LogClaw – Open-source AI SRE that auto-creates tickets from logs

Ingests structured and unstructured logs from multiple sources (files, syslog, cloud platforms) and parses them into normalized event objects using pattern matching and optional LLM-assisted semantic extraction. Supports real-time streaming via file watchers or batch ingestion, with configurable parsers for common log formats (JSON, syslog, Apache, Nginx, application-specific formats).

Analyzes parsed logs to identify anomalies and group related events using statistical baselines, pattern frequency analysis, and optional LLM-based semantic similarity clustering. Detects deviations from normal behavior (error rate spikes, unusual latency patterns, new error types) by comparing against historical baselines or predefined thresholds, then clusters related anomalies to reduce alert fatigue.

Automatically generates incident tickets (Jira, GitHub Issues, PagerDuty, etc.) from detected anomalies by extracting root cause signals from logs, generating human-readable summaries, and populating structured fields (severity, affected service, reproduction steps). Uses LLM to synthesize log context into actionable ticket descriptions with relevant stack traces, error messages, and suggested remediation steps.

Correlates logs across multiple services and data sources (application logs, infrastructure metrics, distributed traces, deployment events) to provide cross-system context for incident analysis. Enriches log events with metadata from external sources (service topology, recent deployments, infrastructure state) using timestamp-based joining and optional semantic correlation via LLM.

Routes generated tickets and alerts to appropriate teams based on configurable rules (service ownership, severity, time-of-day, escalation policies). Supports multiple notification channels (Slack, email, PagerDuty, webhooks) with customizable message formatting and optional deduplication to prevent alert storms. Implements escalation logic (e.g., page on-call if not acknowledged within 15 minutes).

Collects feedback on generated tickets and anomalies (false positives, missed incidents, incorrect severity) and uses it to improve future detections and ticket generation. Tracks which tickets led to actual incidents, which were false alarms, and which anomalies were missed, then retrains or fine-tunes detection models and LLM prompts based on this feedback.

Allows users to define custom anomaly detection rules, log parsing patterns, and ticket generation templates using a domain-specific language (DSL) or visual rule builder. Supports regex patterns, threshold-based rules, time-series patterns (e.g., 'alert if error rate increases 10x in 5 minutes'), and conditional logic for complex scenarios.

Provides searchable archive of historical incidents, anomalies, and generated tickets with full log context and correlation data. Allows users to replay past incidents (re-run anomaly detection on historical logs) to validate rule changes or investigate similar patterns. Supports full-text search, filtering by service/severity/date, and export of incident data for analysis.