diff --git a/cid-redirects.json b/cid-redirects.json index 096e508a04..343b4c9cc2 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -3441,7 +3441,6 @@ "/Metrics/Metric-Queries-and-Alerts/11Metrics-Queries": "/docs/metrics/metrics-queries", "/Metrics/Metrics_Transformation_Rules": "/docs/metrics/metrics-transformation-rules", "/docs/metrics/metrics-visualization/aggregation-operators": "/docs/metrics/metrics-operators", - "/docs/observability/ai-driven-investigations": "/docs/get-started/ai-machine-learning", "/Metrics/Understand_and_Manage_Metric_Volume/Blacklisted_Metrics_Sources": "/docs/metrics/manage-metric-volume/disabled-metrics-sources", "/Metrics/Understand_and_Manage_Metric_Volume/Disabled_Metrics_Sources": "/docs/metrics/manage-metric-volume/disabled-metrics-sources", "/Metrics/Understand_and_Manage_Metric_Volume": "/docs/metrics/manage-metric-volume", diff --git a/docs/observability/ai-driven-investigations.md b/docs/observability/ai-driven-investigations.md new file mode 100644 index 0000000000..23bf0c5bc6 --- /dev/null +++ b/docs/observability/ai-driven-investigations.md @@ -0,0 +1,136 @@ +--- +id: ai-driven-investigations +title: AI-Driven Investigations +description: Generate a service map to analyze service coverage and stability. +--- + + + + + +

Beta

+ +import useBaseUrl from '@docusaurus/useBaseUrl'; + +icon + +AI-Driven Investigations uses AI to generate a map of system services, revealing areas that require attention. It surfaces real-time signals for issues such as latency and errors, providing actionable paths for root-cause analysis. + +The functionality of AI-Driven Investigations is similar to that of the [Services List and Map](/docs/apm/services-list-map/), but uses AI to generate the list and map, providing deeper insights and more targeted surfacing for areas of concern. No tracing setup is required. + +## What is AI-Driven Investigations? + +AI-Driven Investigations leverages an AI generative context engine to analyze your organization's raw log data to provide dynamic observability of the services in your enterprise. It determines real-time environment status and dynamically builds visualizations and instructions to guide troubleshooters. + +Insights are generated by passing a sample of data for the past 30 minutes. Output includes details on logs that result in signals, and recommended next steps. You can create an investigation for any time in the past 14 days. + +AI-Driven Investigations provides developers, security, and IT operations teams with a single source of truth and remediation recommendations in natural language. Engineers that are responsible for maintaining the uptime of a service would benefit most from AI-Driven Investigations. Depending upon the company and how you manage your operations, these could be development operations (DevOps) engineers, service reliability engineers (SREs), or information technology operations (ITOps) engineers. + +## View AI-Driven Investigations + +[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To open AI-Driven Investigations, at the top of the screen select **New > AI-Driven Investigations**. + +[**New UI**](/docs/get-started/sumo-logic-ui). To open AI-Driven Investigations, in the main Sumo Logic menu select **AI-Driven Investigations**. + +When you first open AI-Driven Investigations, the display of an investigation will include a list of services to the left, and a map of the services to the right. These services are automatically identified by AI analysis of logs in your environment. + +The service list and map visually represents your application environment, giving you a greater understanding of your application architecture, hierarchy, and dependencies between microservices. Health of each microservice is reflected in the color of nodes in the map to help you spot potential problems and bottlenecks in your application infrastructure. + +AI-Driven Investigations list and map + +### View a summary of all service activity + +AI-Driven Investigations provides an AI-generated summary of all detected service signals and steps to remediate issues. + +1. Click the summary button to the right of the services map.
Summary button +1. The **Summary** panel will open, displaying observations, root cause analysis, and recommended next steps.
Signals summary +1. Carefully review the summary to learn actions you can take to address the findings. + +### View the summary for a single service + +When you select a service in the list or a node in the map that has signals, a summary panel displays to the right. The panel contains findings about the service with log examples and steps you can take to remediate problems with the service. + +1. To find services to investigate, at the top of the screen use the following controls:
Filter results + * **Environment**. Select the environment to investigate. + * **Search Services**. Enter keywords to search services names. + * **Signal Type**. Select the signal types to search for: + * **Latency**. An increase or decrease in latency of the requests to the system. + * **Errors**. Error signals detected. + * **Services with Signals**. Show only services with signals. Normally operating services will not be shown. +1. Click a service in the list, or a node in the map. The **App Service Summary** panel displays to the right showing signals of interest and recommended next steps.
Service summary example +1. Click an expand arrow on a signal to view an example of a log entry that illustrates the issue. You can use this information to query for logs with similar content.
Log example +1. Scroll to the bottom of the **App Service Summary** pane to the **Next Steps** section. This section describes concrete steps you can take to remediate issues identified in the selected service.
AI-Driven Investigations next steps +1. Click Mobot logo to [open Mobot](/docs/search/copilot/#step-1-open-copilot). Use Mobot to investigate further. + +### Explore the AI-Driven Investigations UI + +Perform the following steps to explore the UI: +1. The legend at the bottom of the screen shows that gold nodes in the map represent services with signals, while blue nodes indicate normal, expected activity. Use the zoom buttons to resize the map.
Resize buttons +1. Click **Generate Latest** to refresh the services list and map with the most current version.
Refresh button +1. Click **History** to browse previously-generated versions.
Refresh button
Services history + 1. To open a version, select a previous version directly from the list. When you select a version, the time and date of the version appears at the top of the page. Click **Revert to Recent** if you want to switch back to the most recent version.
Timestamp + 1. Click **Select Date** and **Select Time** to find a specific version. You can search for a time in the past 14 days for a desired investigation. + 1. If an investigation does not exist for a specific date and time, you can generate it.
Generate an investigation +1. Click the buttons on the right to regenerate the services list and map or provide feedback:
Regenerate and feedback buttons + * Click the **Regenerate** Regenerate button button to display this dialog:
Regenerate map + 1. Select from **Concerns** to provide feedback about the current view, and select from **Variations** to request how AI should automatically adjust regeneration. + 1. Click **Regenerate** to regenerate the service list and map using the last 15 minutes of data. + :::warning + It is only necessary to regenerate if it has been longer than 15 minutes since last generation. Do not regenerate multiple times in quick succession, because doing so will not result in new results. + ::: + * Click the **Mark as verified** Mark as verified button button to provide feedback that the current services list and map are good. + * Click the **Needs improvement** Needs improvement button button to provide feedback that the current services list and map need work. In the provided box, describe what was unclear, inaccurate, or unhelpful. + +## FAQ + +### How is data for AI-Driven Investigations generated? + +Data for AI-Driven Investigations is generated by our AI system leveraging Claude on Bedrock, which is specially trained to provide actionable signal intelligence at the system level. The dataset is sampled periodically every 15 to 30 minutes using our proprietary algorithm, which ensures comprehensive log collection from all services. It effectively deduplicates logs and filters out noise to maintain data quality. + +### What is the confidence level of the large language model (LLM) output? + +There is a high degree of confidence in the AI outputs as verified through human judging of sample sets. Sumo Logic internally relies on the human judging process and follows that up with tuning the dataset or the prompt. + +Furthermore, you can provide feedback, such as noting it is missing services. + +### What information is generated? + +Data is generated by passing a sample of data to the LLM for the past 15 minutes along with a prompt. This returns a "service summary" of logs along with log messages related to the signals generated, with a hypothesis of the problem and next steps for further exploration. + +Our AI delivers actionable intelligence in near-real-time via log analysis only. The resulting service map highlights the interconnection of various services and components. The summary and signals highlight what services are functioning normally, and any that might have errors or latency issues. Clicking on an individual service lets you view the specific signals generated for the service. Next steps are suggested for how to resolve any issues that might be present. From there, you can view example log lines, and dig deeper into the logs if needed. + +### How does regeneration work? + +Regeneration takes the same sampled data that was used for the first attempt and sends it to the model again, along with special instructions based on your feedback about whether anything looked incorrect (missing services, wrong connections, service names), and how different they want the result to be (subtly different, or very different). + +The idea is that the model gets to try again with a hint about what to focus on. The new result may be the same or different, and it may or not be more correct than the original result. + +### What are the signal types? + +The signal types are: +* **Latency**. An increase or decrease in latency of the requests to the system. +* **Errors**. Error signals detected. + + + +These signals are extracted based on the logs observed for the last 15 minutes. + +### Is customer data used to train the model? + +No customer data is used to train the model. We use a Foundation Model (FM) with custom prompts that don’t use customer data to train. + +### What sort of instrumentation is required? + +No instrumentation is required. You can send your structured and unstructured data to Sumo Logic through normal data collection to drive s. + +### And are log format limitations? + +There is no limitation on log formats. + +### Can you choose which logs to use in AI-Driven Investigations? + +No, you can't choose which logs to use in AI-Driven Investigations. AI-Driven Investigations will sample all logs in your environment for the desired timeframe. diff --git a/static/img/observability/copilot-logo.png b/static/img/observability/copilot-logo.png new file mode 100644 index 0000000000..835c4e7ec5 Binary files /dev/null and b/static/img/observability/copilot-logo.png differ diff --git a/static/img/observability/filter-results.png b/static/img/observability/filter-results.png new file mode 100644 index 0000000000..f01d24a978 Binary files /dev/null and b/static/img/observability/filter-results.png differ diff --git a/static/img/observability/regenerate-map.png b/static/img/observability/regenerate-map.png new file mode 100644 index 0000000000..a88a58f94a Binary files /dev/null and b/static/img/observability/regenerate-map.png differ diff --git a/static/img/observability/service-intelligence-generate-button.png b/static/img/observability/service-intelligence-generate-button.png new file mode 100644 index 0000000000..6ffb94c54b Binary files /dev/null and b/static/img/observability/service-intelligence-generate-button.png differ diff --git a/static/img/observability/service-intelligence-historical-view-time.png b/static/img/observability/service-intelligence-historical-view-time.png new file mode 100644 index 0000000000..cce2c89f0d Binary files /dev/null and b/static/img/observability/service-intelligence-historical-view-time.png differ diff --git a/static/img/observability/service-intelligence-history-dialog.png b/static/img/observability/service-intelligence-history-dialog.png new file mode 100644 index 0000000000..922bf30087 Binary files /dev/null and b/static/img/observability/service-intelligence-history-dialog.png differ diff --git a/static/img/observability/service-intelligence-history.png b/static/img/observability/service-intelligence-history.png new file mode 100644 index 0000000000..079f893285 Binary files /dev/null and b/static/img/observability/service-intelligence-history.png differ diff --git a/static/img/observability/service-intelligence-icon.png b/static/img/observability/service-intelligence-icon.png new file mode 100644 index 0000000000..376ea505c0 Binary files /dev/null and b/static/img/observability/service-intelligence-icon.png differ diff --git a/static/img/observability/service-intelligence-initial-map.png b/static/img/observability/service-intelligence-initial-map.png new file mode 100644 index 0000000000..99cf0ac5ba Binary files /dev/null and b/static/img/observability/service-intelligence-initial-map.png differ diff --git a/static/img/observability/service-intelligence-log-example.png b/static/img/observability/service-intelligence-log-example.png new file mode 100644 index 0000000000..d7915e4080 Binary files /dev/null and b/static/img/observability/service-intelligence-log-example.png differ diff --git a/static/img/observability/service-intelligence-next-steps.png b/static/img/observability/service-intelligence-next-steps.png new file mode 100644 index 0000000000..27d5426020 Binary files /dev/null and b/static/img/observability/service-intelligence-next-steps.png differ diff --git a/static/img/observability/service-intelligence-refresh.png b/static/img/observability/service-intelligence-refresh.png new file mode 100644 index 0000000000..f642baea4b Binary files /dev/null and b/static/img/observability/service-intelligence-refresh.png differ diff --git a/static/img/observability/service-intelligence-regenerate-and-feedback-buttons.png b/static/img/observability/service-intelligence-regenerate-and-feedback-buttons.png new file mode 100644 index 0000000000..cfa693d9a6 Binary files /dev/null and b/static/img/observability/service-intelligence-regenerate-and-feedback-buttons.png differ diff --git a/static/img/observability/service-intelligence-regenerate-button.png b/static/img/observability/service-intelligence-regenerate-button.png new file mode 100644 index 0000000000..4061eecb4b Binary files /dev/null and b/static/img/observability/service-intelligence-regenerate-button.png differ diff --git a/static/img/observability/service-intelligence-service-example.png b/static/img/observability/service-intelligence-service-example.png new file mode 100644 index 0000000000..6ce8e0e993 Binary files /dev/null and b/static/img/observability/service-intelligence-service-example.png differ diff --git a/static/img/observability/service-intelligence-signals-summary.png b/static/img/observability/service-intelligence-signals-summary.png new file mode 100644 index 0000000000..cdb268c7ee Binary files /dev/null and b/static/img/observability/service-intelligence-signals-summary.png differ diff --git a/static/img/observability/service-intelligence-size-buttons.png b/static/img/observability/service-intelligence-size-buttons.png new file mode 100644 index 0000000000..fe7aa1e299 Binary files /dev/null and b/static/img/observability/service-intelligence-size-buttons.png differ diff --git a/static/img/observability/service-intelligence-thumbs-down.png b/static/img/observability/service-intelligence-thumbs-down.png new file mode 100644 index 0000000000..8bcc6fb9c5 Binary files /dev/null and b/static/img/observability/service-intelligence-thumbs-down.png differ diff --git a/static/img/observability/service-intelligence-thumbs-up.png b/static/img/observability/service-intelligence-thumbs-up.png new file mode 100644 index 0000000000..aefc39fa74 Binary files /dev/null and b/static/img/observability/service-intelligence-thumbs-up.png differ diff --git a/static/img/observability/summary-button.png b/static/img/observability/summary-button.png new file mode 100644 index 0000000000..c33105ea4e Binary files /dev/null and b/static/img/observability/summary-button.png differ