How to Build a Customer Issue Pattern Detector

A customer issue pattern detection system for trending problems catches outages and bugs before your monitoring does. I build these because support tickets are often the first signal that something broke. When 5 customers report the same issue within an hour, that is not a coincidence. That is a pattern.

The system clusters recent tickets by topic and alerts when any cluster grows faster than normal.

What You Need Before Starting

• A ticketing system with incoming ticket data
• Python 3.8+ with sentence-transformers and sklearn
• A database for pattern tracking
• Alert channels for the engineering team

Step 1: Embed Incoming Tickets

Convert each ticket into a vector for clustering:

from sentence_transformers import SentenceTransformer
import numpy as np

model = SentenceTransformer("all-MiniLM-L6-v2")

def embed_ticket(subject, body):
    text = f"{subject} {body}"
    return model.encode(text)

def embed_recent_tickets(hours=4):
    tickets = get_tickets_since(hours)
    embeddings = []
    ticket_ids = []
    for t in tickets:
        emb = embed_ticket(t["subject"], t["body"])
        embeddings.append(emb)
        ticket_ids.append(t["id"])
    return np.array(embeddings), ticket_ids

Step 2: Cluster Similar Issues

Use DBSCAN to find groups of related tickets without predefined categories:

from sklearn.cluster import DBSCAN

def find_clusters(embeddings, ticket_ids, min_cluster_size=3):
    if len(embeddings) < min_cluster_size:
        return []

    clustering = DBSCAN(eps=0.5, min_samples=min_cluster_size, metric="cosine")
    labels = clustering.fit_predict(embeddings)

    clusters = {}
    for ticket_id, label in zip(ticket_ids, labels):
        if label == -1:
            continue
        if label not in clusters:
            clusters[label] = []
        clusters[label].append(ticket_id)

    return [{"cluster_id": k, "ticket_ids": v, "size": len(v)} for k, v in clusters.items()]

Step 3: Summarize Each Cluster

Use AI to describe what the cluster is about:

import anthropic

client = anthropic.Anthropic()

def summarize_cluster(ticket_ids):
    tickets = [get_ticket(tid) for tid in ticket_ids[:5]]
    ticket_text = "\n---\n".join([f"Subject: {t['subject']}\nBody: {t['body']}" for t in tickets])

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=150,
        messages=[{
            "role": "user",
            "content": f"""These support tickets are about the same issue. Summarize the common problem in 1-2 sentences.

{ticket_text}"""
        }]
    )
    return response.content[0].text

Step 4: Detect Abnormal Spikes

Compare current cluster sizes to historical baselines:

def is_spike(cluster_size, category, lookback_days=30):
    conn = sqlite3.connect("patterns.db")
    avg = conn.execute("""
        SELECT AVG(cluster_size) FROM pattern_history
        WHERE category = ? AND detected_at > datetime('now', ?)
    """, (category, f"-{lookback_days} days")).fetchone()[0]

    if avg is None:
        return cluster_size >= 5

    return cluster_size > avg * 2

Step 5: Alert on Detected Patterns

import requests

def run_pattern_detection():
    embeddings, ticket_ids = embed_recent_tickets(hours=4)
    clusters = find_clusters(embeddings, ticket_ids)

    for cluster in clusters:
        summary = summarize_cluster(cluster["ticket_ids"])

        if is_spike(cluster["size"], summary):
            alert_message = (
                f"Trending issue detected ({cluster['size']} tickets in 4 hours):\n"
                f"{summary}\n"
                f"Ticket IDs: {', '.join(cluster['ticket_ids'][:5])}"
            )
            requests.post(os.getenv("SLACK_ENGINEERING_WEBHOOK"), json={"text": alert_message})
            log_pattern(cluster, summary)

What to Build Next

Connect detected patterns to your incident management system. When a cluster crosses a threshold, automatically create an incident in PagerDuty or your status page. Proactive incident communication builds customer trust.

Related Reading

• Why Monitoring Is Not Optional - pattern detection is monitoring from the customer side
• The Feedback Loop That Powers Everything - support patterns feeding back to product and engineering
• Designing for Failure - detecting failure patterns before they cascade