anomaly detection
Log anomaly detection with
no thresholds to configure
The bug you weren't looking for.
Not every failure announces itself with the word “error.” Logier watches for the things that just look wrong — a rate that changed, a message that's never shown up before, a service that suddenly went quiet — and flags them before you have to know to search for them.
8× baseline · payment-service
Error rate jumped well past its trailing-window median at 09:14
New signature
"connection reset by peer" has not appeared before in this file
12m silence
worker-queue went quiet far longer than its typical gap
Outlier duration
one request took several times longer than its cluster's norm
four kinds of wrong
Four kinds of anomaly
Logier flags
| Type | What it means | Typical trigger |
|---|---|---|
| Frequency spike | A level's rate jumps to at least 4× its own trailing-window median. | A retry loop, a cache miss cascade, a bad deploy |
| New signature | A message shape — normalized by stripping IDs, IPs, and numbers — that hasn't appeared since the warm-up window. | A new code path, a dependency upgrade, an unhandled edge case |
| Silence gap | A service goes quiet far longer than its typical gap between entries. | A crashed process, a stuck thread, a lost connection |
| Outlier value | A duration-like number in a message runs at least 6× its cluster's typical value. | A slow query, a memory leak, a malformed payload |
how it decides
How the baseline is computed
from your own file
Logier tracks a trailing-window baseline for each recurring message signature and numeric field as it parses a file — how often it normally shows up, and what range its values usually fall in. When something crosses well outside that range, or a signature is seen for the first time after the warm-up period, or a normally-regular source goes quiet, it gets flagged. All of it runs as plain heuristics against the file already open — no model, no network call, and nothing to configure up front.
in practice
What a keyword search
would have missed
Caught before anyone noticed
A background worker stopped logging for eleven minutes overnight. Nothing in the log said “error” — it just went quiet. The silence-gap anomaly flagged it the next morning, before a single support ticket came in.
Not every spike is a bug
A sudden jump in request volume looked alarming until the timeline lined up with a scheduled campaign send. Anomaly detection flagged the shape; cross-referencing against the timeline made the real cause obvious in seconds.
where this lives
Anomalies are surfaced, not searched for
You don't write a query to find them. The banner appears above your log the moment Logier finishes computing a baseline from the file.
Explorer
Cloud
- 1
A count and a severity breakdown, expandable into the individual findings. No thresholds were configured to produce this.
- 2
Each flagged anomaly maps to a point on the timeline, so you can see it in the context of everything around it.
- 3
Jump straight from a finding to the entries that triggered it.
silent failures
Finding the failure that
produces no errors
Every log tool can find the word ERROR. Almost none can find the thing that stopped writing. When a worker deadlocks, a consumer loses its partition assignment, or a cron job silently exits non-zero, the signal is an absence — a service that logged every few seconds for six hours and then didn't.
Logier learns each service's normal gap distribution from the file itself and flags the intervals that break it. No threshold to set, because the threshold comes from your data. This is the class of bug that survives a keyword search indefinitely: you cannot grep for a line that was never written.
no platform required
Anomaly detection without
an observability platform
Anomaly detection is usually something you buy access to: ship logs to a vendor, wait for indexing, learn a query language, and pay per gigabyte. That's a reasonable trade for continuous production monitoring — and a poor one when you have a log file in front of you and a question about it right now.
No training data
The baseline comes from the file you opened, not a model trained on somebody else's logs.
No query language
Nothing to learn before you get an answer — anomalies are surfaced, not searched for.
No ingestion
Detection is statistics running locally on your machine. Nothing is uploaded or indexed.
faq
Common questions
keep reading
From a flag to a fix
Timeline view
See the flagged spike or silent gap in the context of everything around it.
AI root cause analysis
Anomaly detection says something is off; this says why, in plain English.
Local-first log privacy
Detection is local statistics — no model, no upload, no vendor in the loop.
Automatic format detection
Anomalies are computed over parsed entries, so this works on custom formats too.
Logier vs. grep
A pattern can only find what you can already describe. Anomalies are what you can't.
Analyzing large log files
In a file too big to inspect, outliers have to surface themselves.
Let the log tell you what's wrong.
No thresholds to configure — anomaly detection learns what's normal from the file you give it.