AI AGENTS
On-Demand Log-Spike Investigator (Chat)
Ask in chat about a log-cost jump and an agent queries Honeycomb to find the noisy service and field driving volume.
How it runs
The automated pipeline, trigger to output.
- TriggerChat message describes the spike and time range
- ActionQuery Honeycomb event volume grouped by serviceHoneycomb
- ActionDrill into top service by high-cardinality fieldHoneycomb
- ActionAgent explains contributors and drafts sampling rule
- OutputReply in chat with breakdown and pastable fix
What it does
Turns a vague "why did our log bill jump this week?" into a concrete answer on demand. You ask in chat, the agent investigates Honeycomb event volume, isolates the service and high-cardinality field inflating ingestion, and replies with a ranked breakdown plus a copy-paste sampling rule. No dashboard spelunking required.
When to use it
Use it for ad-hoc investigation during a cost review or a Slack thread, when you don't want a scheduled job but do want an expert answer in seconds. Good for engineers who know the spike happened and just need the culprit and a fix.
How it works
- 1A chat message describing the spike and time range triggers the agent.
- 2It queries Honeycomb for event volume over the window, grouped by service.
- 3It drills into the top service by the field with the highest cardinality contribution.
- 4The agent reasons over the results to explain what drove the volume and how much each factor contributed.
- 5It replies in chat with the ranked breakdown and a drafted sampling rule, ready to apply.
Set it up
What you configure once, before turning it on.
- 1Connect HoneycombDistributed traces and queries.
- 2Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 3Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 4Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More AI Agents workflows
Stale Doc-PR Chaser for Runbook Gaps
On a daily schedule the agent finds runbook doc PRs that were opened from resolved incidents but never reviewed, summarizes what each one fixes.
On-Call Runbook Gap Closer: Resolved Sentry Issues to Doc PRs
An agent reads each newly resolved Sentry issue, compares the actual fix against your existing runbook, and opens a GitHub PR adding the missing remediation steps.
Datadog Bill Spike Attribution Agent
When a daily Datadog cost check detects a spend jump, an agent attributes the increase to the specific services and metric types driving it and posts a ranked breakdown to Slack.
Sentry-to-Confluence Runbook Updater
When a Sentry issue is resolved, the agent finds the matching Confluence runbook page and proposes an inline update with the verified fix.
Custom Metrics Cardinality Spike Pager
A webhook from a Datadog monitor fires when custom-metric cardinality jumps; an agent pinpoints the offending metric and tag, estimates the added cost.
Resolved Incident to Public Troubleshooting Doc
For customer-facing errors resolved in Sentry, the agent drafts a sanitized troubleshooting entry and opens a PR to your ReadMe documentation.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.