Featured project

Log Watcher

A multi-project log-analysis and AI triage system you run on your own server. It polls Loki and OpenSearch, groups matching errors into incidents, and asks an LLM to explain each new one.

1 / 2
1 / 2
Log Watcher projects view (light theme)

Overview

What was built

A log-analysis and AI triage system that runs on your own server. It watches Loki and OpenSearch log sources across multiple projects, groups matching error entries into incidents, and uses an LLM to explain the likely root cause of each new one. Resolved incidents build a searchable, cross-project solutions knowledge base.

  • Polls Loki and OpenSearch, and groups matching errors into incidents automatically
  • AI-generated root cause, first action, and recommendation for every new incident
  • Alerts by email or webhook, with maintenance windows to mute planned downtime
  • Searchable, cross-project solutions knowledge base built from resolved incidents

Why it exists

Practical focus

Error logs pile up faster than anyone can read them. The idea was a triage layer that groups the noise into incidents, explains what is likely wrong before a human looks at it, and remembers how the same problem was solved last time.

Technical profile

Features and infrastructure

Log sources & ingestion

  • Loki (LogQL) and OpenSearch adapters behind one shared interface, with connectivity tests and JSON import/export
  • Per-project filter rules matched against label values discovered live from the source, plus an optional message substring filter
  • Every fetch is floored to error-tier severity, then re-checked against a level heuristic to catch false positives
  • Matching entries are deduped and grouped into incidents by signature, with one write per unique signature per poll cycle

AI triage

  • Normalization runs off the poll loop through a queue, so a slow LLM call never blocks ingestion
  • Works with an OpenAI-compatible endpoint or Anthropic's API, chosen per deployment
  • Produces a root cause, first action, and recommendation for every new incident
  • Every AI call is logged with latency and token usage for cost and performance visibility

Alerts & maintenance windows

  • Per-project alerts on a new incident, every N occurrences, or N occurrences within a time window
  • Email and webhook notification channels, webhook covers Slack, Teams, or anything with an incoming-webhook URL
  • Maintenance windows mute alert notifications for a project without pausing ingestion or analysis
  • Acknowledging an incident pauses further alerts while it is being worked

Triage, knowledge base & admin

  • Incidents tracked as open, acknowledged, or resolved, each resolution logged with a category and note
  • Resolution notes form a searchable, cross-project solutions knowledge base for recurring issues
  • Workspace statistics: open/resolved totals per project, plus AI call volume, success rate, and latency
  • Local and LDAP authentication, with an admin area for users, audit log, and system health