Added Enhancements to Log Ai Insight by yuliia-fryshko · Pull Request #247291 · elastic/kibana

yuliia-fryshko · 2025-12-22T16:26:28Z

Issue #445

This PR enhances the Log AI Insight:

We implemented a function to identify the log severity. It takes into account both ECS and OTel fields, since we are working with the raw log entry. We check the severity of the log entry, and we only ask the model to include remediation steps when the log severity is warning or higher.
We now always prefetch the ServiceSummary and CorrelatedLogs.

Tested this using the following Cursor prompt prompt_log_ai_insight.md

Here are the results logaiinsightresults.md

It was able to correctly identify errors, and the correlated logs provided enough detail to understand where the error might have occurred.

elasticmachine · 2025-12-22T16:27:28Z

Pinging @elastic/obs-ai-team (Team:obs-ai)

viduni94 · 2025-12-22T18:57:18Z

    You are assisting an SRE who is viewing a log entry in the Kibana Logs UI.
-    Using the provided data produce a concise, action-oriented response.`);
+    Using the provided data produce a concise, action-oriented response.
+    If it's an issue, provide remediation steps suitable for an on-call SRE.`);


The wording here is a bit ambiguous I feel.

If it's an issue doesn't clearly say what an issue is?
Is it referring to an error log or a warning log? What can be considered as an issue in this context?

And do we need to say suitable for an on-call SRE?

If it's an issue - I added it because, in the message, we ask to explain the log and whether "it is an issue". We didn’t specify what qualifies as an issue there. I’m happy to clarify it if you think it’s needed, but the LLM was able to define it nicely on its own.

Regarding suitable for an on-call SRE - I added this because we already mention in the system promt that the audience is an SRE, and I assume that if there is an issue, we want to provide some next steps to investigate. I don’t have a strong opinion on keeping this part or not and am happy to change it.

I added it because, in the message, we ask to explain the log and whether "it is an issue"

I think that should change as well. We have to avoid ambiguity in system prompt and instructions as much as possible, as different LLMs may interpret it in different ways if it's ambiguous.

…lder/server/routes/ai_insights/get_log_ai_insights.ts Co-authored-by: Viduni Wickramarachchi <viduni.ushanka@gmail.com>

elasticmachine · 2025-12-31T10:52:41Z

Pinging @elastic/obs-presentation-team (Team:obs-presentation)

arturoliduena · 2026-01-02T10:40:24Z

We are adding more information (ServiceSummary, DownstreamDependencies, TraceDocuments, and TraceServices), which is great. But do we need all of them to explain a log message? also worry about the token count.
Maybe we should add more data depending on the log.level, eg. for info we may not want to query and send to the LLM Trace data.
also there is another that we can use here: get_correlated_logs.

sorenlouv · 2026-01-30T15:18:26Z

+        ${entityLinkingInstructions}
+      `)
+    : dedent(`
+        You are an expert SRE assistant analyzing an info, debug, or trace log entry. Keep it concise:


Same as above

sorenlouv · 2026-01-30T15:20:00Z

+    <LogContext>
+    ${context}
+    </LogContext>


Does this cause multiple levels of nesting?

<LogContext> <CorrelatedLogSequence> ... </CorrelatedLogSequence> </LogContext>

If so, remove the LogContext tag

sorenlouv · 2026-01-30T15:21:55Z

-  errorLogsOnly,
+  errorLogsOnly = DEFAULT_ERROR_LOGS_ONLY,
  index,
-  correlationFields,
+  correlationFields = DEFAULT_CORRELATION_IDENTIFIER_FIELDS,
  logId,
-  logSourceFields,
-  maxSequences,
-  maxLogsPerSequence,
+  logSourceFields = DEFAULT_LOG_SOURCE_FIELDS,
+  maxSequences = DEFAULT_MAX_SEQUENCES,
+  maxLogsPerSequence = DEFAULT_MAX_LOGS_PER_SEQUENCE,
 }: {
  core: ObservabilityAgentBuilderCoreSetup;
  logger: Logger;
  esClient: IScopedClusterClient;
  start: string;
  end: string;
  kqlFilter?: string;
-  errorLogsOnly: boolean;
+  errorLogsOnly?: boolean;
  index?: string;
-  correlationFields: string[];
+  correlationFields?: string[];
  logId?: string;
-  logSourceFields: string[];
-  maxSequences: number;
-  maxLogsPerSequence: number;
+  logSourceFields?: string[];
+  maxSequences?: number;
+  maxLogsPerSequence?: number;


I think these should not be optional. Instead of changing this, can you create a function (in this file) that you call, and which just calls getToolHandler?

sorenlouv · 2026-01-30T15:25:13Z

+    });
+
+  await logsSynthtraceEsClient.index([logs]);
+  await logsSynthtraceEsClient.refresh();


Is this necessary when we already have refreshAfterIndex?

kibana/x-pack/solutions/observability/test/api_integration_deployment_agnostic/services/synthtrace.ts

Line 23 in 016123f

refreshAfterIndex: true,

Thanks, I missed that refreshAfterIndex: true is already configured in the synthtrace client manager.

sorenlouv · 2026-01-30T15:26:38Z

+      errorMessage: ERROR_MESSAGE,
+      warningMessage: WARNING_MESSAGE,
+      infoMessage: INFO_MESSAGE,


Where are these used?

sorenlouv · 2026-01-30T15:27:06Z

+    logsSynthtraceEsClient,
+    logData: {
+      traceId,
+      serviceName: SERVICE_NAME,


This should be a param to the data generator (decided by the consumer) and thus not returned

... this would also be more consistent with service environment

…lder/server/routes/ai_insights/get_log_ai_insights.ts Co-authored-by: Søren Louv-Jansen <sorenlouv@gmail.com>

sorenlouv · 2026-01-30T15:29:19Z

-    id,
+    size: 1,
+    _source: false,
+    fields: ['*'],


We shouldn't retrieve all fields - just the fields we need.

…lder/server/utils/warning_and_above_log_filter.ts Co-authored-by: Søren Louv-Jansen <sorenlouv@gmail.com>

sorenlouv · 2026-02-02T12:26:57Z

+      `);
+
+  const userPrompt = dedent(`
+    ${context}


Did you consider adding context to system prompt instead of user prompt? Pros/cons?

Good question! For me the context is the user's input data to analyze, so userPromt is a right point to add it. Also this part will be available for the chat with agent later as a part of attachments

sorenlouv

Just a couple of nits

…lder/server/routes/ai_insights/get_log_ai_insights.ts Co-authored-by: Søren Louv-Jansen <sorenlouv@gmail.com>

…lder/server/routes/ai_insights/get_log_document_by_id.ts Co-authored-by: Søren Louv-Jansen <sorenlouv@gmail.com>

elasticmachine · 2026-02-02T13:53:03Z

💔 Build Failed

Buildkite Build
Commit: 999af77

Failed CI Steps

Check Types

History

💔 Build #388487 failed cac6cfc
💚 Build #388242 succeeded f2faa93
💔 Build #388146 failed 8f6049e
💔 Build #388138 failed 4ea551b
💔 Build #388110 failed 6c67d8d

cc @yuliia-fryshko

Added Remediation Steps to Log Ai Insight system promt

c9aab67

yuliia-fryshko self-assigned this Dec 22, 2025

yuliia-fryshko requested a review from a team as a code owner December 22, 2025 16:26

yuliia-fryshko added backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:obs-ai Observability AI team labels Dec 22, 2025

viduni94 reviewed Dec 22, 2025

View reviewed changes

edited system promt

44b44e2

viduni94 reviewed Dec 23, 2025

View reviewed changes

Comment thread ...ability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts Outdated

yuliia-fryshko added 3 commits December 28, 2025 17:03

added downstream dependencies

b64015b

added trace data

a87c1dc

Merge branch 'main' into edit-log-insight-system-promt-445

e5d48e5

yuliia-fryshko changed the title ~~Added Remediation Steps to Log Ai Insight system promt~~ Added Enhancements to Log Ai Insight Dec 29, 2025

yuliia-fryshko added 2 commits December 29, 2025 12:46

edit log ai system promt to respond base on log type

e02947c

edited wording

769fee0

yuliia-fryshko mentioned this pull request Dec 29, 2025

[Observability Agent] Added markdown links to to select entities #247536

Closed

viduni94 reviewed Dec 30, 2025

View reviewed changes

yuliia-fryshko and others added 5 commits December 31, 2025 09:23

Merge branch 'main' into edit-log-insight-system-promt-445

e50dd81

Update x-pack/solutions/observability/plugins/observability_agent_bui…

52ee4df

…lder/server/routes/ai_insights/get_log_ai_insights.ts Co-authored-by: Viduni Wickramarachchi <viduni.ushanka@gmail.com>

Update x-pack/solutions/observability/plugins/observability_agent_bui…

ac070e8

…lder/server/routes/ai_insights/get_log_ai_insights.ts Co-authored-by: Viduni Wickramarachchi <viduni.ushanka@gmail.com>

Changes from node scripts/eslint_all_files --no-cache --fix

b8c86ee

applied PR review suggestions

b0685ce

yuliia-fryshko requested a review from a team as a code owner December 31, 2025 10:52

botelastic Bot added the Team:obs-presentation Focus: APM UI, Infra UI, Hosts UI, Universal Profiling, Obs Overview and left Navigation label Dec 31, 2025

removed first occurence promt

55affb9

arturoliduena reviewed Jan 2, 2026

View reviewed changes

Comment thread ...ability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts Outdated

Merge branch 'main' into edit-log-insight-system-promt-445

0b45ec5

sorenlouv reviewed Jan 30, 2026

View reviewed changes

Comment thread ...servability/plugins/observability_agent_builder/server/utils/warning_and_above_log_filter.ts Outdated

sorenlouv reviewed Jan 30, 2026

View reviewed changes

Update x-pack/solutions/observability/plugins/observability_agent_bui…

306143a

…lder/server/routes/ai_insights/get_log_ai_insights.ts Co-authored-by: Søren Louv-Jansen <sorenlouv@gmail.com>

sorenlouv reviewed Jan 30, 2026

View reviewed changes

yuliia-fryshko and others added 8 commits January 30, 2026 17:01

created a function to call corelated logs

90e3885

Update x-pack/solutions/observability/plugins/observability_agent_bui…

6c67d8d

…lder/server/utils/warning_and_above_log_filter.ts Co-authored-by: Søren Louv-Jansen <sorenlouv@gmail.com>

fixed review comments

b47a1e6

fixed check type

4ea551b

fixed check type

8f6049e

Changes from node scripts/eslint_all_files --no-cache --fix

51a1ba8

Merge branch 'main' into edit-log-insight-system-promt-445

f2faa93

Merge branch 'main' into edit-log-insight-system-promt-445

cac6cfc

sorenlouv reviewed Feb 2, 2026

View reviewed changes

Comment thread ...ability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts Outdated

sorenlouv reviewed Feb 2, 2026

View reviewed changes

Comment thread ...lity/plugins/observability_agent_builder/server/routes/ai_insights/get_log_document_by_id.ts Outdated

sorenlouv reviewed Feb 2, 2026

View reviewed changes

Comment thread ...ability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts

sorenlouv approved these changes Feb 2, 2026

View reviewed changes

yuliia-fryshko and others added 4 commits February 2, 2026 14:06

Update x-pack/solutions/observability/plugins/observability_agent_bui…

430b890

…lder/server/routes/ai_insights/get_log_ai_insights.ts Co-authored-by: Søren Louv-Jansen <sorenlouv@gmail.com>

Update x-pack/solutions/observability/plugins/observability_agent_bui…

a3a965b

…lder/server/routes/ai_insights/get_log_ai_insights.ts Co-authored-by: Søren Louv-Jansen <sorenlouv@gmail.com>

Update x-pack/solutions/observability/plugins/observability_agent_bui…

6500993

…lder/server/routes/ai_insights/get_log_document_by_id.ts Co-authored-by: Søren Louv-Jansen <sorenlouv@gmail.com>

fixed review comment

999af77

fixed type check

bbce724

yuliia-fryshko merged commit 6185ec2 into elastic:main Feb 3, 2026
16 checks passed

kibanamachine added the v9.4.0 label Feb 3, 2026

Conversation

yuliia-fryshko commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticmachine commented Dec 22, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

viduni94 Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Dec 31, 2025

Uh oh!

Uh oh!

arturoliduena commented Jan 2, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sorenlouv Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sorenlouv left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

yuliia-fryshko commented Dec 22, 2025 •

edited

Loading

viduni94 Dec 23, 2025 •

edited

Loading

sorenlouv Jan 30, 2026 •

edited

Loading

elasticmachine commented Feb 2, 2026 •

edited

Loading