People sometimes ask why this could not have been built five years ago with rules and regexes. The honest answer is that we tried versions of that for years as an industry, and they broke on contact with real telemetry. Logs are prose. They are written by hundreds of engineers, in a dozen formats, with the context left implicit because the author assumed a human would read it.
Cause lives in the seam
The hardest part of a diagnosis is not any single line. It is the relationship between a deploy at 14:02, a query that got slower at 14:04, a pool that saturated at 14:05, and a past incident that failed the same way in November. Cause lives in the seam between signals, which is exactly where a single dashboard cannot look and a rules engine falls apart.
Reading across those signals and reasoning about what connects them is language work. It is the thing recent models are genuinely good at, and it is why the model is the engine here rather than a garnish on a dashboard.
Reasoning, kept honest by evidence
A model reasoning freely about your outage is not something you want to trust blindly, and we do not ask you to. Every cause Ketl proposes is tied to lines quoted verbatim from your telemetry. The model does the reasoning; the evidence keeps it honest and keeps you in control.
cause N+1 query introduced by v2.48.0 confidence 88
because deploys: PR #4821 'per-item line lookup'
logs: same SELECT repeating at ~1.2s
incident: pool saturation, Nov, same shapeThe model reasons. The evidence is what makes it trustworthy at 3am.
Why this is AI-native, not AI-flavored
There is no rules engine underneath Ketl pretending to be clever. Take the models away and there is no product, because the core action, reading raw telemetry and naming a cause, is the model. That is what we mean when we say Ketl is built AI-native. It is not a claim on a landing page. It is the architecture.