Occurrences
An occurrence is a single log event: one error line, one stack trace, one request entry. Log Lens groups occurrences that share a fingerprint into an issue, so the issue is the pattern and each occurrence is one real event behind it. This lets you see how often something happened and jump to any individual instance.
What each occurrence records
Every occurrence stores when it happened and exactly where it lives in the source file:
| Field | Meaning |
|---|---|
occurred_at / occurred_day | Event timestamp and its day bucket (used for timelines) |
severity / environment | Captured per event, so one issue can span levels or environments |
source_file_id | The file the event was read from (path, log type, channel) |
byte_start / byte_end | The byte range of the raw event in that file |
context_preview | A truncated slice of the event's JSON context |
The context preview is capped by ingestion.context_preview_limit (default 12,000 characters).
Viewing occurrences
Open an issue's detail to get its occurrences, newest first. Results are paginated with a hard ceiling of 500 per page, alongside a per-day timeline. Because the byte range is stored, Log Lens can re-open the original file and read the exact bytes for any occurrence on demand - see Read a raw event. Reads are capped at 4 MiB per event.
The dedup constraint
Occurrences are deduplicated by an exact fingerprint - the issue fingerprint plus the normalized stack trace. Inserts use INSERT OR IGNORE, so if the identical event is ingested again (for example, re-reading the same file region), the duplicate is silently skipped and the issue count is not inflated. Genuinely distinct events with the same pattern still each become their own occurrence and bump the count.
A new occurrence on a fixed issue flips it back to reoccurred - see Reoccurrence detection.