A non-transitory computer-readable medium stores instructions readable and executable by at least one electronic processor (10, 12, 14) to perform a log pattern analysis method (300) by applying a log pattern to log data undergoing analysis comprising log events which are time stamped and which are defined by values for a set of fields. The log data undergoing analysis are stored on a server (30) accessible by the at least one electronic processor via an electronic network (31). The log pattern analysis method includes: constructing a retrieval query to select log events that are in a time interval and that also satisfy at least one additional constraint associated with the log pattern and defined on one or more filter fields of the set of fields; downloading a sub-set of the log data undergoing analysis from the server to the at least one electronic processor via the electronic network, wherein the sub-set is selected from the log data undergoing analysis by the retrieval query; applying the log pattern to the downloaded sub-set of the log data undergoing analysis to identify log pattern hits in the log data undergoing analysis; and controlling a display screen (16) to display a report of the log pattern hits in the log data undergoing analysis.