Log Analysis

Log analysis turns a question into a bounded query over data you already ingest. Eridian does not become your log store. It reads from the connector window you configured.

Query

POST /v1/ops/logs/query
Authorization: Bearer eridian_sk_...

{
  "project_id": "prj_ops_001",
  "service_id": "svc_auth",
  "model": "auto",
  "question": "Show 500 errors from auth in the last hour, grouped by route.",
  "from": "2026-09-08T13:00:00Z",
  "to": "2026-09-08T14:00:00Z",
  "max_lines": 5000
}

Required scope: ops:write (queries are billed inference plus scan). ops:read can fetch a prior logq_ while retained.

{
  "id": "logq_91",
  "object": "eridian.ops.log_query",
  "status": "completed",
  "model": "gemini",
  "translated_query": "service:auth status:500 @timestamp:[now-1h TO now] | stats count by route",
  "results": [
    { "route": "POST /v1/session", "count": 412 },
    { "route": "GET /v1/session", "count": 19 }
  ],
  "analysis": "412 of 431 500s are POST /v1/session after 13:44Z.",
  "eridian": {
    "route": "gemini",
    "scan_lines": 890000,
    "region": "eu-west-1",
    "cost_usd": 0.11
  }
}

Translation

The model proposes translated_query in the dialect of the connected store (Datadog, Elasticsearch, CloudWatch, Loki). Eridian executes it through the connector with a timeout and a row cap. If the store rejects the query, you get 400 invalid_request with the store message in error.message. The model does not retry unbounded.

Time bounds

from / to are required for production keys. Defaulting to "all time" is rejected. Max window is on Ops Limits. During incidents, prefer 15 to 60 minutes.

Attach to an incident

{
  "incident_id": "inc_2847",
  "question": "Same 500 pattern on payments-api?"
}

The query id is appended to the incident timeline.

What is not allowed

• Exporting raw log lines that contain PAN or secrets to a third-party model. PII redaction runs on the prompt pack. You still must not ingest card data into the connector.
• max_lines above the plan cap.
• Cross-region scan. The connector must sit in the project pin.

See Ops Integrations and On-Call.