Technical preview

The AI Assistant uses generative AI to provide:

• Chat: Have conversations with the AI Assistant. Chat uses function calling to request, analyze, and visualize your data.
• Contextual insights: Open prompts throughout Observability that explain errors and messages and suggest remediation.

— Click to open this image in fullscreen mode

The AI Assistant integrates with your large language model (LLM) provider through our supported Elastic connectors:

• OpenAI connector for OpenAI or Azure OpenAI Service.
• Amazon Bedrock connector for Amazon Bedrock, specifically for the Claude models.

Requirements

The AI assistant requires the following:

• An account with a third-party generative AI provider that supports function calling. The Observability AI Assistant supports the following providers:
  • OpenAI gpt-4+.
  • Azure OpenAI Service gpt-4(0613) or gpt-4-32k(0613) with API version 2023-07-01-preview or more recent.
  • AWS Bedrock, specifically the Anthropic Claude models.
• The knowledge base requires a 4 GB machine learning node.

Your data and the AI Assistant

Elastic does not use customer data for model training. This includes anything you send the model, such as alert or event data, detection rule configurations, queries, and prompts. However, any data you provide to the AI Assistant will be processed by the third-party provider you chose when setting up the OpenAI connector as part of the assistant setup.

Elastic does not control third-party tools, and assumes no responsibility or liability for their content, operation, or use, nor for any loss or damage that may arise from your using such tools. Please exercise caution when using AI tools with personal, sensitive, or confidential information. Any data you submit may be used by the provider for AI training or other purposes. There is no guarantee that the provider will keep any information you provide secure or confidential. You should familiarize yourself with the privacy practices and terms of use of any generative AI tools prior to use.

Set up the AI Assistant

To set up the AI Assistant:

1. Create an authentication key with your AI provider to authenticate requests from the AI Assistant. You'll use this in the next step. Refer to your provider's documentation for information about creating authentication keys:
   • OpenAI API keys
   • Azure OpenAI Service API keys
   • Amazon Bedrock authentication keys and secrets
2. From Project settings → Management → Connectors, create an OpenAI or Amazon Bedrock connector.
3. Authenticate communication between Observability and the AI provider by providing the following information:
   1. In the URL field, enter the AI provider's API endpoint URL.
   2. Under Authentication, enter the API key or access key/secret you created in the previous step.

Add data to the AI Assistant knowledge base

The AI Assistant uses ELSER, Elastic's semantic search engine, to recall data from its internal knowledge base index to create retrieval augmented generation (RAG) responses. Adding data such as Runbooks, GitHub issues, internal documentation, and Slack messages to the knowledge base gives the AI Assistant context to provide more specific assistance.

You can add information to the knowledge base by asking the AI Assistant to remember something while chatting (for example, "remember this for next time"). The assistant will create a summary of the information and add it to the knowledge base.

You can also add external data to the knowledge base either in the Project Settings UI or using the Elasticsearch Index API.

Use the UI

To add external data to the knowledge base in the Project Settings UI:

1. Go to Project Settings.

2. In the Other section, click AI assistant for Observability settings.

3. Then select the Elastic AI Assistant for Observability.

4. Switch to the Knowledge base tab.

5. Click the New entry button, and choose either:

   • Single entry: Write content for a single entry in the UI.

   • Bulk import: Upload a newline delimited JSON (ndjson) file containing a list of entries to add to the knowledge base. Each object should conform to the following format:

     {
       "id": "a_unique_human_readable_id",
       "text": "Contents of item",
     }

Use the Elasticsearch Index API

1. Ingest external data (GitHub issues, Markdown files, Jira tickets, text files, etc.) into Elasticsearch using the Elasticsearch Index API.
2. Reindex your data into the AI Assistant's knowledge base index by completing the following query in Developer Tools → Console. Update the following fields before reindexing:
   • InternalDocsIndex: Name of the index where your internal documents are stored.
   • text_field: Name of the field containing your internal documents' text.
   • timestamp: Name of the timestamp field in your internal documents.
   • public: If true, the document is available to all users with access to your Observability project. If false, the document is restricted to the user indicated in the following user.name field.
   • user.name (optional): If defined, restricts the internal document's availability to a specific user.
   • You can add a query filter to index specific documents.

POST _reindex
{
    "source": {
        "index": "<InternalDocsIndex>",
        "_source": [
            "<text_field>",
            "<timestamp>",
            "namespace",
            "is_correction",
            "public",
            "confidence"
        ]
    },
    "dest": {
        "index": ".kibana-observability-ai-assistant-kb-000001",
        "pipeline": ".kibana-observability-ai-assistant-kb-ingest-pipeline"
    },
    "script": {
        "inline": "ctx._source.text = ctx._source.remove(\"<text_field>\");ctx._source.namespace=\"<space>\";ctx._source.is_correction=false;ctx._source.public=<public>;ctx._source.confidence=\"high\";ctx._source['@timestamp'] = ctx._source.remove(\"<timestamp>\");ctx._source['user.name'] = \"<user.name>\""
    }
}

Interact with the AI Assistant

You can chat with the AI Assistant or interact with contextual insights located throughout Observability. See the following sections for more on interacting with the AI Assistant.

AI Assistant chat

Click AI Assistant in the upper-right corner where available to start the chat:

— Click to open this image in fullscreen mode

This opens the AI Assistant flyout, where you can ask the assistant questions about your instance:

— Click to open this image in fullscreen mode

AI Assistant functions

The AI Assistant uses several functions to include relevant context in the chat conversation through text, data, and visual components. Both you and the AI Assistant can suggest functions. You can also edit the AI Assistant's function suggestions and inspect function responses. For example, you could use the kibana function to call a Kibana API on your behalf.

You can suggest the following functions:

Additional functions are available when your cluster has APM data:

AI Assistant contextual prompts

AI Assistant contextual prompts throughout Observability provide the following information:

• Alerts: Provides possible causes and remediation suggestions for log rate changes.
• Application performance monitoring (APM): Explains APM errors and provides remediation suggestions.
• Logs: Explains log messages and generates search patterns to find similar issues.

For example, in the log details, you'll see prompts for What's this message? and How do I find similar log messages?:

— Click to open this image in fullscreen mode

Clicking a prompt generates a message specific to that log entry. You can continue a conversation from a contextual prompt by clicking Start chat to open the AI Assistant chat.

— Click to open this image in fullscreen mode

Known issues

Token limits

Most LLMs have a set number of tokens they can manage in single a conversation. When you reach the token limit, the LLM will throw an error, and Elastic will display a "Token limit reached" error. The exact number of tokens that the LLM can support depends on the LLM provider and model you're using.