e-volv

Observability playbook

LogAnomalySweep

Daily clustering of production error logs, surfacing novel signatures and investigating the emitting code, suspected commit, and proposed fix.

Daily, queries the last 24 hours of production error logs across every service, clusters them by normalized signature, and diffs the clusters against the previous run. New signatures and signatures whose rate grew beyond threshold are investigated in the repository: the agent locates the emitting code, reads surrounding logic, correlates against deployed commits, and files an actionable ticket. Configure the repository on the Clone step and the ticket integration on the Create step after importing.

Identifier
log-anomaly-sweep
Version
1.0.2
Steps
5
Triggers
1
  • logs
  • observability
  • anomaly
  • errors
  • sre

When it runs

Scheduleschedule.daily
Schedule
Every day at 07:00 UTC 0 7 * * *
Timezone
UTC

The pipeline

The graph below is the one the workflow opens with in the builder — same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.

React Flow
  1. 01
    Daily Schedule (07:00 UTC)trigger

    The event that starts the run.

  2. 02
    Query and Cluster Logsagent.run

    One agent works the task with its toolkit.

  3. 03
    Clone Repository ⚠️ SET YOUR REPOgit.clone

    Shallow-clones the repository at the right ref.

  4. 04
    Investigate Clustersagent.run

    One agent works the task with its toolkit.

  5. 05
    File Anomaly Ticketticket.create

    Opens a ticket on the connected tracker.

The agent

Log Anomaly Investigator

Base type
Senior Developer
Temperature
0.2
Max iterations
50
Tools
7

Memory · 2

  • memory_writeWrite Memory · write
  • memory_readRead Memory · read

Terminal · 1

  • run_terminal_cmdRun Terminal Command · write

Filesystem · 1

  • read_fileRead File · read

Code search · 1

  • code_searchCode Search · read

Tickets · 1

  • create_ticketCreate Ticket · write

Status · 1

  • update_statusUpdate Status · write