Observability Analysis¶

Obsy Copilot can combine the context of the current page with the workspace data accessible to the current user to summarize, analyze anomalies, and locate root causes for observable objects. This page also includes the AI aggregation capability automatically executed by alert policies. Different capabilities correspond to different data entry points and result formats. Before using any capability, you should first enter the page or business process that needs analysis.

Page Analysis & Root Cause Location¶

When you are viewing a specific anomaly and want to quickly understand the phenomenon, identify possible causes, or determine the next investigation direction, you can directly open Obsy Copilot on the current page.

This capability currently covers the following page types:

• Alert events, Error Center, and Incidents;
• Log and trace details;
• Dashboards;
• RUM sessions, pages, resources, actions, long tasks, and errors;
• Security signals;
• Hosts, containers, Kubernetes objects, processes, and database objects;
• Network overview, topology, network flows, network devices, and network paths;
• Database query details, where SQL optimization rules are covered in Database Query Optimization.

The actual supported scope depends on whether the current page provides analysis context to Obsy Copilot.

Analyze the Current Page¶

1. Open the detail page that needs analysis and adjust the page time range to the period of interest.
2. Open Obsy Copilot, click the quick analysis prompt provided on the page, or directly describe the analysis goal.
3. If you have a specific focus, supplement the scope of impact, related services, anomaly time window, or expected output that needs to be determined.

The following pages may display corresponding quick analysis prompts:

The quick prompt disappears after you start entering other content, send a message, switch objects, or close the panel. The same object prompts only once within the same panel session; after the prompt disappears, you can still directly input the same target.

Analysis Results¶

Obsy Copilot first reads the current object, then queries related evidence within the same time range as needed. For confirmed anomalies, the results typically include:

1. The current object and anomaly description;
2. The most likely root cause or risk direction along with its confidence level;
3. Log, metric, trace, or event evidence supporting the conclusion;
4. Known impact scope;
5. Actionable verification and remediation recommendations.

If the current object has no clear anomaly, Obsy Copilot provides a summary and risk description without assuming a fault just to produce a root cause analysis. When evidence is insufficient, the results indicate the unconfirmed parts and the data that needs to be supplemented.

Analyze Infrastructure Pages¶

On supported infrastructure pages, Obsy Copilot can combine the current object, time range, and filters to help you understand resource status and communication conditions. Currently supported pages include:

• Lists and details of hosts, containers, Kubernetes objects, and processes;
• Lists and details of database objects;
• Lists and details of Network overview, topology, network flows, network devices, and network paths.

To use this capability, first set the time range and filters of interest on the page, then open Obsy Copilot and describe the analysis goal. For example, you can ask "Which hosts require priority attention right now?", "Does this container have resource pressure?", or "Where are the issues concentrated in this network path?"

Obsy Copilot organizes the object status, resource usage, Top distribution, or communication quality within the data scope provided by the current page, and distinguishes confirmed facts, possible risk directions, and still-missing evidence. If the page does not provide necessary fields or there is no data within the current scope, the results explain the limitations rather than interpreting missing data as normal or abnormal.

Database object pages are used to analyze the current status, capacity, and performance clues of instances or resources. To analyze why a specific SQL is slow or whether the execution plan is reasonable, go to the database query detail page and refer to Database Query Optimization.

Analyze Dashboards¶

When analyzing a dashboard, Obsy Copilot combines the current time range, filters, and chart content to summarize main trends, anomaly changes, and objects worth further investigation. Before starting the analysis, it is recommended to adjust the dashboard to the business scope of interest. If only some charts are of interest, you can specify them directly in the query.

When the time range is large, the number of charts is high, or queries are complex, the system prioritizes analyzing key charts or samples part of the data to reduce waiting time. The results explain the actual scope of the current analysis, as well as content not fully covered due to sampling, query failure, timeout, or permission restrictions. For a more complete item-by-item check, you can shorten the time range, reduce filter results, or specify the charts that need priority analysis before re-querying.

The trends and anomaly judgments from dashboard analysis are only applicable to the analysis scope stated in the results. For important business decisions or production handling, you should still return to the original charts to verify critical data.

List & Asset Analysis¶

When a single data point is insufficient to explain the overall situation, or when you need to identify anomaly distributions, Top objects, and common characteristics from the current list, you can ask Obsy Copilot to analyze the current list.

This capability is available for dashboards, logs, traces, RUM, alert events, security signals, Error Center, incidents, and supported infrastructure list pages. The specific analyzable fields and objects are determined by the filters and data scope provided by the current page.

Analyze the Current List¶

1. On the list page, set the time range and filters so that the list shows the business scope you want to analyze.
2. Open Obsy Copilot and describe the conclusions you want, such as "Summarize the anomaly distribution of the current list", "Find the service with the most errors", or "Analyze the common characteristics of recent events".
3. If you need comparison or sorting, specify the grouping dimension, metrics of interest, or Top count.

Obsy Copilot uses the query boundary of the current page and prioritizes aggregation or sampling a small number of records rather than reading all details without limits.

If sampling is used, the results indicate the actual data scope covered. To check all objects, you can narrow the time range or filter scope and re-analyze.

Analysis Results¶

The results typically include an overview of the current scope, key counts, Top distribution, representative samples, risk descriptions, and next-step recommendations. If the list lacks sufficient fields, the query fails, or the result is empty, Obsy Copilot retains the current facts and explains the evidence gaps.

List analysis does not change the current filters or perform batch operations on list objects.

Database Query Optimization¶

On the database query detail page, when the query takes too long, scans too many rows, or shows abnormal execution behavior, you can use this capability to analyze the SQL and execution plan.

Perform Optimization Analysis¶

1. Open the target database query detail page.
2. Open Obsy Copilot and enter "Analyze the current SQL", "Why is this query slow?", or "Give optimization recommendations based on the execution plan".
3. If there is a specific goal—such as reducing scanned rows, improving index usage, or reducing sorting overhead—you can include it in the query.

Analysis Results¶

Obsy Copilot analyzes based on the data already available in the current query detail. The results can include:

• Database type, query duration, call count, scanned rows, and returned rows (if available);
• Raw SQL;
• Returned execution plan and key fields;
• Recommendations for query rewriting, indexing, filter conditions, or execution methods.

If the detail does not return an execution plan, Obsy Copilot shows the existing SQL and explains the missing evidence, without fabricating execution nodes or costs. This capability only provides analysis and recommendations; it does not automatically execute the rewritten SQL or modify database objects.

Alert Aggregation & Compression¶

When a large number of duplicate or related alerts are generated in the same period, making it difficult to identify the main issue by reading them one by one, you can enable AI Aggregation in the alert policy. The system classifies, deduplicates, and summarizes alerts within the configured aggregation window, and then sends the aggregated notification according to the alert policy. This capability is automatically executed by the alert policy; you do not need to open Obsy Copilot or start a conversation.

This capability focuses on identifying:

• Repeated alerts triggered by the same monitor;
• Related alerts from the same host, application, service, or dependency;
• Common categories such as cloud platform, infrastructure, Kubernetes, middleware, database, log, trace, and delivery chain;
• High-frequency objects and anomalies requiring priority attention.

Aggregation Results¶

The system generates a structured result based on the aggregation time range and the input alert set, including:

• The number of monitors that triggered alerts and the number of alert notifications within the aggregation window;
• Monitors, representative titles, and classification summaries organized by anomaly type;
• Correlation descriptions for high-frequency hosts, applications, or services;
• Recommendations for duplicate alerts, related anomalies, and priority investigation objects.

Resolved events can be used to indicate that an issue has been resolved, but they are not counted in the anomaly alert count and are not used as primary evidence for root cause recommendations. The aggregation results are based solely on the content of the alerts passed in this batch and cannot replace further verification of original metrics, logs, and traces.

Incident Initial Analysis¶

In the scenario of generating an incident from the Incident Center, you can use Obsy Copilot to generate a structured initial assessment based on the event details that have been passed in, helping the person handling the incident quickly understand the problem background and begin investigation.

Initial Analysis Results¶

When this capability is enabled in the current workflow, Obsy Copilot extracts available information from the event details and organizes the following content based on actual data:

• Event title, status or severity, and first occurrence time;
• Detection time range, affected objects, and key metric snapshots;
• Possible causes sorted by priority;
• Recommendations for urgent investigation, change rollback, and escalation.

The initial analysis only uses the event details passed in from the current incident workflow. If time, severity, impact scope, or metrics are missing, those sections are omitted and the uncertainty is clearly stated without fabricating data.