LogWeave - distributed log tracer powered with AI

From one distributed event ID to an AI root-cause investigation all through simple CLI interaction.

Comment

Inspiration

When an incident happens, the evidence is scattered across services, regions, and log dashboards. Engineers spend valuable time correlating it before they can begin fixing the failure.

LogWeave was inspired by the idea that an engineer should be able to start with one event ID and immediately follow the evidence across services first in the terminal, then in an AI-assisted root-cause investigation. The goal is not to replace engineers' judgment, it is to remove the tedious correlation work so they can focus on fixing the actual failure.

Over time, LogWeave also turns individual investigations into operational memory. Its history and cross-investigation chat can reveal which services fail most often, whether a root cause is recurring, and where teams should focus their reliability work.

What it does

LogWeave is a terminal-first incident investigation tool for developers and SREs. An engineer enters an event ID, trace ID, or request ID; LogWeave retrieves the correlated logs from Better Stack (or you can set up any Log Provider), prints the raw evidence in the terminal, and uses GPT-5.6 to build a root-cause investigation. The local web report shows comprehensive investigation report, while History lets engineers compare selected investigations and ask AI about recurring patterns across incidents.

How we built it

LogWeave was built in Codex using GPT-5.6 Terra with medium reasoning. Codex accelerated the implementation, iteration, and testing. It also helped in building the one-shot template app that emits a realistic correlated failure.

The product also uses the OpenAI Responses API with gpt-5.6-terra and medium reasoning effort for two tasks:

  • Root-cause investigation: structured output reconstructs a timeline, identifies anomalies, distinguishes observed evidence from inference, and explains the probable root cause.
  • Cross-investigation chat: GPT-5.6 receives only the investigations the engineer selected and answers questions about shared causes, services, and repeated incident patterns.

Challenges we ran into

  • Producing dependable AI output is hard as AI is probabilistic in nature: GPT-5.6 root-cause reports need a predictable structure. We used strict structured output, corrected constraints, and made the UI retain raw logs so engineers can verify every conclusion against the evidence.
  • Building toward shared operational memory: today LogWeave runs locally and saves investigations on one developer's machine. The next challenge is a hosted workspace with team access, durable history across services, and the permissions needed to safely share incident evidence.

Accomplishments that we're proud of

  • We designed a structured investigation template with a timeline, probable root cause, anomalies, misleading evidence (red herrings), and prioritised actions. GPT-5.6 is prompted and constrained to fill those sections, and the UI turns them into a visual timeline and clear next actions while preserving the raw logs for verification.
  • Operational memory starts on day one: History and multi-investigation chat let a developer compare incidents and begin spotting recurring failing services and causes.

What we learned

  • Developer-tool friction matters as much as intelligence. A single CLI flow, an offline fixture, and a one-shot ingestion template make the project easier to evaluate and more realistic to adopt by developers.
  • Raw evidence must stay close to AI conclusions. AI answer becomes much more useful when an engineer can immediately inspect the exact log lines that support or challenge it.

What's next for LogWeave

  • Support more log providers: evolve the current Better Stack connector into provider adapters for Datadog, Elasticsearch, and internal company logging platforms. Each adapter will normalize provider-specific search results into the same LogWeave investigation workflow.
  • Build a hosted team experience: replace local-only investigation files with secure organization workspaces, access controls, and shared history so teams can investigate the same incident together.
  • Create Shared Reliability Memory: turn past root-cause investigations into an AI-searchable service memory. When a new incident arrives, LogWeave can surface similar failures, recurring affected services, previous fixes, and relevant reliability context before the team starts from scratch.

Built With

Share this project:

Updates