AlertSense

AlertSense: AI incident triage agent — searches Elastic logs via MCP, analyzes with Gemini, returns P0/P1 severity + fix steps.

Inspiration

Every engineering team knows the feeling: alerts fire all night, dashboards turn red, and someone asks "why is checkout slow?" — but nobody knows what to fix first.

Elastic gives you powerful search and observability. Gemini gives you reasoning. Yet most tools still stop at answers, not actions. On-call engineers don't need another chatbot — they need an agent that searches logs, finds root cause, and recommends fix steps in minutes.

We built AlertSense to solve alert fatigue — one of the most common, still-unsolved problems in modern DevOps and SaaS operations.

What it does

AlertSense is a multi-step AI incident triage agent. Describe an incident in plain language — for example:

"Customers say checkout is slow — what broke?"

The agent then:

Detects incident intent from your message
Searches ERROR and WARN logs from Elasticsearch via Elastic MCP
Analyzes patterns with Gemini (timeouts, circuit breakers, deploy correlation)
Recommends severity (P0/P1/P2), root cause, evidence logs, and actionable fix steps

It goes beyond chat. It uses real tools, retrieves live data from Elastic Cloud, and returns a structured incident report — while keeping humans in control.

How we built it

Elastic Cloud (Serverless) — Observability project with Agent Builder, custom ES|QL tool (search_error_logs), and MCP endpoint
Google Gemini 3.5 Flash — root cause analysis and incident report generation
Google Cloud Agent Builder — agent orchestration aligned with hackathon requirements
FastAPI backend — 4-step agent workflow (detect → search → analyze → recommend)
React frontend — chat UI with agent timeline, severity badges, and evidence logs
Live demo pipeline — sample + live incident logs ingested into Elasticsearch for realistic demos

Architecture: User → AlertSense UI → Gemini + Elastic MCP → Elasticsearch logs

Challenges we ran into

Elastic MCP integration — connecting Agent Builder tools and MCP URL authentication took careful setup
Live vs demo data — early versions fell back to mock logs; we fixed Elasticsearch query field mapping (timestamp vs @timestamp) to pull real live logs
Multi-step reliability — ensuring the agent always searches logs before analyzing, not hallucinating evidence
Gemini API quotas — free-tier rate limits required graceful fallback while keeping Elastic search fully functional
Port and environment setup — coordinating frontend proxy, backend, and Elastic credentials on local Windows dev environment

Accomplishments that we're proud of

Built a functional multi-step agent — not a chatbot wrapper
Meaningful Elastic MCP integration with live log retrieval from Elastic Cloud
Clear P0/P1/P2 severity triage with evidence and fix steps
Polished UI with agent timeline showing each step transparently
End-to-end demo: inject live incident → search Elastic → analyze → recommend
Submitted on Elastic track with a real-world problem: alert fatigue

What we learned

MCP is the bridge between LLM reasoning and real enterprise data — Elastic MCP made log search a first-class agent capability
Agents must act, not answer — hackathon judges care about tool use and multi-step workflows
Observability + AI is powerful when the output is actionable (severity + fix steps), not just search results
Small teams face the same alert fatigue as enterprises — a focused agent beats a giant dashboard
Building with Gemini + Elastic taught us how partner integrations create "superpowers" for agents