epok
HOW IT WORKS

Logs in. Answers out.
Every layer is inspectable.

Twenty detectors run on every log line. Each layer is independently observable — inspect candidates, suppression decisions, and the evidence behind any fire.

01INGESTraw lines

Anything that speaks HTTP.

Send via FluentBit, Vector, Promtail, the OpenTelemetry collector, syslog forwarders, CloudWatch subscription filters, or a curl script. No SDKs, no agents required. Typically searchable within seconds of POST.

FORMATSLoki push · OTLP · Elasticsearch bulk · syslog · GELF · JSON
LATENCYSub-second from POST to searchable
THROUGHPUTProduction-scale per tenant
02NORMALIZEstructured records

Field extraction without a schema.

Severity, service, hostname, and trace IDs are extracted automatically. Custom fields are stored as-is — no schema to declare, no cardinality tax. JSON is parsed; raw text is kept searchable.

EXTRACTIONSeverity · service · host · trace ID · auto
CUSTOM FIELDSSchemaless · no cardinality limit
RAWAlways preserved · grep-searchable
03FINGERPRINTstable pattern IDs

Template clustering.

Every line is hashed to a stable template — variable values (UUIDs, IPs, timestamps) are abstracted out, leaving the structural shape. The same error across a thousand unique strings collapses to one pattern fingerprint.

ALGORITHMTemplate-based clustering · structural shape
CARDINALITYStable templates per tenant · grows with new error shapes
STABILITYSurvives schema churn · backwards compatible
04BASELINEanomaly scores per stream

Per-service rolling distributions.

A rolling distribution per service per hour-of-week. Seasonal patterns are learned. A 3am spike on a quiet weekend service isn't compared to peak business hours on a noisy production API. Statistical detectors score deviations against this baseline.

MODELRolling per-service · hour-of-week · seasonal
WARM-UP7 days to full baseline · backfilled at connect
UPDATEContinuous · changepoint-aware
05DETECTcandidate alerts

Twenty detectors run in parallel.

Statistical detectors (new error, silence, volume anomaly, golden signals, outlier) consume baselines. Domain rule packs (Kubernetes, AWS, serverless, database, dependency, web, security, search, infrastructure) match deterministic patterns. Each detector emits independent candidate alerts with confidence scores.

STATISTICAL6 detectors · learned thresholds · evidence-gated
ERROR INTELLIGENCE3 detectors · pattern + semantic clustering · changepoint
RULE PACKS9 packs · deterministic · fire from minute one
SLO & CUSTOM2 detectors · user-defined thresholds + composites
PARALLELISMAll 20 detectors run on every line · no ordering
06SUPPRESSunique fires

Fingerprint dedup + ack-aware quieting.

Candidates that share a fingerprint are folded into a single alert with a fire count. Repeat-fires that don't get acknowledged learn to stay quieter — the pager isn't asked twice for the same thing. Acknowledged-and-not-resolved alerts suppress duplicates until they're closed.

DEDUPFingerprint-based · per-tenant · 24h rolling
ACK-AWAREUnacked repeat-fires de-escalate
RECOVERYAuto-resolves when signal returns to baseline
07CORRELATEincident objects

Cascade graph across services.

When two or more detectors fire on related services within a time window, they're folded into one incident. The dependency graph between services is inferred from log content — "X called Y and got a timeout" is a directed edge. Cascades present as one page, not five.

GRAPHInferred from log content · no manual config
WINDOWTime-bound · default 5 min · per-incident
MERGESemantic dedup across detectors
08ANALYZEdiagnosis

Root-cause scoring + blast radius.

Each candidate cause gets a readable score — origin vs. victim classification, failure type (TIMEOUT / OOM / AUTH / CONFIG / CONNECTION / CRASH), and a recency-weighted evidence count. Blast radius (affected services, users, endpoints) and "what changed" (recent deploys, config diffs) are computed in parallel.

RANKINGPer-candidate score · origin vs. victim · type
WHAT CHANGEDDeploys · config · service · in incident window
BLAST RADIUSServices · users · endpoints
09NARRATEthe page

LLM writeup, cited evidence.

The final layer drafts a 2–3 sentence root-cause hypothesis from the diagnosis. Every claim links to the specific log lines that produced it. The output is what arrives in Slack and PagerDuty — what happened, probable cause, what to check first. AI included on every tier, including the trial.

DRAFTLLM writeup · 2–3 sentences · cited
NOTIFICATIONSlack · PagerDuty · webhook · email
AVAILABILITYAI writeup on Trial + Team+

Want to see all nine in action?

The live demo runs the full pipeline on a synthetic log stream. Click any alert to see the candidates, the suppressed dupes, the cited evidence — every layer leaves an audit trail.