Observability Analysis¶

Toby AI TruePilot can combine the current page context and the workspace data accessible to the current user to summarize observable objects, analyze anomalies, and locate root causes. This page also includes automated AI aggregation capabilities triggered by alert strategies. Different capabilities correspond to different data entry points and result formats. Before using, you should first navigate to the page or business process that needs analysis.

Page Analysis & Root Cause Location¶

When you are viewing an anomalous data record and want to quickly understand the phenomenon, determine possible causes, or decide on the next investigation steps, you can directly open Toby AI TruePilot on the current page.

This capability currently covers the following types of detail pages:

• Alert events, error center, and incidents;
• Logs and trace details;
• Dashboards;
• RUM sessions, views, resources, actions, long tasks, and errors;
• Security signals;
• Database Query details, where SQL optimization rules refer to Database Query Optimization.

The actual supported scope depends on whether the current page provides the analysis context to Toby AI TruePilot.

Analyze the Current Page¶

1. Open the detail page you want to analyze and adjust the page time range to the interval of interest.
2. Open Toby AI TruePilot, click the quick analysis prompt provided on the page, or directly describe the analysis goal.
3. If there is a specific focus, supplement the impact scope, related services, anomaly period, or expected output you need to determine.

The following pages may display corresponding quick analysis prompts:

After you start typing other content, send a message, switch objects, or close the panel, the quick prompt disappears. The same object is only prompted once per panel session; after the prompt disappears, you can still directly input the same goal.

Analysis Results¶

Toby AI TruePilot will first read the current object, then query relevant evidence within the same time range as needed. For confirmed anomalies, the results typically include:

1. The current object and the anomalous phenomenon;
2. The most likely root cause or risk direction and its confidence level;
3. Log, metric, trace, or event evidence supporting the conclusion;
4. Known impact scope;
5. Executable verification and handling recommendations.

If the current object has no clear anomaly, Toby AI TruePilot will provide a summary and risk description, and will not assume a fault for the sake of root cause analysis. When evidence is insufficient, the results will indicate unconfirmed parts and data that needs to be supplemented.

List & Asset Analysis¶

When a single data record is insufficient to describe the overall situation, or when you need to identify anomaly distribution, Top objects, and common characteristics from the current list, you can let Toby AI TruePilot analyze the current list.

This capability is available for supported list pages, including dashboards, logs, traces, RUM, alert events, security signals, error center, and incidents. The specific fields and objects that can be analyzed are determined by the filter conditions and data range provided by the current page.

Analyze the Current List¶

1. On the list page, set the time range and filter conditions so that the list stays within the business scope that needs analysis.
2. Open Toby AI TruePilot, describe the conclusions you want, such as "summarize the anomaly distribution of the current list," "find the service with the most errors," or "analyze common characteristics of recent events."
3. For comparison or sorting, specify the grouping dimension, metrics of interest, or Top N count.

Toby AI TruePilot will follow the query boundaries of the current page, prioritizing aggregation or sampling a small number of records rather than reading all details without boundaries.

Analysis Results¶

The results typically include an overview of the current scope, key counts, Top distribution, representative samples, risk descriptions, and next-step recommendations. When the list lacks sufficient fields, the query fails, or the result is empty, Toby AI TruePilot will retain the current facts and indicate evidence gaps.

List analysis does not change the current filter conditions, nor does it perform batch operations on list objects.

Database Query Optimization¶

When you find that a query takes too long, scans too many rows, or performs abnormally on the database Query detail page, you can use this capability to analyze the SQL and execution plan.

Perform Optimization Analysis¶

1. Open the target database Query detail page.
2. Open Toby AI TruePilot, enter "analyze the current SQL," "why is this query slow," or "provide optimization suggestions based on the execution plan."
3. If there is a specific goal, such as reducing scanned rows, improving index usage, or reducing sorting overhead, include it in the question.

Analysis Results¶

Toby AI TruePilot will analyze based on the data available in the current Query details. The results can include:

• Database type, query duration, number of calls, scanned rows, returned rows, and other available statistics;
• Original SQL;
• The returned execution plan and key fields;
• Suggestions for query rewriting, indexing, filter conditions, or execution methods.

If the current details do not return an execution plan, Toby AI TruePilot will display the existing SQL and explain the missing evidence, without fabricating execution nodes or costs. This capability only provides analysis and suggestions; it does not automatically execute the rewritten SQL or modify database objects.

Alert Aggregation & Compression¶

When a large number of duplicate or related alerts are generated in the same time period, making it difficult to judge the main problem by reading them one by one, you can enable AI Aggregation in the alert strategy. The system will classify, deduplicate, and summarize the alerts within the set aggregation period, then send an aggregated notification according to the alert strategy. This capability is automatically executed by the alert strategy and does not require opening Toby AI TruePilot or initiating a conversation.

This capability will focus on identifying:

• Alerts triggered repeatedly by the same monitor;
• Related alerts generated by the same host, application, service, or dependency;
• Common categories such as cloud platforms, infrastructure, Kubernetes, middleware, databases, logs, traces, and delivery pipelines;
• High-frequency objects and anomalies that require priority attention.

Aggregation Results¶

The system will generate a structured result based on the aggregation time range and the input alert set, including:

• The number of monitors that triggered alerts during the aggregation period and the total number of alert notifications;
• Monitors, representative titles, and classification summaries organized by anomaly type;
• High-frequency hosts, applications, or services with related descriptions;
• Recommendations for duplicate alerts, related anomalies, and priority investigation objects.

Recovered events can be used to indicate that the problem has been resolved, but they will not be counted in the anomaly alert count nor serve as the primary basis for root cause recommendations. The aggregation result is based solely on the alert content received in this batch and cannot replace further verification of original metrics, logs, and traces.

Incident Preliminary Analysis¶

In the scenario of generating an incident in the Incident Center, you can use Toby AI TruePilot to generate a structured initial comment based on the event details already passed in, helping the handler quickly understand the problem background and start investigation.

Preliminary Analysis Results¶

When this capability is enabled in the current workflow, Toby AI TruePilot will extract available information from the event details and organize the following content based on actual data:

• Event title, status or severity, and first occurrence time;
• Detection time range, affected objects, and key metric snapshots;
• Possible causes prioritized by urgency;
• Recommendations for urgent investigation, change rollback, and process escalation.

The preliminary analysis only uses the event details passed in the current incident flow. If time, severity, impact scope, or metrics are missing, the corresponding sections will be omitted, and uncertainties will be clearly stated without fabricating data.