Volume is the least informative number in a log stream
Logs arrive at a rate nobody can read and get summarized into a count, and a count is the one number that cannot tell you whether anything is wrong. 90,000 errors per hour are normal for some systems and catastrophic for others.
What matters is composition and change: which distinct errors are present, in what proportion, and which of them were absent yesterday. A new error class at low volume is more urgent than a familiar one spiking.
Grouping has to work on the shape of an error rather than its text, because identifiers, timestamps, and user references make every line unique. Two errors differing only by a request ID are one error.
Done properly, ninety thousand lines become eleven groups, three of them new, and the eleven are readable.
How the ActionFlow runs on the canvas
Raw log lines reach the flow through an HTTP Request node against your log store, or a Webhook trigger streams them in batches.
A String node normalizes each line, stripping identifiers, timestamps, and paths so that lines differing only by those values collapse together.
A Uniq node reduces the normalized set, and a Math node counts occurrences per distinct shape before any model sees anything.
Counting before generation is what keeps this affordable. The model reads eleven distinct shapes, not ninety thousand lines.
A Generate Object node returns each group with a description of what went wrong and the component involved, and a Text Classifier node assigns severity against your definitions rather than the logger's.
A MongoDB node holds the history of shapes, and an If node marks anything absent from it as new.
A Sort node orders by new first, then by change in volume rather than volume itself, and a Generate Text node writes the summary.
A Slack node posts it, and a Linear node opens an item for any new group above your threshold.
Nodes this ActionFlow uses
- HTTP Request (Util) with Webhook (Triggers): the log store, or a stream in batches.
- String (Util): normalizes lines so identifiers stop making each one unique.
- Uniq (Control) with Math (Util): distinct shapes and their counts, before any generation.
- Generate Object (AI Core): what went wrong and which component, per group.
- Text Classifier (AI Custom): severity against your definitions, not the logger's.
- MongoDB (Data): the history of shapes, so new ones can be detected at all.
- Sort (Data): new first, then change in volume rather than volume.
- Linear (Integration): one item per new group above your threshold.
Frequently asked questions
Start building AI workflows
Create a free account, open a template or a blank canvas, and run your first ActionFlow.
Newsletter
Get product updates
New nodes, agents, and product notes. We send mail only when we have something worth opening.