LogIQ — Role-Aware AI Log Intelligence

01

Project Overview

Searchable log records: 4.96M
Investigation tools: 19
Role-specific perspectives: 3

Recorded infrastructure data, predefined SQL tools, and evidence-grounded responses tailored to the person investigating.

02

System Architecture

An investigation moves between a shared AI agent and its SQL tools. Evidence returns to the agent before findings are adapted to the selected audience.

Question

Natural-language investigation

Scope

Dataset · time window · filters

Selected perspective

Engineer

ONE SHARED AI AGENTEngineer context

01

Interpret the request

Question, scope, role instructions, and conversation context.

02

Choose the next tool

Select a named function and relevant arguments.

03

Interpret returned evidence

Read structured results and their limits; decide whether more evidence is needed.

Continue with another tool, or synthesize the answer.

Planning, tool choice, and interpretation belong to this same agent loop.

Inside the same reasoning process

Patterns, context & findings

Interpret observed errors and temporal context. Keep findings traceable to the returned evidence.

scope · filters: What was queried
queries · params: Executed SQL and bound values
data: Bounded records and aggregates
notes · truncated: Caveats and result limits

Named tool + arguments

19 predefined tools · selected as needed

Search & scope4

Find log lines, inspect corpus coverage, and extract or filter message fields.

corpus_overview
search_logs
extract_field
filter_numeric

Event investigation5

Inspect events, neighboring lines, template history, tracebacks, and entity context.

get_nearby_events
investigate_event
template_history
get_traceback
trace_instance

Aggregation & trends5

Measure groups, recurrence, time buckets, period changes, and estimated episodes.

count_problems
problem_trend
recurring_problems
compare_periods
count_incidents

Correlation4

Explore preceding patterns, correlated templates, and candidate event chains. Association does not establish cause.

preceding_patterns
correlate_templates
correlation_chains
chain_profile

Prioritization1

Rank observed patterns or teams using documented severity, frequency, spread, and trend signals.

risk_ranking

Database execution

Parameterized SQL

Return structured evidence
to the same agent

SereneDB

SQL search & aggregation

4,955,783 historical log records

Timestamp · source · component
Level · template · log content

Offline preparation

BGL + OpenStack → parsed CSVs → loaded tables

Recorded datasets, prepared before investigation.

One agent’s findings, presented for the selected audience.

Engineer emphasis: Log lines, traceback context, labeled hypotheses, and concrete diagnostic checks.

Returned data / evidenceRequest / invocationArrowheads show direction

Text architecture & implementation boundaries

A natural-language question and selected role enter one agent session. The agent interprets the context and dynamically selects from 19 predefined SQL-backed tools. Selected functions execute parameterized queries in SereneDB; bounded results and their evidence envelopes return to the same agent. It can select another tool or synthesize a response.

Evidence supports error-pattern and temporal interpretation. Role instructions shape Engineer, Team Lead, or Manager reporting through the same agent, rather than independent agents. Tools remain a shared registry; selecting a perspective here only previews reporting emphasis.

BGL and OpenStack are historical datasets. Offline preparation parses archives into structured CSVs and loads SereneDB before investigations. The corpus total describes log records, not live telemetry or independent incidents. Subsystem boundaries and tool families express responsibilities, not separate deployed services.

FIG. 01 / LogIQ agent architectureInteractive explanation · no tool or model calls are executed

19 predefined investigation tools across search, investigation, aggregation, correlation, and prioritization. Tools execute parameterized SQL; the agent does not generate arbitrary SQL.

03

Investigation in Action

Recorded OpenStack investigation · May 16–17, 2017

Recurring InvalidDiskInfo / qemu-img failures

Follow the evidence from a scoped question to a role-aware interpretation. The investigation stays the same when the perspective changes.

Matching error lines: 8; InvalidDiskInfo search matches
Related diagnostic matches: 24; qemu-img search matches
Component-level ERROR volume: 192; oslo_service.periodic_task

Counts are shown separately on a common line-count scale. These measures overlap; they are neither additive nor independent incident counts.

Evidence-to-answer workflow

Select a stage

Natural-Language Question

Investigate recurring InvalidDiskInfo / qemu-img failures in OpenStack on May 16–17, 2017. Separate observed evidence from possible causes.

Scope: 2017-05-16 00:00:00 inclusive to 2017-05-18 00:00:00 exclusive. Timestamps remain as recorded, without timezone conversion.

Same evidence · Engineer perspective

Finding: Disk inspection failed with a missing-path diagnostic.
Recommended follow-up: Check disk paths, image-cache state, and instance lifecycle timing; verify against the recorded traceback.

Explore the recorded evidence Tools · inputs · log context

Search family · search_logs

Example recorded input parameters: { "dataset": "openstack", "text": "InvalidDiskInfo", "start": "2017-05-16 00:00:00", "end": "2017-05-18 00:00:00", "limit": 20 }
Evidence type: Matching lines and total match count
Tool operation: Search the indexed log content within the supplied dataset and time window; return representative matches and a separate total count.

Interpretation limit. A search match is a log line, not a complete traceback or an independent incident.

Investigation family · investigate_event

Example recorded input parameters: { "dataset": "openstack", "line_id": 45631, "window": 10 }
Evidence type: Event detail and nearby log context
Tool operation: Inspect the recorded event and adjacent log lines. The tool also consults recurrence and same-source context with their own scopes.

Interpretation limit. Nearby messages and recurrence are supporting context, not proof of causation. Some tool subqueries extend beyond the two-day search window.

Aggregation family · count_problems

Example recorded input parameters: { "dataset": "openstack", "group_by": "component", "start": "2017-05-16 00:00:00", "end": "2017-05-18 00:00:00", "limit": 10 }
Evidence type: Component-level problem aggregation
Tool operation: Aggregate problem log lines by component within the supplied historical window; inspect the recorded ERROR volume for oslo_service.periodic_task.

Interpretation limit. The 192 ERROR lines are a component-level measurement. They do not establish 192 disk failures or 192 independent incidents.

Representative recorded context · engineer/Q1 · line 45631
2017-05-16 03:19:45 · oslo_service.periodic_task · ERROR

InvalidDiskInfo: Disk info file is invalid: qemu-img failed to execute on /var/lib/nova/instances/16797a0f-32fb-494c-8f36-38588148c35d/disk : Unexpected error while running command.

The adjacent recorded traceback includes a missing-path diagnostic. Why the path was unavailable remains unconfirmed. This context comes from the recorded search, not a new tool execution.

Inspect the worked-investigation source

Root cause was not conclusively established. The missing-path diagnostic does not explain why the file was unavailable. Operational impact remains unconfirmed.

04

Explore the Code

Explore the implementation

Explore the agent, 19 investigation tools, SQL evidence retrieval, MCP integration, and Docker setup.

View GitHub Repository View Worked Investigation