AI Integration

[ashnwade]

Feature Description

Integrate AI to assist users in Query Studio.

Possible Use Cases

Entry interpretation

A user runs a search, e.g. tag=winlog. The user interacts with an individual entry and chooses to "Explain this entry". An LLM "explains" the single entry.

Search result interpretation

A user runs a search, e.g. tag=winlog winlog EventID==4689 Channel==Security. The user chooses an option to "Explain these results to me". The entire collection of entries is fed into an LLM, which is asked to summarize what happened.

Query writing

A user writes an English-language description of their desired search, e.g. "Find any logs from the Gravwell indexer that returned an error", in Query Studio. Then the user chooses an option to "Write as a query". The LLM then populates a query such as tag=gravwell syslog -s Appname==indexer error.