search

opensearch-project / skills

Apache License 2.0
8 stars 30 forks source link

[FEATURE] Create alerting monitor tool #338

Open ylwu-amzn opened 5 months ago

ylwu-amzn commented 5 months ago

We have get alerting monitor tool now. We can create some tool to create alerting monitor.

dblock commented 4 months ago

[Catch All Triage, attendees 1, 2, 3, 4, 5, 6, 7]

qianheng-aws commented 4 months ago

Hi, I'm working on implementing this tool, which aims to help create alert with natural language. The tool has 3 input parameters:

  1. question: user's question about creating a new alert
  2. indices: The input indices of the monitor.
  3. chat_history: optional, the chat history of chatbot

This tool is able to request LLM by itself and has its own tool prompt, and it can also get some necessary information by calling OS API.

When this tool is selected by chat agent or invoked by flow agent, it will be executed as following steps:

  1. get the mapping info of the input indices
  2. construct its final tool prompt by substitute the placeholders(e.g. question, indices, chat_history, mapping_info) in its raw prompt
  3. request LLM with the final prompt and got response

  4. extract the alert configuration from the LLM response as its output.

    The tool output format may be like:

    
Tool output:

{ "name": "Error 500 Response Alert", "search": { "indices": ["opensearch_dashboards_sample_data_logs"], "timeField": "timestamp", "bucketValue": 60, "bucketUnitOfTime": "m", "filters": [ { "fieldName": [ { "label": "response", "type": "text" } ], "fieldValue": "500", "operator": "is" } ], "aggregations": [ { "aggregationType": "count", "fieldName": "bytes" } ] }, "triggers": [ { "name": "Error 500 Response Count Above 1", "severity": 1, "thresholdValue": 1, "thresholdEnum": "ABOVE" } ] }


There is a demo video about creating an alert by LLM: https://broadcast.amazon.com/videos/1159580