AI Query Generator
Describe what you are looking for in plain English, and LogPulse generates the LPQL query for you. No need to memorize syntax — just ask.
Overview
The AI Query Generator is built into the Log Explorer search bar. It translates natural language descriptions into optimized LPQL queries, so you can find the logs you need without knowing the exact syntax. Whether you are new to LogPulse or an experienced user looking to save time, the generator helps you go from question to answer faster.
The generator understands your schema, knows which fields are available in your environment, and produces queries that take advantage of LPQL features like pipe commands, aggregations, and time ranges.
How It Works
The generator works in three stages: it interprets your natural language input, enriches it with context from your environment, and compiles the result into a valid LPQL query.
Natural Language Input
You type a question or description in the search bar, prefixed with a forward slash or by clicking the AI icon. The input can be anything from a simple phrase like "show me errors from the payment service" to a complex request like "compare error rates between us-east-1 and eu-west-1 over the last 24 hours, broken down by service."
The generator supports English and Dutch input. It handles typos, abbreviations, and informal phrasing — you do not need to be precise.
Context Awareness
Before generating a query, the AI inspects your environment to understand what is available. It considers the following context:
| Context | Description |
|---|---|
| Field names | All indexed fields and their types (string, number, boolean, map). |
| Known values | High-frequency values for fields like level, source, namespace, and cluster. |
| Time range | The currently selected time window in the Log Explorer. |
| Recent queries | Your last 10 queries, used to infer intent and avoid repetition. |
| Schema labels | Custom labels and attribute keys defined by your team. |
This context injection is what makes the generator accurate for your specific environment. A generic AI model would not know that your team uses "payment-svc" as the source name for the payment service — but the LogPulse generator does.
Query Generation
The final stage compiles your intent and the environment context into an optimized LPQL query. The generator applies several optimization rules:
1. It places the most selective filters first to maximize partition pruning in ClickHouse.
2. It uses field expressions instead of full-text search when a specific field is known, which is significantly faster.
3. It adds appropriate pipe commands for aggregation, sorting, and limiting when the question implies a summary rather than raw log output.
4. It infers time ranges from your input (for example, "yesterday" maps to earliest=-1d@d latest=@d) and combines them with the currently selected range.
Using the Generator
Quick Search Mode
The fastest way to use the generator is directly from the search bar. Click the sparkle icon (or press /) and type your question. The generated LPQL query appears below the input as a preview. Press Enter to execute it, or Tab to insert it into the search bar for further editing.
> show me all 5xx errors from api-gateway in the last hour
Generated LPQL:
source=api-gateway level=error attributes.status_code>=500 earliest=-1h
| stats count by attributes.status_code
| sort -countAdvanced Mode
For more complex queries, open the AI panel by clicking "AI Query Generator" in the toolbar or pressing Ctrl+K (Cmd+K on macOS). The panel provides a larger input area and shows a step-by-step breakdown of how the query was constructed.
In advanced mode you can also:
1. Pin context fields — force the generator to always include certain filters (for example, always scope to your team's namespace).
2. Set output preferences — tell the generator whether you want raw logs, a count summary, a timechart, or a table.
3. Chain follow-up questions — ask "now break that down by region" and the generator modifies the previous query instead of starting from scratch.
Refining Results
After a query is generated, you can refine it in two ways:
Edit the LPQL directly — the generated query is plain text in the search bar. You can adjust filters, add pipe commands, or change the time range manually.
Ask a follow-up — type another natural language question and the generator will modify the existing query rather than replacing it. For example, after generating a query that shows errors, you could say "also include warnings" and the generator will update the level filter from level=error to (level=error OR level=warn).
Examples
Here are common scenarios showing what you can ask and what the generator produces.
Finding Errors
> show me all errors from the order service in the last 30 minutessource=order-service level=error earliest=-30m | head 100Latency Analysis
> average response time per endpoint for the api-gateway todaysource=api-gateway earliest=-1d@d
| stats avg(attributes.duration_ms) as avg_duration by attributes.endpoint
| sort -avg_durationPattern Detection
> which services have the most errors this week, grouped by hourlevel=error earliest=-7d
| timechart span=1h count by sourceBefore & After Deploys
> compare error rates between 2pm and 3pm yesterday vs today for payment-svcsource=payment-svc level=error
| eval period=if(timestamp >= relative_time(now(), "-1d@d+14h") AND timestamp < relative_time(now(), "-1d@d+15h"), "yesterday", "today")
| stats count by periodSupported Query Types
The generator can produce the following types of LPQL queries:
| Query Type | Description | Example Prompt |
|---|---|---|
| Filter | Field-level and text-search filters | "errors from auth-service" |
| Aggregation | stats, count, avg, sum, min, max, dc | "count errors by source" |
| Time chart | Time-bucketed visualizations | "error trend over the last 24h" |
| Top/Rare | Most or least common values | "top 10 slowest endpoints" |
| Table | Specific fields as columns | "show timestamp, source, event for errors" |
| Dedup | Deduplicate by field | "unique error messages per service" |
| Comparison | Before/after or A/B analysis | "compare today vs yesterday" |
| Multi-pipe | Chained transformations | "errors, grouped by source, sorted by count" |
Tips & Best Practices
1. Be specific about field names when you know them. "Show errors where attributes.order_id is ord_123" produces better results than "find order 123."
2. Mention the output format you want. Saying "as a timechart" or "in a table" tells the generator which pipe commands to use.
3. Use follow-up questions to iterate. Start broad ("show me errors") and narrow down ("only from us-east-1", "just the last hour", "group by service").
4. Review the generated query before running it. The preview shows exactly what will be executed, and you can edit it directly if needed.
5. If you find a generated query useful, save it as a Saved Search. The generator is great for exploration, but recurring queries should be saved for consistency and speed.
Privacy & Data Handling
The AI Query Generator processes your natural language input to produce LPQL queries. Here is what you should know about how your data is handled:
Your log data is never sent to the AI model. The generator only receives your natural language question and schema metadata (field names, types, and high-frequency values). The actual log content stays in your ClickHouse cluster and is never included in the prompt.
Queries are not stored or used for training. Your input is processed in a stateless request-response cycle. There is no persistent memory between sessions beyond the recent query history stored locally in your browser.
The generator runs on LogPulse's own infrastructure. We do not send your schema or queries to third-party AI services. The model runs on dedicated GPU instances within the same region as your LogPulse deployment.
Limitations
The AI Query Generator is powerful but not perfect. Here are the known limitations:
| Limitation | Details |
|---|---|
| Complex joins | The generator cannot produce queries that combine data from multiple indexes or data sources in a single query. |
| Regex patterns | While the generator can produce basic rex commands, it may struggle with complex regular expressions. Write these manually for best results. |
| Ambiguous prompts | Vague inputs like "show me everything" may produce overly broad queries. Be specific about what you are looking for. |
| Custom eval functions | The generator knows built-in LPQL functions but may not recognize custom functions defined by your team. |
| Non-English languages | Full support for English and Dutch. Other languages may work but are not officially supported. |