LogCopilot uses LLMs to automate log analysis with 76.8% accuracy

Log analysis is essential for debugging, testing, and fault diagnosis in modern software systems, but as systems grow in scale and complexity, writing queries for log aggregation platforms like Grafana Loki or ELK becomes a tedious and error-prone task. Engineers must master both the DSL syntax (e.g., LogQL) and deep log details, which slows down incident response. To address this, a team of researchers from multiple institutions developed LogCopilot, a framework that uses large language models (LLMs) to automatically translate natural language analysis instructions into executable LogQL queries.

LogCopilot's architecture consists of a hierarchical knowledge base that organizes log metadata, field names, and common query patterns, allowing the LLM to retrieve exactly what it needs during query generation. The system then generates LogQL queries via tool calling and executes them against log aggregation services. Evaluated on four real-world log datasets, LogCopilot achieved an average accuracy of 76.8% in generating correct queries, significantly outperforming baseline approaches. This work demonstrates a practical path to reducing the cognitive load on engineers and accelerating log-based diagnostics in production environments.