How to Monitor Logs with Logz.io AI

📌 1) Prerequisites & Setup

▶️ a) Send logs to Logz.io

Before using AI features you must first ingest logs into your Logz.io account. Typical steps:

1. Install a log shipper (e.g., Filebeat, Fluentd, OpenTelemetry Collector).
2. Configure connection to Logz.io with your account token.
3. Verify incoming logs in Logs → Discover / Explore.

This step ensures Logz.io is receiving and indexing your logs for search, alerting, and AI analysis.

🔍 2) Basic Log Monitoring

▶️ a) Search & Explore logs

Inside the Logs → Explore UI:

• Use search filters and timestamp selectors to narrow your view.
• Tail logs with free‑text queries like status:ERROR or service:auth-service to find anomalies.
• Adjust time windows as needed for context (last 15 min, 1 h, 24 h).

🧠 3) Using Logz.io AI Features

Logz.io offers multiple AI‑driven capabilities that help with understanding, detecting, and responding to issues in your logs:

✅ a) AI Insights — Automated issue detection

The Insights tab (under Logs → Discover → Insights) shows AI‑identified issues based on current log views:

• Lists detected abnormalities and assigns severity levels.
• Lets you filter logs tied to specific issues.
• Offers short explanations and suggestions.
• You can create alerts directly from identified issues. (docs.logz.io)

Example Workflow

1. Open Insights while viewing error‑heavy logs.
2. Browse the issue table to see recurring error types.
3. Click on an issue to see related log entries and patterns.
4. Click Create alert to monitor it moving forward.

✅ b) AI Agent — Chat‑based, interactive insights

The AI Agent (part of Logz.io’s AI suite) lets you interact with your logs using natural language:

• It suggests and runs queries based on your prompt.
• Provides root cause insights, trend analysis, and patterns.
• Can be used to turn insights into dashboard panels or alerts.

Example Conversation with AI Agent

1. Open Explore and click the AI Agent button at the top.
2. Ask a question like

• “Show me spikes in error rate for the auth service over the past hour.”

1. The agent runs context‑aware queries and responds with trends, root causes, or next steps.
2. You can ask follow‑ups like

• “Which deployments happened before the spike?” and the Agent adjusts.

This offers a hands‑on, real‑time exploration experience that goes beyond static dashboards.

🚨 4) Alerting + AI‑Enabled Analysis

AI tools in Logz.io can make alerts more actionable.

📌 a) Basic Alert Configuration

1. Go to Logs → Alerts.
2. Create a new alert using a search query (e.g., status:ERROR).
3. Define a threshold (e.g., number of hits per minute).
4. Set recipients (email, Slack, webhook).
5. Save and activate.

🧠 b) AI Agent Analysis on Alerts

You can attach AI analysis to alerts so that every time the alert triggers:

• The AI Agent automatically investigates related logs and metrics.
• Generates a summary of likely root cause, key events, and recommendations.
• Sends these insights to Slack or designated endpoints.

How to Enable

1. Edit an existing alert.
2. Enable the “AI Agent Analysis” option.
3. Choose where the analysis should be delivered (Slack channel, webhook, email).
4. Provide a clear description in the alert (helps the AI generate contextually accurate insight).

The AI Agent runs hourly and investigates events related to that alert automatically.

📊 5) Advanced Monitoring & Options

🔹 a) AI‑Driven Dashboards

After insights surface:

• Use AI Agent to generate dashboards from natural language prompts like:
• “Create a dashboard panel showing 500 error trends per service.”
• Save panels for ongoing observation.

This eliminates manual query and panel creation.

🔹 b) AI Alert Instructions

You can give instructions to AI on how to analyze alerts:

• These act as playbooks telling the AI which checks and data sources to focus on.
• For example:
• Check error logs for service:<SERVICE> for last 30m Examine latency patterns & recent deploys Highlight any 5xx spikes
• Add these to the alert; the AI will execute them when the alert fires.

🔹 c) Correlated Alerts

For complex scenarios:

• You can define alerts involving conditions across multiple log types or services.
• Helps reduce noise by detecting event sequences rather than standalone hits.

🛠️ 6) Putting It Together: Example Scenario

Goal: Catch and analyze intermittent timeouts in your web service.

1. Ingest logs from your web service
2. In Explore, search with queries like message:"timeout" and adjust time range.
3. Use AI Insights tab to identify repeating timeout patterns.
4. Create an alert:

• Trigger if “timeout” appears > X times in 5m.
• Enable AI Agent Analysis.
• Add instructions to look up trace IDs and recent deployments.

1. When alert fires, the AI Agent:

• Analyzes surrounding logs & metrics.
• Posts a summary in Slack with likely root cause and next steps.

1. Convert insights into a dashboard and set alerts for related metrics (latency, CPU).