> ## Documentation Index > Fetch the complete documentation index at: https://docs.aiaxoniq.com/llms.txt > Use this file to discover all available pages before exploring further. # Log patterns > Millions of log lines collapse into the handful of shapes they actually take — how patterns are discovered and what they are good for. A **log pattern** is the template behind many similar log lines. These three: ```text theme={null} user 8817 not found user 4402 not found user 91 not found ``` are one pattern with a count of three, discovered automatically by clustering log bodies as they arrive. **Before you start.** You need logs arriving. Patterns are derived continuously — there is nothing to configure and no rules to write. ## What this is for A new service's entire log vocabulary in a page, instead of scrolling through a million lines of the same three messages. A pattern that did not exist yesterday is a genuinely new kind of error — which raw search will not surface, because you do not know what to search for. The pattern with the highest count is usually where your log bill is, and it is usually something nobody reads. Which errors are one-offs and which are happening thousands of times. ## How grouping works Log bodies are clustered by structure: the stable words become the template and the varying parts become placeholders. Nothing is configured — the clustering adapts to what your services actually log. **Patterns are discovered from the body text, not from attributes.** Two log lines with identical bodies and completely different attributes are one pattern. Use patterns to find the *shape*, then filter on attributes in [search](/guides/logs/search) to narrow within it. ## From a pattern to the lines behind it A pattern is a starting point, not an answer. Once you have found the interesting one, filter logs by its identifier to get the individual records — with their timestamps, services, trace ids and attributes. That round trip is the workflow: **pattern to find what is happening, search to find why.** ## What it will not do **A pattern count is not an alert.** Nothing fires when a new pattern appears or when one spikes. If you need to be told, write an alert rule against the underlying condition — see [Alerting](/guides/alerts/overview). **Structured logs cluster better than prose.** A service that logs free-form sentences with embedded values produces more patterns and less useful ones than a service that logs a stable message with the variable parts as attributes. This is worth knowing when the output looks noisy: it is usually a property of the logging, not of the clustering. Moving values out of the message and into attributes improves patterns, search *and* your storage cost at once. ## Retention Patterns follow log retention — **30 days**. A pattern with no recent matches ages out along with the lines behind it. ## Next The query syntax for drilling into a pattern. Watching new lines as they arrive. What to do about the pattern with the highest count.