DEV Community

Cover image for Query Tencent Cloud CLS Logs from Dify and Automate Alert Analysis
Tencent Cloud -Cloud Log Service
Tencent Cloud -Cloud Log Service

Posted on

Query Tencent Cloud CLS Logs from Dify and Automate Alert Analysis

#ai #logging #dify #observability

Large language model workflows become more useful when they can read operational data directly. The source article introduces the Tencent Cloud CLS log query plugin for Dify. After the plugin is authorized with Tencent Cloud credentials, a Dify application can query CLS log topics and use model reasoning to analyze the returned logs.

The article covers two practical workflows:

  • natural-language log querying from a Dify application;
  • automated alert analysis, where a CLS alert callback triggers a Dify workflow.

What the plugin does

The plugin connects Dify with Tencent Cloud CLS. According to the source article, it provides two capabilities:

Capability Source-backed behavior
Authentication Dify uses Tencent Cloud CAM credentials to access CLS after SecretId and SecretKey are configured
Log search and analysis Dify can query a specified CLS log topic, then use model analysis or reasoning on the returned logs

Install and authorize the plugin

The source article gives two installation paths: use the link at the end of the original article or search for CLS in the Dify marketplace.

After installation:

  1. Open the plugin.
  2. Click the authorization entry.
  3. Fill in Tencent Cloud SecretId and SecretKey.
  4. Set the default CLS log topic.
  5. Save the configuration.

The source recommends creating a separate Tencent Cloud user and binding the read-only CLS policy:

QcloudCLSReadOnlyAccess
Enter fullscreen mode Exit fullscreen mode

Use case 1: natural-language log queries

The first example is the simplest Dify usage path:

  1. Create an application in Dify Studio.
  2. Add the Tencent Cloud CLS query plugin as a tool.
  3. Select the model in the upper-right corner.
  4. Query logs directly from the chat box using natural language.

The source article includes an important caveat: complex log-search requirements still depend on how well the general model understands the CLS query syntax. For complex production queries, the article recommends using the AI query-writing capability in the Tencent Cloud CLS console instead of relying only on broad natural-language prompting.

That is a useful operational boundary. Natural language is good for exploration, but production troubleshooting still benefits from precise query syntax and explicit prompt instructions.

Use case 2: analyze alert causes automatically

The second example turns CLS alerts into a workflow:

  1. CLS triggers an alert.
  2. The alert uses a custom callback to call a Dify workflow API.
  3. The Dify workflow reads the alert content.
  4. The workflow queries related raw logs from CLS.
  5. A model analyzes the logs and attempts to identify the alert cause.
  6. The final message is sent to Enterprise WeChat.

The result shown in the source article contains the original CLS alert plus a clearer model-generated section called intelligent alert-cause analysis.

Build the alert-analysis workflow

The source article provides a workflow import file named:

CLS Alarm Intelligent Early Warning Analysis.yml
Enter fullscreen mode Exit fullscreen mode

It also provides the download URL:

https://drive.weixin.qq.com/s?k=AJEAIQdfAAouqbbyRl
Enter fullscreen mode Exit fullscreen mode

The setup steps from the source are:

  1. Create a Dify workflow and import the case configuration.
  2. Update the Enterprise WeChat node with the webhook key.
  3. Publish the workflow.
  4. Get the Dify workflow API key.
  5. Create a CLS notification content template. The template calls the Dify API and uses the API key in the request header.
  6. Create a CLS integration configuration with the Dify endpoint.
  7. Create a notification channel group and select the content template and integration.
  8. Use that notification channel group in an alert policy.

Operational takeaways

  • Keep plugin credentials scoped. The source recommends a separate user with the CLS read-only policy.
  • Treat natural-language querying as an entry point, not a replacement for precise CLS search syntax in complex cases.
  • For alert automation, make the callback path explicit: CLS alert -> notification template -> integration configuration -> Dify workflow API -> message delivery.
  • Put model reasoning after log retrieval. The workflow first collects related raw logs, then asks the model to analyze them.
  • Use screenshots and workflow files as deployment evidence, but keep API keys and webhook keys out of published articles.

Top comments (0)