DEV Community

Cover image for Show DEV: AI Ops Squad Evolves — Ask ERROR Logs in Plain English
databufflabs
databufflabs

Posted on

Show DEV: AI Ops Squad Evolves — Ask ERROR Logs in Plain English

#opensource #showdev #devops #opentelemetry

You can already ask AI about traces. What about ERROR logs?

In our launch post we showed DataBuff — open-source, OpenTelemetry-native APM with an AI agent squad — answering one question across metrics, traces, and topology.

This follow-up uses the same checkout inventory failure (InsufficientStockException on service-b) and walks three real paths: search logs in the UI, jump between Trace and logs, and delegate ERROR log queries to AI.

All screenshots come from one incident window on a live demo environment.

Demo scenario: InsufficientStockException

The demo hammers GET /demo/checkout. service-b throws:

InsufficientStockException: inventory unavailable for skuId=…
Enter fullscreen mode Exit fullscreen mode

OTLP logs land in Apache Doris with trace_id / span_id. Three investigation paths:

  1. Path A — You know the exception name → global log search with facets
  2. Path B — You have a slow trace → span logs + deep links back to global search
  3. Path C — You ask in plain English → AI dispatches log.queryLog* tools

Path A: Global log search

Menu: Application Performance → Log Analysis. No LogQL required — keyword + facets are enough.

Search InsufficientStockException → filter ERROR + service-b → each row has Trace · View to jump to the call chain.

Global log search — keyword + ERROR + service-b facet

Path B: Span logs inside Trace + bidirectional deep links

B1 · Trace header: one click to log analysis

Open a slow checkout trace. The trace header shows TraceID; Log Analysis on the right pre-fills traceId on the global page.

Trace header log analysis link

B2 · Span sidebar: flame graph + Logs tab

Spans marked Logs on the flame tree open a sidebar Logs tab. Select the service-b span to see the ERROR stack.

Span sidebar with flame graph and log tab

B3 · Deep link: "View all in log analysis"

Click at the bottom of the sidebar — the global page auto-fills traceId + spanId and shows only logs in that span context.

Deep link from span to global log analysis

Path C: Ask the AI platform about logs

The UI is for precision. AI is for one-sentence delegation. The smart-query expert registers a log tool family:

AI log query tools registered

Scenario 1: Search ERROR logs by service + keyword

Find ERROR logs for service-b in the last hour related to InsufficientStockException.
List traceIds and key log summaries.
Enter fullscreen mode Exit fullscreen mode

AI dispatches log query by service and keyword

AI summarizes traceIds and log excerpts

Scenario 2: Known traceId → root cause

Given traceId edfa44615dcee4d6bdfeed46d84bfb20, list all ERROR logs on this trace
and explain why checkout failed.
Enter fullscreen mode Exit fullscreen mode

AI lists ERROR logs for a known traceId

Scenario 3: ERROR log volume spike

How did ERROR log volume for service-b trend over the last hour? Any obvious spikes?
Enter fullscreen mode Exit fullscreen mode

AI shows ERROR log trend and spike detection

Tool routing: service/level search → queryLogDetail; known traceId → queryLogsByTraceId; specific span → queryLogsBySpanId; volume spikes → queryLogTrend.

Where the data comes from · vs ELK

OTLP Logs (:4317 / :4318) → Ingest → Doris log_dc_record → POST /log/search. Inject traceId via MDC on the Java side and correlation is automatic.

DataBuff is log exploration in an APM context — not a replacement for ELK/Loki. The win is same context as traces, metrics, and AI without tab-hopping across three systems.

Try it in 5 minutes 

curl -fsSL https://databuff.ai/install.sh | bash
Enter fullscreen mode Exit fullscreen mode

Web UI: http://localhost:27403 · default admin / Databuff@123

GitHub: https://github.com/databufflabs/databuff

Top comments (0)