9.3LLM-Powered Log Analysis

# ai_log_analyzer.py
import json
from datetime import datetime, timedelta
from collections import Counter
from openai import OpenAI

client = OpenAI()

def analyze_recent_anomalies(logs: list[dict], window_minutes: int = 30) -> str:
    """
    Feed recent error/warning logs to an LLM for anomaly analysis.
    The LLM identifies patterns that static rules would miss.
    """
    # Summarize logs to fit context window
    error_summary = Counter()
    sample_logs = []

    for log in logs:
        key = f"{log.get('service', 'unknown')}:{log.get('event', 'unknown')}"
        error_summary[key] += 1
        if len(sample_logs) < 50:  # keep representative samples
            sample_logs.append(log)

    prompt = f"""You are an SRE analyzing production logs from the last {window_minutes} minutes.

## Error Summary (event:count)
{json.dumps(dict(error_summary.most_common(20)), indent=2)}

## Sample Log Entries
{json.dumps(sample_logs[:20], indent=2, default=str)}

## Task
1. Identify any anomalous patterns (new error types, unusual frequency spikes,
   correlated failures across services).
2. For each anomaly, provide:
   - Severity: critical / warning / info
   - Affected services
   - Likely root cause hypothesis
   - Recommended investigation steps
3. If no anomalies are found, state that the system appears healthy.

Respond in structured JSON format with an "anomalies" array."""

    response = client.chat.completions.create(
        model="gpt-5.5",
        messages=[{"role": "user", "content": prompt}],
        response_format={"type": "json_object"},
        temperature=0.1,
    )

    return response.choices[0].message.content

When to Use AI vs. Static Rules

Scenario	Static Rules	AI Analysis	Both
Known error patterns (e.g., 5xx rate)	Best	Overkill	--
New/unknown error patterns	Cannot detect	Best	--
Error correlation across services	Complex to maintain	Best	--
Capacity forecasting	Basic thresholds	Advanced prediction	Ideal
Incident summarization	Cannot do	Best	--
On-call escalation decisions	Simple rules	Augmentation	Ideal

Rule of thumb: Use static rules for known, well-defined failure modes. Use AI for pattern discovery, correlation, and summarization tasks that would require a human expert.