# Querying Datadog logs via API with AI summarization
import anthropic
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.logs_api import LogsApi

def investigate_incident(service: str, start_time: str, end_time: str) -> str:
    config = Configuration()
    with ApiClient(config) as api_client:
        logs_api = LogsApi(api_client)

        # Fetch logs for the incident window
        response = logs_api.list_logs(
            body={
                "filter": {
                    "query": f"service:{service} status:error",
                    "from": start_time,
                    "to": end_time
                },
                "sort": "timestamp",
                "page": {"limit": 500}
            }
        )

    # Extract log messages
    logs = [log.attributes.get("message", "") for log in response.data]
    log_sample = "\n".join(logs[:200])  # First 200 lines

    # Use Claude to analyze
    client = anthropic.Anthropic()
    response = client.messages.create(
        model="claude-sonnet-4-5",
        max_tokens=1024,
        messages=[{
            "role": "user",
            "content": f"""Analyze these production error logs from the {service} service.

Time range: {start_time} to {end_time}

Logs:
{log_sample}

Identify:
1. The root cause error (the first failure that triggered others)
2. Any cascade pattern (did one error cause many others?)
3. Which specific request/user/ID triggered the issue
4. Whether this looks like a deployment issue, data issue, or infrastructure issue
5. Recommended next investigation step"""
        }]
    )

    return response.content[0].text

# log_investigator.py — queries OpenSearch, summarizes with Claude
from opensearchpy import OpenSearch
import anthropic
from datetime import datetime, timedelta

es = OpenSearch([{'host': 'localhost', 'port': 9200}])
claude = anthropic.Anthropic()

def find_error_clusters(index: str, time_window_minutes: int = 30) -> list:
    """Find clusters of similar errors in the recent time window."""
    cutoff = (datetime.utcnow() - timedelta(minutes=time_window_minutes)).isoformat()

    # Aggregate by error message to find patterns
    response = es.search(
        index=index,
        body={
            "query": {
                "bool": {
                    "filter": [
                        {"range": {"@timestamp": {"gte": cutoff}}},
                        {"term": {"level": "ERROR"}}
                    ]
                }
            },
            "aggs": {
                "error_patterns": {
                    "terms": {
                        "field": "message.keyword",
                        "size": 20
                    },
                    "aggs": {
                        "first_occurrence": {"min": {"field": "@timestamp"}},
                        "services": {"terms": {"field": "service.keyword"}}
                    }
                }
            },
            "size": 0
        }
    )

    return response["aggregations"]["error_patterns"]["buckets"]

def investigate_cluster(error_message: str, index: str) -> str:
    """Fetch surrounding context for a specific error and analyze it."""
    # Get the full log context around occurrences of this error
    response = es.search(
        index=index,
        body={
            "query": {"match": {"message": {"query": error_message, "operator": "and"}}},
            "sort": [{"@timestamp": "asc"}],
            "size": 50,
            "_source": ["@timestamp", "message", "service", "trace_id", "user_id",
                       "request_path", "error.stack_trace"]
        }
    )

    hits = response["hits"]["hits"]
    log_context = "\n".join(
        f"[{h['_source']['@timestamp']}] {h['_source'].get('service', 'unknown')}: "
        f"{h['_source']['message']}"
        + (f"\nStack: {h['_source']['error']['stack_trace'][:300]}"
           if h['_source'].get('error') else "")
        for h in hits[:30]
    )

    analysis = claude.messages.create(
        model="claude-haiku-4-5",
        max_tokens=768,
        messages=[{
            "role": "user",
            "content": f"""Production error cluster to investigate:

Error: {error_message}
Occurrences in last 30 minutes: {len(hits)}

Sample log entries with context:
{log_context}

Diagnose: What is causing this error? Is it a code bug, infrastructure issue,
or data problem? What's the fastest path to resolution?"""
        }]
    )

    return analysis.content[0].text

# Usage
clusters = find_error_clusters("production-logs-*", time_window_minutes=30)
for cluster in clusters[:5]:  # Investigate top 5 error clusters
    if cluster["doc_count"] > 10:  # Only if significant
        print(f"\n=== Error: {cluster['key'][:80]} ({cluster['doc_count']} occurrences) ===")
        print(investigate_cluster(cluster["key"], "production-logs-*"))

import json
import anthropic
from pathlib import Path

def analyze_structured_logs(log_file: str, max_lines: int = 500) -> str:
    """Analyze JSON structured logs for patterns and anomalies."""
    client = anthropic.Anthropic()
    lines = Path(log_file).read_text().splitlines()[:max_lines]

    parsed = []
    for line in lines:
        try:
            parsed.append(json.loads(line))
        except json.JSONDecodeError:
            continue

    # Extract statistics
    levels = {}
    services = {}
    error_messages = []

    for entry in parsed:
        level = entry.get("level", "unknown")
        levels[level] = levels.get(level, 0) + 1

        service = entry.get("service", "unknown")
        services[service] = services.get(service, 0) + 1

        if level in ("ERROR", "FATAL"):
            error_messages.append(entry.get("message", ""))

    # Sample of error logs for context
    error_sample = json.dumps([p for p in parsed if p.get("level") == "ERROR"][:50], indent=2)

    response = client.messages.create(
        model="claude-sonnet-4-5",
        max_tokens=1024,
        messages=[{
            "role": "user",
            "content": f"""Analyze these structured application logs.

Log statistics:
- Total entries: {len(parsed)}
- By level: {json.dumps(levels)}
- By service: {json.dumps(services)}

Error log sample:
{error_sample}

Provide:
1. What is the primary failure mode visible in these logs?
2. Is there a time pattern (errors concentrated in a window)?
3. Which service appears to be the origin vs downstream victims?
4. What additional log fields or metrics would help diagnose this further?"""
        }]
    )

    return response.content[0].text