A method is implemented by a computing device to analyze a live stream of log entries to determine new patterns and changes in a number of occurrences of previously identified patterns. The method includes receiving a log entry in a live stream of log entries, determining whether the log entry fits a baseline pattern from one or more previously saved baseline patterns, adding to a count of occurrences for a baseline pattern if the log entry fits that baseline pattern, creating a new baseline pattern for the log entry if the log entry does not fit any of the one or more previously saved baseline patterns, saving the new baseline pattern, generating a snapshot of a pattern hierarchy based on the baseline patterns, comparing the new snapshot to a previously saved snapshot of a pattern hierarchy, and causing a report to be displayed based on a result of the comparing.