AI Investigator
Ask a question about your logs in plain language. Why did checkout fail at 14:00? Which users logged in from a new country this week? The investigator writes and runs the searches itself and answers with the evidence it found.
Overview
The investigator lives in the workspace: type in Ask anything about your logs… and press Enter. It plans a few steps, runs LPQL searches against your data, reads the results and runs follow-up searches until it can answer. You see every step and every query it ran, so you can open any of them in Search.
Every plan includes the AI Investigator, Free included. It uses AI credits (see AI credits).
Modes
Pick a mode next to the input, or leave it on Auto.
| Mode | What you get |
|---|---|
| Auto | The investigator picks Investigate or Insight from your question. |
| Investigate | A root-cause analysis: what happened, since when, where, and the findings that prove it. |
| Insight | A dashboard of panels (counts, trends, top values) that answers the question, ready to save. |
| Search | The LPQL editor, for when you know the query. See LPQL syntax. |
Follow-up questions
An investigation is a conversation. Ask a follow-up ("and on the other hosts?", "only since the deploy") and the investigator keeps the context of the earlier answers. Every investigation lands in your history, where you can open, continue or delete it. A running investigation can be cancelled.
Effort
Effort sets how far the investigator digs: default, more or high. More effort means more steps and searches, a more thorough answer, and more credits.
Findings and evidence
An answer consists of findings. Each finding says what the investigator concluded and links to its evidence: the query and the log lines it is based on. Open the evidence to check a conclusion yourself before you act on it.
Workspace memory
The investigator remembers facts about your organization in a workspace memory, such as which index holds which application or what a host name means. That makes later answers faster and more precise.
Access and data
The investigator searches as you. It only sees the indexes and namespace your role may see, exactly like your own searches. Every investigation is written to the audit log.
AI runs on Claude via Amazon Bedrock in the EU region Stockholm. Amazon is a US provider. Owners can switch AI off for the whole organization; the investigator then refuses new questions.
AI credits
Each investigation turn uses AI credits from your plan. The balance is checked before every turn. When the credits for the period are used up, new questions are refused until the next period or an upgrade.
API
The same investigator is available over the API with a personal access token, and to AI assistants through the MCP server.
| Call | What it does |
|---|---|
POST /api/v1/ai/investigate | Start or continue an investigation: question (3 to 1000 characters), optional conversationId, effort and mode |
POST /api/v1/ai/investigate/:sessionId/cancel | Cancel a running investigation |
GET /api/v1/ai/investigations | Your investigation history |
GET / DELETE /api/v1/ai/investigations/:id | Read or delete one investigation |
GET /api/v1/ai/investigations/:id/findings/:findingId/evidence | The evidence behind a finding |
POST / DELETE /api/v1/ai/investigations/:id/share | Create or revoke a share link |
PATCH /api/v1/ai/investigations/:id/visibility | private or organization |
GET /api/v1/ai/shared/:token | Read a shared investigation, no sign-in |
POST /api/v1/ai/investigations/:id/feedback | Rate an answer: thumbsUp and an optional note |
curl -X POST https://api.logpulse.io/api/v1/ai/investigate \
-H "Authorization: Bearer $LOGPULSE_TOKEN" \
-H "Content-Type: application/json" \
-d '{"question": "Why did the checkout service return 500s in the last hour?", "mode": "investigate"}'Limits
| Limit | Value |
|---|---|
| New investigations | 5 per minute |
| Question length | 3 to 1000 characters |
| Credits used up | HTTP 429 |
| AI switched off for the organization | HTTP 403 |