AI Monitor¶
AI Monitor uses natural language prompts as continuously effective detection rules. It analyzes observability data in the current Workspace at a set frequency. When a problem that matches the description and is supported by data evidence is found, the system generates an AI Monitor event report and processes it according to the associated Alert Policy.
It is suitable for scenarios that require judgment combining business semantics, metrics, logs, and context. It can convert manual troubleshooting approaches into periodic detection tasks and provide analysis conclusions and detection evidence in event reports.
Differences from Smart Monitors¶
Both AI Monitor and Smart Monitor support describing monitoring needs in natural language, but the role of the prompt and the actual execution method differ:
| Comparison Item | AI Monitor | AI Smart Monitor |
|---|---|---|
| Role of the prompt | The prompt itself serves as the detection rule and remains in effect for every detection. | The prompt is used to generate one or more specific detection rules. |
| Execution method | Each time it runs, the AI queries and analyzes observability data based on the prompt. | After rules are generated and saved, the system executes detection according to the fixed rules and does not re-interpret the prompt on each run. |
| Detection results | The AI generates an event report containing analysis conclusions and data evidence. | It determines whether to generate a Smart Monitor event based on the saved rules; rules hit in the same detection are merged into an analysis report. |
| Adjustment method | Modify the prompt to adjust subsequent analysis objectives and judgment requirements. | Modify rule thresholds or rule status, or regenerate the configuration after modifying the requirement description. |
Use Cases¶
| Scenario | Data Objects That Can Be Added | Prompt Writing Focus | Purpose |
|---|---|---|---|
| Error log troubleshooting | Log indexes, sources, and related fields of the order service | Time range, service, error symptoms, duration | Identify issues such as sudden error volume spikes or repeated specific errors, and obtain analysis conclusions and troubleshooting recommendations. |
| Service quality inspection | Service-related metrics and tags | Environment, service, metrics of interest, abnormal behavior | Continuously monitor changes such as request volume drops, error rate increases, or slower responses. |
| Post-release observation | Metrics and logs involved in the release | Release scope, observation period, key risks | Check for abnormal signals during a fixed period after release to help determine whether further troubleshooting is needed. |
Create a Monitor¶
Go to Monitoring > AI Monitor and click Create AI Monitor:
- Enter the monitor name, and select the detection frequency and problem category;
- Write the detection prompt;
- Add mentioned data objects as needed;
- Under Advanced Settings, you can set the credit budget per detection to limit credit consumption for each detection task;
- Test the current configuration;
- Select an Alert Policy, configure operational permissions, and save.
Detection Configuration¶
Basic Information¶
| Configuration Item | Description |
|---|---|
| Name | Used to identify the current monitor. It is recommended to reflect the detection target and objective. |
| Detection frequency | The interval at which the AI performs detection. The minimum is 1 hour. |
| Problem category | Options include Security, Stability, Performance, and Cost. Used for event classification, and does not limit the actual scope of problems detected. |
Write the Detection Prompt¶
The prompt is the primary basis for the AI to judge problems, with a maximum of 20,000 characters. The clearer the description, the more accurately the AI can understand the detection objective and select relevant data for analysis.
It is recommended to specify the following in the prompt:
| Content | Description | Example |
|---|---|---|
| Analysis target | The service, environment, business, or log source to check, along with the corresponding name or tag value. | Order service (service:order-service) in the production environment (env:prod) |
| Time range | The time range of data to analyze. | Last 1 hour |
| Judgment clues | The abnormal behavior, change direction, or duration to focus on. | Error volume increases significantly and lasts for more than 10 minutes |
| Impact scope | The scope of services, resources, requests, or users that the AI should focus on. | Order placement endpoint (resource:/api/v1/orders) |
| Expected output | The information expected in the results. | Main error types, possible causes, and troubleshooting recommendations |
The service names, environments, endpoints, and thresholds in the following examples are for illustration only. Replace them with actual values in the current Workspace.
For example, to check error logs for a specified service, enter:
Check error logs of the order service (
service:order-service) in the production environment (env:prod) over the last 1 hour. Focus on the order placement endpoint (resource:/api/v1/orders); if the error volume increases by more than 50% compared with the average over the same period in the past 7 days and lasts for more than 10 minutes, describe the main error types, impact scope, and possible causes, and provide prioritized troubleshooting recommendations.
To check performance metrics for a specified service, enter:
Check the request volume, error rate, and P95 response time of the payment service (
service:payment-service) in the production environment (env:prod) over the last 30 minutes. If the request volume drops by more than 30% compared with the same period in the past 7 days, the error rate exceeds 5%, or the P95 response time stays higher than 1 second for 10 consecutive minutes, describe the anomaly start time, affected endpoints, and possible causes.
Add Data Objects¶
The mentioned data objects provide analysis context for the AI and help it identify the Measurements or log sources it can reference. This configuration is optional and supports search, multi-selection, and removal.
Click Add Data Objects and select in the order of "Data type > Measurement or source > Field or tag":
| Data Type | How to Select |
|---|---|
| Metrics | Select a Measurement, and optionally select fields or tags. |
| Logs | Select a log index and source, and optionally select fields or tags. |
Selected objects are used to limit the analysis context and are not mandatory query conditions. The AI still decides the actual queries based on the prompt, so it is recommended to add only data objects directly related to the detection objective.
Advanced Settings¶
Expand Advanced Settings to configure the Credit Budget per Detection, with a default value of 300 credits. Tests, manual triggers, and scheduled executions all use the budget saved in the current monitor, and credits are deducted based on actual usage.
Alerting and Permissions¶
- Alert Policy: Determines the notification rules, notification targets, and notification channels after an event report is generated;
- Operational Permissions: Used to control which roles, teams, or members can operate on the current monitor.
Test Detection¶
Test Detection is used to verify whether the prompt, data objects, and other configurations produce the expected analysis results:
- Find Test Detection on the create or edit page;
- Click Test Prompt; the system validates and saves the current configuration;
- View the execution progress and detection results;
- Adjust the prompt or data objects as needed and test again.
Test results include:
| Result | Description |
|---|---|
| Issues found | An AI Monitor event report is generated and processed according to the selected Alert Policy. |
| No issues found | The detection results of this run are displayed. |
| Execution failed | Failure information is displayed; adjust the configuration according to the page prompts and test again. |
Testing may trigger alert notifications. Before execution, confirm the notification targets and channels in the Alert Policy to avoid impacting unrelated personnel.
Manage Monitors¶
Search and Filter¶
- Enter the monitor name or ID in the search box;
- Filter monitors by tags, status, or Alert Policy.
View Running Status¶
- Enabled: The monitor runs according to the configured detection frequency;
- Disabled: The monitor stops periodic detection and can be re-enabled as needed;
- Consecutive failures: A consecutive failure indicator appears next to the monitor name. Click it to open the configuration page and check the prompt, data objects, and permission configuration.
Manage a Single Monitor¶
| Operation | Description |
|---|---|
| View or edit | View the monitor configuration; modify the configuration if you have operational permissions. |
| Manually trigger detection | Run detection immediately once using the currently saved configuration. |
| View related events | View the event reports generated by this monitor. |
| Clone | Copy the current monitor configuration to quickly create similar detection tasks. |
| Operation Audit | View operation records for the monitor, such as creation, editing, enabling, and disabling. |
| Delete | Delete the current monitor; existing event reports are still retained in the Incident Center. |
Import and Export¶
- Import: Import monitor configurations in JSON format through the list settings menu;
- Export All: Export all monitor configurations in the current Workspace;
- Export Selected: Select one or more monitors and export the selected configurations.
Billing¶
Each time an AI Monitor runs a detection, it generates Triggers and AI credit usage separately:
| Billing Item | Billing Rule |
|---|---|
| Triggers | Each detection run is counted as 1 Trigger. |
| AI Credits | Deducted based on the actual Credits consumed by this detection run. |
The Credit Budget per Detection in Advanced Settings is used to control credit consumption for a single detection and does not mean that this amount is fixedly deducted each time.
View Related Events¶
After an AI Monitor finds a problem, it generates an event report and automatically aggregates it into the Incident Center, where it is displayed as an event record.
Access Points¶
- Click View Related Events in the AI Monitor list;
- Go to Incident Center > All Events and filter AI Monitor event reports using
df_source:aiMonitor.
Event Content¶
Open the event details to view the structured analysis conclusions generated by the AI, including the problem summary, confidence level and supporting evidence, as well as impact scope, diagnosis, and recommended actions. This helps users understand the problem, confirm the impact, and perform follow-up handling. Related evidence is linked to the data used in this detection run, making it easier to further verify the analysis results.