AI log analysis only works when the agent has context

Something breaks in production. The first thing you do is open the logs. The second thing you do is start scrolling.

Thomas di Luccio, product manager at Upsun, has a picture for this. "Logs are like that box of cables we all have at home, with too many cables you keep just in case. You need one, and you don't know which one or how you'll get it out."

That is the problem Upsun Cloud™ is taking on with two features that ship together. Log Explorer is a Logs tab in Console that gathers every log line from every container in an environment. The Log Analyzer Agent reads those same logs and reports back what went wrong, why, and what to change. This article covers what each one does, and why the quality of AI log analysis depends on where the agent runs.

AI log analysis without context is guesswork

Developers already know a language model can read a log. Thomas sees it in customer conversations: "More recently, some are clearly taking a log file and throwing it at their favorite AI." It helps. It also has a ceiling.

"The issue is that the agent doing this is only analyzing the file, without the context," Thomas says. "We run the agent within the application itself, so it has all the context: the configuration, the history, the past deployments. Context is key to making a good decision."

A pasted log file tells the model what one container printed. It does not tell the model how the environment is wired, which services talk to each other, or what deployed an hour ago. The Log Analyzer Agent runs as a task container inside your own project. It reads the same logs you see in Log Explorer, across every log kind, and it works from a shallow clone of the environment's branch, so it can tie an error line back to the code and the configuration that produced it. It knows what .upsun/config.yaml means. A chatbot with a text box does not.

The difference shows in the answer. The agent's report names a likely root cause and the change to make, with a quoted log line as evidence. Thomas's version: "Very quickly, you can go from 'you have an issue' to 'you have insight on what to fix first.'"

Every log in one tab, before anything gets analyzed

The agent is the headline, but it stands on Log Explorer, and Log Explorer is useful on its own.

Open any environment in Console and there is now a Logs tab. It shows the last 24 hours of logs from every app and service in that environment, each line tagged by kind: application, access, cron, deployment, or platform. A chart at the top shows volume over time, stacked by severity, so a spike in errors is visible before you read a single line. Filter by kind, severity, service, or unit. Click a line to expand it and see the structured payload. Click an attribute inside that line to filter on it. The filters and time range live in the URL, so a link reproduces the exact view for a teammate.

You install nothing and configure nothing, and you never open an SSH session. Upsun collects the logs automatically. Before this, the route to the same information was upsun log per container, or SSH into each one and read raw files.

What changes most is the ability to look across containers. Thomas describes the typical case: your application is throwing errors, but the cause lives somewhere else. "You can know that every time you have those 500s in this application, it's linked to some deadlocks on your databases. Then you can connect the dots and move from exploring the logs of the application to the logs of the services."

From a filtered view to a diagnosis in one click

Once the Log Analyzer Agent is set up, the Logs tab gains a button: Analyze N logs, where N follows whatever filters you have applied. Click it, confirm the window and filters, and the agent runs. A few minutes later a report lands in the task's activity log: a one-sentence read on the environment's log health, a top recommendation, and a list of findings ordered by priority. Each finding has a title, a priority the agent assigned by urgency rather than by raw log severity, a representative log line as evidence, and a concrete next step. If the agent scanned the window and found nothing worth flagging, it says so, and the recommendation reads "No action needed."

The agent starts from your filters but is not confined to them. If your filters would hide the root cause, it widens the search.

Setup takes two things. Add the log-analyzer-agent task to .upsun/config.yaml and deploy. Then store an ANTHROPIC_API_KEY, or an OPENAI_API_KEY with the MODEL task variable set to openai, as a sensitive project variable. That key is the only credential involved. Upsun does not charge for the agent itself. You pay for the task container's compute per second, and your provider bills the tokens to your own account. A budget cap, $5 by default, applies to every run.

Two things the agent will not do. It will not change anything: it is read-only, it recommends, and it never edits configuration, code, or environments. And it will not send your logs or your source anywhere you did not choose. Both go to the provider behind the key you set, under your own agreement with that provider.

Built for the moment you have no headspace

"We discussed this with a lot of users while building it, and even the more experienced users tell us the same struggle," Thomas says. "Even if you do know how to read all that, when there's a fire you don't really have the headspace or the bandwidth to take the time and make sure you have the right thing."

That is the argument for a report that names the most likely cause first. Experienced engineers can read the stack trace. What they need is the search narrowed while they are being paged. Junior engineers, and agencies running dozens of client projects on different stacks, get a prioritized starting point that would otherwise need a senior engineer's time.

One less system to run

Ask teams how they handled logs before, and Thomas hears three answers. Most read them manually, one file at a time. Some built their own pipeline, forwarding everything to a separate logging service, which works, costs money, and needs maintaining. Others paste into a chatbot.

Log Explorer and the Log Analyzer Agent sit on a log pipeline that Upsun runs as part of the platform's built-in observability. Existing log forwarding to Datadog, Splunk, or anything else keeps working unchanged. Log Explorer retains the last 24 hours of logs.

His summary of why Upsun builds this kind of feature at all: "We are here to take care of the software development life cycle and make it super easy, so people can focus on what they do best: building their own products. They shouldn't have to maintain everything happening backstage."

Where you can use it today

Both features are available on Upsun Cloud projects in AWS and Google Cloud regions. Azure and OVHcloud projects are not supported, and HIPAA projects are excluded. The Logs tab is visible to users with the Contributor role or above, which usually matches who can already SSH in and read log files.

Log Explorer needs no setup. Adding the agent is a config change and an API key. The docs for Log Explorer and the Log Analyzer Agent cover the details, including the task variables you can set from the CLI to pick a model, choose a window, or change the budget cap.