Incident triage

Read server logs, classify the incident, and write a message only for the team that must act.

Full request body

{
  "system": "You are an SRE incident triage assistant. Base every field only on the log. Be specific: mention the exact host names, service names and numbers from the log. Never calculate, estimate or infer numbers that are not written in the log.",
  "context": "Server log:\n2026-09-27 02:14:03 ERROR [db-primary-01] postgres: could not extend file \"base/16384/2619\": No space left on device\n2026-09-27 02:14:03 ERROR [api-gateway] upstream orders-service returned 500 (x342 in 60s)\n2026-09-27 02:14:05 WARN  [db-primary-01] disk /var/lib/postgresql usage 100% (500G/500G)\n2026-09-27 02:14:10 ERROR [orders-service] psycopg2.OperationalError: could not write to file: No space left on device\n2026-09-27 02:15:00 CRIT  [monitor] checkout success rate dropped to 12% (baseline 99%)",
  "schema": {
    "severity": {
      "enum": [
        "low",
        "medium",
        "high",
        "critical"
      ],
      "instruction": "Incident severity from the log. critical = main service down / large impact on users; high = important feature disrupted; medium = limited degradation; low = warning with no impact on users.",
      "on": [
        {
          "when": {
            "in": [
              "low"
            ]
          },
          "do": "ticket_summary"
        }
      ]
    },
    "component": {
      "type": "string",
      "instruction": "Main host/component that is the source of the problem (not one that is merely affected)."
    },
    "affected_services": {
      "type": "list",
      "items": "string",
      "max_items": 5,
      "instruction": "Services/hosts AFFECTED according to the log, one per line (exact name as in the log)."
    },
    "http_codes": {
      "type": "list",
      "items": {
        "type": "number",
        "integer": true,
        "max_digits": 3
      },
      "max_items": 5,
      "instruction": "HTTP error status codes that appear in the log (e.g. 500, 502). Leave empty if none."
    },
    "risk": {
      "type": "string",
      "free_form": true,
      "depends_on": [
        "severity",
        "component",
        "affected_services",
        "http_codes"
      ],
      "instruction": "Technical and business risk if not handled immediately, in English, max 50 words."
    },
    "escalate_to": {
      "enum": [
        "infra",
        "dev",
        "security",
        "other"
      ],
      "depends_on": [
        "risk"
      ],
      "instruction": "Team that must handle the root cause. infra = server, disk, network, capacity, database host; dev = application code bug or deploy; security = attack / unauthorized access; other = none of these.",
      "on": [
        {
          "do": "switch",
          "cases": {
            "infra": "infra_message",
            "dev": "dev_message",
            "security": "security_message"
          },
          "default": "other_message"
        }
      ]
    },
    "infra_message": {
      "type": "string",
      "free_form": true,
      "instruction": "Escalation message for the INFRA team in English (max 80 words): the problematic host, symptoms from the log (quote metrics/numbers), impact, and 2-3 immediate mitigation steps (e.g. capacity, disk, restart, failover).",
      "depends_on": [
        "escalate_to"
      ]
    },
    "dev_message": {
      "type": "string",
      "free_form": true,
      "instruction": "Escalation message for the DEV team in English (max 80 words): the service and error/stack trace from the log, the likely cause in code or the last deploy, and immediate steps (rollback, hotfix, feature flag).",
      "depends_on": [
        "escalate_to"
      ]
    },
    "security_message": {
      "type": "string",
      "free_form": true,
      "instruction": "Escalation message for the SECURITY team in English (max 80 words): attack indicators from the log (IP, account, pattern), the systems at risk, and immediate containment steps (block, credential rotation, isolation).",
      "depends_on": [
        "escalate_to"
      ]
    },
    "other_message": {
      "type": "string",
      "free_form": true,
      "instruction": "General escalation message in English (max 80 words): a summary of the event from the log, the impact, and which team should be involved.",
      "depends_on": [
        "escalate_to"
      ]
    },
    "ticket_summary": {
      "type": "string",
      "free_form": true,
      "depends_on": [
        "infra_message",
        "dev_message",
        "security_message",
        "other_message"
      ],
      "instruction": "One-line incident ticket title: [SEVERITY] component - problem summary - responsible team (write 'not escalated' if there is no escalation message)."
    }
  },
  "max_new_tokens": 250
}

What it shows

• Lists of strings (affected_services) and numbers (http_codes).
• switch: escalate_to picks one of infra_message, dev_message, security_message, other_message; only that message is written, the others are null.
• Forward jump: severity low jumps straight to ticket_summary, skipping escalation.
• Stages: risk → escalate_to → one message → ticket_summary.

The sample log (disk full on the primary database) should give severity critical and a message to the infrastructure team. Try the other logs in the preset description to see the dev and security branches.

Playground preset: 19.