Integrations
Connects to the tools you use
Set up connections through ERP.AI and Proto workflows, with every change logged.
- Log Management & Analysis
- Observability source
- Processing events
- User accounts
Log Management & Analysis · Available now
Example screen with sample data
Trace log alerts to the service response.
Log Management & Analysis organizes log streams by service, records source endpoints and retention periods, and captures query-based alerts for defined time windows. Log operators register streams and review alert match counts.
- No per-user fees
- Manual work is free
- Configure it in Proto
OverviewOpen log alerts×
Log Management & Analysis · Log alerts
New log alert
Open log alerts
acknowledged waits for the log operator
Log alerts in view
6Total match count
86Open
3Acknowledged
3| Query definition | Stream | Window start | Window end | Match count | Status | |
|---|---|---|---|---|---|---|
| error_rate > 5% for 10m | Returns storage alerts | 31 Oct | 06 Nov | 11 | Open | |
| p95_latency_ms > 1200 for 5m | Sign-in audit stream | 03 Nov | 12 Nov | 13 | Acknowledged | |
| queue_depth > 5000 for 15m | Dock scanner telemetry | 02 Nov | 04 Nov | 13 | Open | |
| failed_logins > 100 for 5m | Inventory queue events | 12 Oct | 21 Oct | 9 | Acknowledged | |
| disk_used_pct > 85 for 10m | Checkout application logs | 03 Nov | 05 Nov | 21 | Open |
6 of 6 records
error_rate > 5% for 10mLog alerts · LA-42413
OpenStreamReturns storage alerts
Window start31 Oct
Window end06 Nov
Match count11
Approve changeLA-42413 · error_rate > 5% for 10m
The Change Approver decides whether the reviewed risk, schedule and rollback plan permit implementation.
Waiting for Change Approver
ApproveReturn
- Tables, ready to use
- 12
- Saved views
- 13
- Roles with set permissions
- 7
- Reports and dashboards
- 8
Features
From source signal to service work
Every feature works on the same records. Pick one to see the screen your team works in.
Services and log streams
Keep each log source attached to the service it supports.
- Service context
- Source registration
- Response path
- Services
- Log streams
- Log alerts
- Integration receipts
OverviewRegistered streams×
Log Management & Analysis · Services and log streams
New
Registered streams
Log streams
| Stream name | Service | Source endpoint | Retention days | |
|---|---|---|---|---|
| Checkout application logs | Shipment event gateway | /var/log/checkout/app.log | 20 | |
| Sign-in audit stream | Notification dispatcher | auth-db.audit.events | 9 | |
| Shipment event ingestion | Inventory sync service | carrier-gateway/events | 13 | |
| Inventory queue events | Customer sign-in | inventory-queue/consumer | 1 | |
| Billing worker errors | Order checkout API | billing-worker/stderr | 26 |
6 of 6 records
Checkout application logsLog streams · LS-51700
ServiceShipment event gateway
Source endpoint/var/log/checkout/app.log
Retention days20
Log alerts
Capture query matches and move alerts through triage.
- Query evidence
- Triage state
- Service context
- Log alerts
- Log streams
- Services
- Incidents
OverviewMy incidents×
Log Management & Analysis · Log alerts
New
My incidents
Incidents
| Summary | Priority | Service | Opened at | Status | |
|---|---|---|---|---|---|
| Checkout errors increased after release | Low | Returns processing | 12 Oct | Open | |
| Sign-in requests slowed in east region | Medium | Customer sign-in | 26 Oct | Acknowledged | |
| Carrier events delayed by queue backlog | High | Shipment event gateway | 20 Oct | Investigating | |
| Inventory sync paused during maintenance | Critical | Returns processing | 18 Oct | Resolved | |
| Billing retries duplicated overnight | Low | Order checkout API | 27 Oct | Closed |
6 of 6 records
Checkout errors increased after releaseIncidents · INC-88952
LowServiceReturns processing
Opened at12 Oct
StatusOpen
Incidents and updates
Assign an incident and retain the response timeline.
- Ownership
- Response timing
- Investigation history
- Incidents
- Incident updates
- Services
- Assets
- People
OverviewIncident update history×
Log Management & Analysis · Incidents and updates
New
Incident update history
Incident updates
| Name | Incident | Occurred at | Author | Update text | |
|---|---|---|---|---|---|
| Checkout traffic rerouted | Inventory updates stalled | 13 Oct | Nia Okafor | Error rate fell below alert threshold | |
| Replica catch-up confirmed | Shipment events delayed | 03 Nov | Amir Haddad | Replica lag returned to normal | |
| Carrier feed restarted | Billing retry surge | 13 Oct | Priya Menon | Carrier events caught up through noon | |
| Queue backlog draining | Returns disk near capacity | 27 Oct | Dev Patel | Queue depth dropped below 500 | |
| Duplicate retries paused | Billing retry surge | 30 Oct | Amir Haddad | Billing retries stopped duplicating |
6 of 6 records
Checkout traffic reroutedIncident updates · IU-53611
IncidentInventory updates stalled
Occurred at13 Oct
AuthorNia Okafor
Update textError rate fell below alert threshold
Changes
Review service changes before implementation and verification.
- Preparation
- Decision
- Outcome
- Changes
- Services
- Incidents
- Problems
OverviewChanges awaiting review×
Log Management & Analysis · Changes
New
Changes awaiting review
Approval waits for the change approver
| Summary | Service | Risk | Scheduled start | Scheduled end | Rollback plan | |
|---|---|---|---|---|---|---|
| Checkout errors increased after release | Inventory sync service | Low | 31 Oct | 08 Nov | Restore prior checkout image | |
| Sign-in requests slowed in east region | Warehouse scan service | Medium | 13 Oct | 22 Oct | Revert replica pool setting | |
| Carrier events delayed by queue backlog | Notification dispatcher | High | 31 Oct | 03 Nov | Route feed to previous consumer | |
| Inventory sync paused during maintenance | Shipment event gateway | Low | 15 Oct | 24 Oct | Restore prior queue worker count | |
| Billing retries duplicated overnight | Notification dispatcher | Medium | 20 Oct | 27 Oct | Disable new retry policy |
6 of 6 records
Checkout errors increased after releaseChanges · CHN-42252
LowServiceInventory sync service
Scheduled start31 Oct
Scheduled end08 Nov
Rollback planRestore prior checkout image
StatusReview
Problems and assets
Keep root cause work and affected equipment in service context.
- Service issue
- Affected item
- Response connection
- Problems
- Assets
- Incidents
- Services
- People
OverviewOpen problems×
Log Management & Analysis · Problems and assets
New
Open problems
Problems
Open2
Repeated checkout timeoutsCheckout errors recur during peak traffic
26 Oct
Inventory queue buildupInventory queue grows during nightly sync
16 Oct
Add
Investigating2
Sign-in replica lagReplica falls behind after batch imports
31 Oct
Duplicate billing retriesBilling retries create duplicate attempts
19 Oct
Add
Known error2
Delayed shipment eventsCarrier feed stalls on malformed events
04 Nov
Scanner relay disconnectsScanner relay loses connection at shift start
18 Oct
Add
Requests and receipts
Track service requests and review inbound event outcomes.
- Request decision
- Fulfillment timing
- Event outcome
- Service requests
- Integration receipts
- Services
- People
OverviewSubmitted requests×
Log Management & Analysis · Requests and receipts
New
Submitted requests
Approval waits for the request approver
| Request type | Requester | Service | Requested at | Due at | Status | |
|---|---|---|---|---|---|---|
| Log access request | Tomas Ibarra | Notification dispatcher | 30 Oct | 06 Nov | Submitted | |
| Retention change | Hana Kwon | Order checkout API | 29 Oct | 03 Nov | Submitted | |
| New alert setup | Jules Okoro | Order checkout API | 13 Oct | 17 Oct | Submitted | |
| Incident export | Amir Haddad | Shipment event gateway | 15 Oct | 23 Oct | Submitted | |
| Stream onboarding | Amir Haddad | Shipment event gateway | 12 Oct | 19 Oct | Submitted |
6 of 6 records
Log access requestService requests · SR-58119
SubmittedRequesterTomas Ibarra
ServiceNotification dispatcher
Requested at30 Oct
Due at06 Nov
Process
Follow an alert through response
Log alert to verified response ships ready to use. One step needs a named approval before the work moves on: Approve change (Change Approver).
Drag a card to another stage, or focus it and use the arrow keys. It updates to match the stage.
-
Register stream
Attach a source endpoint and retention setting to its service.
error_rate > 5% for 10mLA-42413 · Log OperatorRegister streamBy Log Operator -
Capture alert
Record the query, time window and match count against the stream.
error_rate > 5% for 10mLA-42413 · Log OperatorCapture alertBy Log Operator -
Acknowledge alert
Take responsibility for triage and mark the alert acknowledged.
error_rate > 5% for 10mLA-42413 · Log OperatorAcknowledge alertBy Log Operator -
Investigate incident
Assign the service response and keep timed updates with the incident.
error_rate > 5% for 10mLA-42413 · Incident ResponderInvestigate incidentBy Incident Responder -
Approve change
Have the Change Approver review risk, window and rollback plan.
error_rate > 5% for 10mLA-42413 · Change ApproverApprove changeBy Change ApproverApprovalThe Change Approver decides whether the reviewed risk, schedule and rollback plan permit implementation. -
Verify change
Record the result after implementation or rollback.
error_rate > 5% for 10mLA-42413Verify change
Inside a record
Connect the tools that produce events
Open any log alert to see the roles that work on it, its process stages and its approvals on one page.
- 1Record details
Stream, Window start, Window end and Match count.
- 2Linked records
Records linked to this log alert.
- 3Who works on it
Admin, Service Owner and Log Operator, each with their own permissions.
- 4Process stages
Every status change, in order.
- 5Approvals
Approve change, with who decides.
Open log alertserror_rate > 5% for 10m×
Log Management & Analysis · Log alerts
Log activity
error_rate > 5% for 10m
Returns storage alerts · Open
1
Record details
StreamReturns storage alerts
Window start31 Oct
Window end06 Nov
Match count11
3
Who works on it
- AdminManage Users, People, Services
- Service OwnerManage Services, Problems
- Log OperatorManage log streams, log alerts
5
Approvals
- Approve changeChange ApproverApproved
Approvals
Decisions before service changes
A Change Approver reviews risk and rollback before implementation; a Request Approver decides whether submitted work may proceed.
OverviewApprovals×
Log Management & Analysis · Overview
Approvals
Signed in as Change Approver
Waiting for you
4 To review1 Overdue2 Decided todayOnly mine
0 selectedApproveReturn
- SR-58119Log access requestSubmitted3dActions
- SR-28540Retention changeSubmitted1dActions
- SR-70923New alert setupSubmitted4dActions
- SR-82351Incident exportSubmitted5dActions
Who approves what
| Decision | Approver | |
|---|---|---|
| Approve changeHave the Change Approver review risk, window and rollback plan. | Change Approver | |
| Approve Changes | Change Approver | |
| Approve service requests | Request Approver |
3 approval rules · set per role in Proto
Roles
A workspace for each role
Everyone opens Log Management & Analysis to the work that is theirs. Pick a role to see what it starts with.
Admin
Configures identities, service ownership and access for the operating team.
- Manage Users, People, Services
- View log streams, log alerts, Incidents, Changes, Problems, service requests, integration receipts
Service Owner
Owns service context and reviews incidents, alerts and problems affecting that service.
This is the first screen this role sees.
OverviewChange schedule×
Change schedule
Changes · Service Owner
| Summary | Service | Scheduled start | Scheduled end | Risk | Status | |
|---|---|---|---|---|---|---|
| Checkout errors increased after release | Notification dispatcher | 31 Oct | 02 Nov | Low | Approved | |
| Sign-in requests slowed in east region | Notification dispatcher | 11 Oct | 19 Oct | Medium | Implementing | |
| Carrier events delayed by queue backlog | Billing ledger API | 03 Nov | 09 Nov | High | Approved | |
| Inventory sync paused during maintenance | Order checkout API | 31 Oct | 04 Nov | Low | Implementing | |
| Billing retries duplicated overnight | Warehouse scan service | 31 Oct | 07 Nov | Medium | Approved |
6 of 6 records
Log Operator
Registers streams, reviews alerts and examines inbound processing outcomes.
This is the first screen this role sees.
OverviewProcessing receipts×
Processing receipts
Integration receipts · Log Operator
Received2
North Quay Monitoringevt_20261015_1842
19 Oct
Blue Harbor Telemetryevt_20261015_1941
14 Oct
Add
Applied2
Pinewatch Cloudevt_20261015_1876
09 Oct
Stonepath Alertsevt_20261015_1998
21 Oct
Add
Failed1
Cedarline Eventsevt_20261015_1903
17 Oct
Add
Rejected1
Willowgate Integrationsevt_20261015_2045
13 Oct
Add
Incident Responder
Acknowledges assigned incidents and records investigation updates.
This is the first screen this role sees.
OverviewIncident queue×
Incident queue
Incidents · Incident Responder
Low2
Checkout errors increased after releaseOrder checkout API
11 Oct
Billing retries duplicated overnightBilling ledger API
30 Oct
Add
Medium2
Sign-in requests slowed in east regionReturns processing
19 Oct
Dock scans resumed after relay restartNotification dispatcher
14 Oct
Add
High1
Carrier events delayed by queue backlogCustomer sign-in
21 Oct
Add
Critical1
Inventory sync paused during maintenanceCustomer sign-in
11 Oct
Add
Change Approver
Reviews the risk, window and rollback plan before authorizing a change.
This is the first screen this role sees.
OverviewChange schedule×
Change schedule
Changes · Change Approver
| Summary | Service | Scheduled start | Scheduled end | Risk | Status | |
|---|---|---|---|---|---|---|
| Checkout errors increased after release | Notification dispatcher | 31 Oct | 02 Nov | Low | Approved | |
| Sign-in requests slowed in east region | Notification dispatcher | 11 Oct | 19 Oct | Medium | Implementing | |
| Carrier events delayed by queue backlog | Billing ledger API | 03 Nov | 09 Nov | High | Approved | |
| Inventory sync paused during maintenance | Order checkout API | 31 Oct | 04 Nov | Low | Implementing | |
| Billing retries duplicated overnight | Warehouse scan service | 31 Oct | 07 Nov | Medium | Approved |
6 of 6 records
Request Approver
Decides whether a submitted service request may proceed.
This is the first screen this role sees.
OverviewSubmitted requests×
Submitted requests
Service requests · Request Approver
| Request type | Requester | Service | Requested at | Due at | Status | |
|---|---|---|---|---|---|---|
| Log access request | Tomas Ibarra | Notification dispatcher | 30 Oct | 06 Nov | Submitted | |
| Retention change | Hana Kwon | Order checkout API | 29 Oct | 03 Nov | Submitted | |
| New alert setup | Jules Okoro | Order checkout API | 13 Oct | 17 Oct | Submitted | |
| Incident export | Amir Haddad | Shipment event gateway | 15 Oct | 23 Oct | Submitted | |
| Stream onboarding | Amir Haddad | Shipment event gateway | 12 Oct | 19 Oct | Submitted |
6 of 6 records
Request Fulfiller
Carries approved service requests through execution and completion.
This is the first screen this role sees.
OverviewRequest fulfillment×
Request fulfillment
Service requests · Request Fulfiller
Approved3
Log access requestReturns processing
22 Oct
New alert setupReturns processing
11 Oct
Stream onboardingWarehouse scan service
01 Nov
Add
In progress3
Retention changeNotification dispatcher
23 Oct
Incident exportBilling ledger API
19 Oct
Query permission reviewNotification dispatcher
11 Oct
Add
Reports
Review signals and response timing
Review alert volume, response timing and processing outcomes.
Overview×
Log Management & Analysis · Overview
Log Management & Analysis dashboard
This quarter
Changes in view
6Low
2Medium
2High
2Log alerts by status
How far records got this quarter
| Stage | Reached | Step | |
|---|---|---|---|
| Open | 24 | ||
| Acknowledged | 11 | 46% | |
| Closed | 4 | 36% |
Match count by status
Sample totals per stage
- 01Alerts by stream and status
Which streams have open, acknowledged and closed alerts in each recorded window?
- 02Alert match volume
Which query definitions have the largest recorded match counts?
- 03Incident response intervals
How long elapsed between opening, acknowledgment and resolution for each incident?
- 04Incidents by service and priority
Which services have the most high-priority incident records?
- 05Problem status by service
Which services have open, investigating or known-error problems?
- 06Change review and outcome
Which changes are currently in review, implementation, verification, rollback or rejection?
- 07Request turnaround
How long elapsed from request submission to completion by service?
- 08Receipt processing outcomes
Which providers and external event IDs ended as applied, rejected or failed?
Who it's for
Fit the way your operations team works
See how Log Management & Analysis fits your kind of team.
Controls
Keep query and outcome evidence together
Each stage of log alert to verified response names the role that acts and the status it records, so a change is never anonymous.
OverviewLog alert to verified response×
Log Management & Analysis · Process
Log alert to verified response
Each stage, the role that acts and the status it records
Process stages
12Approval steps
1Roles involved
6Tables touched
5Acknowledge alert
Log OperatorStatusOpen → Acknowledged
Acknowledge incident
Incident ResponderStatusOpen → Acknowledged
RecordsIncidents
Investigate incident
Incident ResponderStatusAcknowledged → Investigating
RecordsIncidents
- StartLog OperatorAcknowledge alertOpen → Acknowledged
- StepIncidentsAcknowledge incidentOpen → Acknowledged
- StepIncidentsInvestigate incidentAcknowledged → Investigating
- StepServicesSubmit changeDraft → Review
- ApprovalChangesApprove changeReview → Approved
AI agent
Prepare the next decision with Proto
Use an assistant to prepare service records and review work.
It can
- Log Operator: Find active alerts for a stream and summarize their query windows and match counts.
- Incident Responder: Gather an assigned incident's service, asset and authored updates before a handoff.
- Service Owner: Compare open problems and changes for the same service before reviewing risk.
- Change Approver: Prepare the change's risk, window and rollback plan for a decision.
Stays with a person
- An assistant can organize records for review.
- The Change Approver makes the approval decision, and the Request Approver decides on a submitted request.
- The team verifies actual source behavior in its observability system and enters the outcome of service work.
- Access follows the roles configured for the person using the assistant.
Show open log alerts for the checkout stream with their observed windows.
Summarize the assigned incident and its latest authored updates.
Prepare the change under review with risk, schedule and rollback plan.
An assistant can organize records for review.
Data model
Your data, in tables you can change
Every record lives in a table you can see, extend and export. Add fields or whole tables in Proto.
Browse all 12 tables12tables
- Services and log streams4
- Log alerts4
- Incidents and updates5
- Changes4
- Problems and assets5
- Requests and receipts4
Implementation
Roll out one team at a time
Start with one team and one process, then add the rest once the basics are running.
Name service owners
Record the services, people and users who will run the pilot.
Register the source
Enter a representative stream, source endpoint and retention days for a service.
Rehearse triage
Capture a query alert with a defined window and move it through acknowledgment.
Rehearse response
Open an assigned incident, add an update and record acknowledgment and resolution times.
Review decisions
Prepare a change with risk and rollback plan, then test approval, implementation and verification.
Pricing
$0per user
The base account and everyday work in the ERP.AI app are free, for every user.
- No per-user or per-seat fees
- Viewing, editing, approving and exporting records in the app is free
- Pay only for machine work: API calls, imports, workflows and AI agents
- Prepaid credits from $5. Purchased credits never expire
Machine work rate card Included per $1 of credit
| Usage | Per $1 |
|---|---|
| Record reads (list, filter, get) | 20,000 |
| Search or aggregate queries | 4,000 |
| Record writes | 4,000 |
| Imported or synced records | 200,000 |
| Workflow runs | 2,000 |
| AI agent runs | 2,000 |
| Scheduled jobs or webhooks | 20,000 |
| File uploads (MB) | 2,000 |
| CSV or PDF exports | 100 |
How do I get started?
Click Get started, then use Proto to configure Log Management & Analysis for your business. Begin with one service, its owner, one source stream and a representative alert-to-incident case.
What does a log stream record?
It keeps a stream name, source endpoint, retention days and the service it supports. Use the source endpoint when coordinating setup with the observability team.
How does an alert reach the response team?
An alert carries a query definition, observation window, match count, stream and triage status. The team can open a separate incident for service response when needed.
Where do raw logs live?
Set up a connection to the observability system that stores and searches them. The stream record identifies the source used in the team's operating workflow.
Who acknowledges an incident?
The response workflow acknowledges a new incident or authorized inbound event and records the actual acknowledgment time. The assigned Incident Responder checks the work. Incident updates retain the author and occurrence time of later observations.
How are changes approved?
A Change Approver reviews the service, risk, planned window and rollback plan while the change is in review. Approved work then moves into implementation and verification.
Can we track recurring issues?
A problem record holds the service, owner, problem statement, root cause and investigation status. Use it for continuing cause work alongside incidents.
How do service requests differ from incidents?
Requests capture a requester, request type, due date and approval and fulfillment path. Incidents capture a response to a service issue with priority, assignee and response times.
What can we check when stream registration fails?
Find the processing receipt by external event identifier. Its processing status distinguishes received, applied, rejected and failed outcomes.
How do we review response performance?
Use incident opening, acknowledgment and resolution times, together with service and priority, to compare the recorded intervals.
Set up Log Management & Analysis your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.