Domain-view mapping: cluster log patterns by service health domain in diagnose output

pyr0ball commented

2026-05-24 22:02:58 -07:00

Owner

Turnstone pattern tags identify individual log events, but diagnose output treats all patterns as a flat list. Grouping patterns by service health domain would give operators a higher-level view of what subsystems are affected before diving into individual entries.

Proposed behavior:

Define domain groupings in patterns/default.yaml (e.g., domain: networking, domain: storage, domain: auth)
Diagnose output leads with a domain health summary ("3 auth events, 7 storage events, 1 networking event")
Search UI gains a domain facet filter alongside existing severity filter
Watcher status page shows per-domain event rate sparklines

Why it matters: When an incident involves 50+ log entries, knowing "this is primarily a storage domain problem" cuts triage time significantly.

Reference: https://github.com/Lum1104/Understand-Anything (domain-view mapping: code → business process)

Turnstone pattern tags identify individual log events, but diagnose output treats all patterns as a flat list. Grouping patterns by service health domain would give operators a higher-level view of what subsystems are affected before diving into individual entries. **Proposed behavior:** - Define domain groupings in `patterns/default.yaml` (e.g., `domain: networking`, `domain: storage`, `domain: auth`) - Diagnose output leads with a domain health summary ("3 auth events, 7 storage events, 1 networking event") - Search UI gains a domain facet filter alongside existing severity filter - Watcher status page shows per-domain event rate sparklines **Why it matters:** When an incident involves 50+ log entries, knowing "this is primarily a storage domain problem" cuts triage time significantly. Reference: https://github.com/Lum1104/Understand-Anything (domain-view mapping: code → business process)