How the AI works
Reading telemetry is a language problem
Logs are prose written by hundreds of engineers in a dozen formats. Reasoning about cause across them is the kind of work only modern language models can do well, which is why the model is the engine of Ketl, not a feature on the side.
From raw signal to a proposed fix
Ingest the telemetry
When an alert fires, Ketl pulls the relevant window from every connected source: logs, traces, recent deploys and past incidents. It normalizes formats just enough to read them together, and never assumes structure that is not there.
Model reasoning
A language model reads the window the way a senior on-call would. It forms hypotheses, looks for the signal that connects a deploy to a latency change to an error, and drafts candidate causes. This step is the product; there is no rules engine pretending underneath.
Root-cause ranking
Candidate causes are scored by how strongly the provided telemetry supports them, and ordered most likely first with an honest confidence on each. Thin evidence lowers confidence rather than inventing certainty.
Proposed fix
The leading cause is turned into one concrete next action: a fix, a rollback, or a mitigation, with the exact command, the blast radius, and how to verify it worked. Ketl proposes; a human runs it.
Each step goes to the right model
A diagnosis is several steps, and they do not all need the same horsepower. Ketl keeps a registry of frontier and open models and routes each step to the one that clears the bar for the least cost. Betting a pager on a single lab is a reliability risk of its own.
Classify severity, group duplicate alerts, and decide whether this needs a full diagnosis. Cheap and fast.
Read logs, traces, recent deploys and past incidents together and reason about the likely cause. The heaviest step, sent to a frontier model.
Order candidate causes by how well the evidence supports them and attach a confidence to each.
Turn the leading cause into a concrete fix or rollback, with the exact steps and a stated risk.
deep cause reasoning · long log windows · cross-signal
ranking · structured extraction · fast diagnosis
triage · severity classification · deduplication
careful reasoning · refusal on thin evidence
self-host · data residency · cost floor
Reasoning, kept honest
Grounded in your evidence
Every cause Ketl proposes is tied to lines quoted verbatim from the telemetry you gave it. The model does the reasoning; the evidence keeps it honest and keeps you in control. A wrong read is quick to spot because you can check the quote.
Your data answers your incidents only
Telemetry is used to diagnose your incidents and is never used to train a shared model. Connections are read-only by default, with retention controls and deletion on request. On Scale, route to open models you host so nothing leaves your perimeter. Read the Security page.
A note on this deployment: the OpenAI provider is wired live and the router sends steps to OpenAI-hosted models. The other providers in the registry share the same interface and switch on once a key for them is present. The routing table above is the real table the engine uses.
See the reasoning on your own alert
Start free, no card, and run a real diagnosis on your next page. Or connect your stack and watch Ketl fire the moment an alert does.