Investigate logs in natural language without losing context

Move from query syntax to operational questions

Engineers should still be able to use precise filters and queries, but not every investigation begins with a known field name or exact error string. A natural-language layer makes it possible to begin with the operational question: “What changed before the latency increase?” or “Which systems started failing at the same time?”

The useful part is not the chat interface itself. The useful part is maintaining context across follow-up questions while continuing to ground the response in telemetry.

Follow-up questions should narrow the investigation

An initial question may identify a time window or group of services. A second question can then focus on one symptom, compare it with a baseline or ask for the earliest related signal. This iterative process mirrors how experienced operators work during an incident.

Examples of investigation prompts

• What was the first abnormal event before the authentication errors increased?
• Which hosts show the same failure pattern?
• Did database pressure begin before or after application latency?
• Summarise the evidence for the likely cause and list the uncertainties.