log_error_burst_rca
Root-cause error bursts by comparing current and baseline windows per stream, classifying each burst as new signature, volume spike, or single-instance burst with cause and action.
Instructions
[READ][analysis] Root-cause an error burst: current window vs baseline, per stream.
Pulls error streams for the current window (now-hours..now) and an equal-length baseline window (now-2*hours..now-hours), then classifies each burst as a new error signature, a volume spike, or a single-instance burst — with a cause + action. Advisory heuristic; verify against the raw logs.
Args: selector: A Loki stream selector to scope the analysis (e.g. '{app="api"}'). hours: Window length in hours for both current and baseline (capped). loki_target: Loki target name from config; omit for the default.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | ||
| selector | Yes | ||
| loki_target | No |