0078GitHub
Tocsin
22.8M log lines grouped into patterns, then one question each.
Ateeq built Tocsin for the problem every agent hits: reading logs. Running an LLM over 22.8 million lines would have cost $1,120. Tocsin groups them into 11,812 repeating patterns and asks Jev about each pattern once. That took six minutes and 64 cents, and left 123 patterns worth looking at. The paging policy is a prompt: you say what should wake someone at 3 am.
TPAteeq/tocsinREADME ↗
# tocsin
A tocsin is the bell you ring when something is actually wrong. This one collapses a log
stream into patterns, asks TypeSafe's [Jev](https://typesafe.ai) about each pattern once,
and routes every line to `page`, `ticket`, or `log` using a paging policy you write in
plain English.
Sentry had the right idea: group by pattern, alert on the group. tocsin does that for raw
logs, and asks a model whether the group is worth waking someone.
```
22,833,750 log lines → 11,812 templates → 13,080 Jev calls → $0.64
the same 13,080 calls through a $3/M model: $45.82
asking about every line instead of every template: $1,120
```
The full write-up, including the run where it lost, is at
<https://tpateeq.github.io/tocsin/>, built from [docs/index.html](docs/index.html).
## How it works
```mermaid
flowchart LR
L[log lines] --> D[mask + Drain templating]
D -- new template --> J[Jev · one request<br/>policy + 4 typed questions]
D -- known template --> C[(verdict cache)]
J --> C
C --> R{attention}
R -- "≥ 0.75" --> P[page · webhook once per template]
R -- "≥ 0.5" --> T[ticket]
R -- otherwise --> G[log]
```
Numbers, IPs, UUIDs, hex values and emails get masked. HTTP status codes keep their class,
so `GET /checkout 500` becomes `GET /checkout <5xx>` and never merges with a 200. Lines are
then grouped with Drain, using the streaming `drain3_rust` engine from
[codag-drain](https://github.com/codag-megalith/codag-drain). A pattern that repeats a
million times is judged once.
Each new pattern goes to Jev in one request carrying your policy and four questions:
| question | type | what it asks |
|---|---|---|
| `pageable` | noul | does the policy say to page for this event? |
| `detail` | noul | is this a stack frame, register dump or other continuation line? |
|