Log Analyst
Ask why. Get the number first.
Ask about your logs in plain words. The Log Analyst plans the queries, rules out the usual false alarms, and answers with the number first — every number checked against the query it came from.
- 5xx rate by minute, last 2 hours
- Errors split by origin and path
- Bots and people in the errors
5xx errors rose from 0.4%✓ to 4.8%✓ at 20:05. 92%✓ came from checkout-api, on /cart/v1/items. Bots made up only 3%✓.
Every number is checked against the query result it came from. Example data.
Every number, checked.
Each number in an answer points to the query row it came from. The check runs before you see the answer, so a number that can't be traced never reaches you.
5xx errors rose to 4.8%1 at 20:05. 92%2 came from checkout-api. Bots made up 3%3 of the errors.
How it investigates.
The steps a careful engineer would take, every time.
- 1
Checks the real values
Looks at what a field actually contains before it filters on it.
- 2
Sets a baseline
What normal looks like, so an anomaly stands out from a busy day.
- 3
Narrows it down
Splits the signal by status, path, client, cache and time until one part explains it.
- 4
Rules out the false alarms
Bots, health checks, internal traffic and gaps in the data.
- 5
Answers, number first
With what it found, and what the logs can't prove.
Pick the depth.
A quick number or a full investigation. You choose for each question.
- Low
- Plans all its queries at once. Fast, for a single number.
- Medium
- Plans each query from the last result.
- High
- Investigates freely until it has the answer. Can take a few minutes.
Watch the Log Analyst work.
A question about a spike, the queries it runs, and an answer with every number checked.
Questions
Do I need a query language?
No. Ask in plain words, the way you'd ask a colleague.
How do I know a number is right?
Before you see an answer, every number in it is matched to the query result it came from. If the logs can't prove something, the Log Analyst says so instead of guessing.
How long does an answer take?
A simple number comes back quickly. A full investigation at High depth can take a few minutes, because it runs and checks many queries.
Ask your own logs.
Open the demo and ask the Log Analyst what happened.