2026-05-26 10:00:01 ERROR payments-svc Connection timeout to db-replica-2", "2026-05-26 10:00:02 INFO payments-svc Retry attempt 1/3 succeeded" ], "top_n_patterns": 5, "view": "summary" } ``` ??? tenx-input-schema "Input schema" Agent-facing JSON Schema (the canonical shape the MCP server publishes via `tools/list`): ```json { "type": "object", "properties": { "source": { "type": "string", "enum": [ "file", "events", "text" ], "description": "Optional, auto-inferred from whichever of `events` / `text` / `path` you actually provide, so you normally do not set it. Provide explicitly only to disambiguate when more than one is present." }, "path": { "type": "string", "description": "Local file path when source=file. Required for file mode." }, "events": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string" } ], "description": "Inline log lines: an array of lines, or a single newline-separated string (both accepted). `source` need not be set." }, "text": { "type": "string", "description": "Raw text blob when source=text, newline-separated log events." }, "top_n_patterns": { "type": "number", "minimum": 1, "maximum": 50, "default": 20, "description": "How many patterns to return in the ranked triage." }, "include_next_actions": { "type": "boolean", "default": true, "description": "Whether to generate next_action suggestions for each top pattern." }, "environment": { "type": "string", "description": "Environment nickname, used to build next_actions that call log10x_investigate." } }, "additionalProperties": false } ``` Source: [`src/tools/resolve-batch.ts`](https://github.com/log-10x/log10x-mcp/blob/main/src/tools/resolve-batch.ts). ??? tenx-output-example "Output example" Real envelope from the demo env. `view: "summary"` returns the full `StructuredOutput` with typed `data`. Long arrays + base64 PNG bodies trimmed for readability; the real call returns them in full. Headline (the 1-line agent-facing answer): > _3 events → 2 patterns, top: ERROR\_payments\_svc\_Connection\_timeout\_to\_db\_replica at 67% of batch._ ```json { "schema_version": "1.0", "schema_epoch": "2026-05-25", "tool": "log10x_resolve_batch", "generated_at": "2026-05-26T15:37:37.004Z", "view": "summary", "summary": { "headline": "3 events → 2 patterns, top: ERROR_payments_svc_Connection_timeout_to_db_replica at 67% of batch." }, "data": { "input_line_count": 3, "input_bytes": 213, "resolved_pattern_count": 2, "shown_pattern_count": 2, "accounted_events": 3, "dropped_events": 0, "drop_rate": 0, "execution_mode": "local_cli", "cli_wall_time_ms": 7382, "severity_mix": { "ERROR": 2, "INFO": 1 }, "overfit_warning": false, "patterns": [ { "rank": 1, "template_hash": "-9ZQM#HFM!>", "symbol_message": "ERROR_payments_svc_Connection_timeout_to_db_replica", "template": "$(yyyy-MM-dd HH:mm:ss) ERROR payments-svc Connection timeout to db-replica$", "event_count": 2, "share_pct": 66.66666666666666, "interestingness": 0.755, "dominant_severity": "ERROR", "severity_distribution": { "ERROR": 2 }, "slots": [ { "slot_index": 0, "inferred_name": "slot_1", "naming_confidence": "low", "distinct_count": 1, "top_values": [ { "value": "-2", "pct": 1 } ] }, { "slot_index": 1, "inferred_name": "slot_0", "naming_confidence": "low", "distinct_count": 2, "top_values": [ { "value": "1779804000000", "pct": 0.5 }, { "value": "1779804001000", "pct": 0.5 } ] } ] }, { "rank": 2, "template_hash": ".m; }>; }>; } ``` Envelope-level fields the agent should also read: `summary.headline` (1-line answer), `actions[]` (next-call chain hints as `{tool, args, reason}`), `truncated: boolean`, `images[]` (PNG attachments where applicable), `schema_epoch` (engine-ID stability boundary).