Ask AI
Query logs and alerts in Elasticsearch in plain language. The gateway translates each question into read-only DSL and dry-runs it before execution.
Ask AI translates a plain-language question into Elasticsearch DSL, runs it, and returns a hits table or an aggregation table. It is the home page after sign-in and is available in every edition.
How a query is processed
The gateway determines the index, time range, and aggregation dimension of the question, then asks the model for DSL. Read-only validation rejects any query that writes or runs a script. A validated query is dry-run against the target index with size=0. If the dry run fails, the error goes back to the model for one repair round; if the repaired query also fails, you are asked to rephrase.
Data sent to the model is masked according to the mode in Settings. In cloud mode, IP addresses, account names, and similar values appear as placeholders such as 10.30.x.x.
Run a query
Steps
- Enter a question in the composer, for example "Top 10 source IPs by failed logins in the last 24 hours".
- (Optional) Select Index: auto to the left of the composer and pick an index from the whitelist.
- (Optional) Select a time range. The default is All time.
- Send the question. Use
Shift+Enterfor a multi-line question.
While the query is generated, the card steps through understanding the question, writing the query, and running it. With a thinking model, the reasoning is folded under AI is thinking.
The card header shows the index, hit count, latency, token use, and Confidence, which is the model's own rating of whether it understood the question. At high, use the result as is. At medium, open the generated query and check the DSL. At low, rephrase the question.
If the question names a time ("in the last hour") and you also select a time range, the query uses the intersection. The card states whether the range was synced, overrode the question, or falls inside it.
If you are not sure what to ask, the home page offers six groups of starter questions with four phrasings each. Select one to send it.
Check and edit the generated query
Steps
- Below the result card, select Show the generated query.
- Select Edit and change the DSL.
- Select Save. The gateway replaces the query with your version and runs it.
An edited query is marked edited on the card. From the same panel you can Copy the DSL or select Open in Kibana, which requires a Kibana URL in Settings.
Drill into an aggregation
Each row of an aggregation table is a bucket. Select a row to pull the raw documents for that bucket into a hits table. Select Back to the aggregate to return.
Hits tables remember their column set per index.
Save a query
In the generated query, select Save as a query and give it a name. Saved queries appear under Saved on the home page of every new conversation. Selecting one reuses the stored DSL without calling the model.
Act on the results
| Action | Description |
|---|---|
| Explain these results | The model summarizes the current results. The summary is kept in Investigations |
| Send to triage | Hands the matching alerts to Triage |
| Export CSV | Exports the current table as CSV. An aggregation exports every bucket |
| Feedback | The query is right and Something is wrong with the query go into a learning library. When you report a problem, you can paste the correct query and similar questions are generated from it next time |
Empty results
When a query returns nothing, the gateway works out whether the data does not exist or the time window, conditions, or index do not match, and offers a next step on the card.
| Case | What the card offers |
|---|---|
| Time window mismatch, for example you asked for the last hour and the newest document is ten days old | The data range of the index and a button to query that range. Documents with future timestamps (a collector wrote local time as UTC) are pointed out as well |
| Several conditions combine to zero hits | Each condition is relaxed in turn and the hit count without it is listed. Select one to re-run with that condition relaxed |
| No match in the selected index | The same conditions are tried in other indices, which are listed with hit counts. Select an index to query only that one, or select Regenerate against all logs if none match |
| The question spans several sources and some match nothing | The source with no hits is named, with a hint that its field values may be written differently |
A common reason a relaxed condition finds hits is wording: the log says Out of memory while the question says OOM.
Ask follow-up questions
Within a conversation, the model carries the previous turn's context. It reuses the previous index (the card marks it) and resolves references such as "the first one" or "that IP". To change topic, select New conversation in the top right.
Conversations are stored on the gateway in the .rst_copilot_conversations index, expire after 7 days without activity, and can be continued from another browser. Select the conversation name in the top left to open Recent conversations. Failed, interrupted, and still-generating conversations are badged.
First-token timeout
If the model returns no first token within 45 seconds, the gateway cancels the request and prompts you to retry. RST_LLM_FIRST_TOKEN_TIMEOUT_S sets the timeout; 0 disables it.
The usual cause is a congested model endpoint. If it keeps happening, lower the reasoning level of that provider in AI settings or add another provider.