1. A system, comprising: one or more processors configured to: obtain log data; cluster portions of the log data into clusters of similar data portions; generate a signature for each cluster, wherein the signature comprises a representation of log data in the cluster, wherein comparison of subsequent log data with the signature indicates whether the subsequent log data belongs in the cluster, and wherein the log data in the cluster conforms to the signature; and cause the generated signature to be presented via one or more interfaces, wherein the one or more interfaces are configured to obtain a user instruction associated with an action to take with respect to the presented signature, wherein the action comprises editing the signature, and wherein the signature is modified in response to the obtained user instruction; and a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.