ELK Stack and AI Agent: How ASI Biont Automates Log Monitoring Without Complex Queries

Introduction: Why Manual Log Parsing Is a Thing of the Past

DevOps engineers and developers spend up to 30% of their working time analyzing logs—searching for errors, anomalies, and bottlenecks in infrastructure. ELK Stack (Elasticsearch, Logstash, Kibana) is a standard tool for collecting and visualizing logs, but its configuration requires writing complex queries in Kibana Query Language (KQL) or Painless scripts. Even automatic dashboards have to be created manually, and alerts must be set up via Watcher or third-party services.

Integrating ASI Biont with ELK Stack solves this problem: the AI agent connects to your cluster via API, writes code to analyze logs, identifies anomalies, and generates ready-made dashboards in Kibana. All of this—without a single line of code on your part. Just provide an API key in the chat, and the AI does the rest.

How ASI Biont Connects to ELK Stack

ASI Biont is an AI agent that connects to any service via its API. No special control panel or "Add Integration" button is needed for ELK Stack integration. Everything happens through a chat dialogue:

1. You provide the AI agent with an Elasticsearch API key (e.g., via a service account with permissions to read indices and create dashboards).
2. The AI itself writes Python code (using the elasticsearch-py library) to connect to your cluster, parse logs, and send queries.
3. You describe the task in natural language: "Find all 500 errors from the last hour" or "Create a dashboard with request frequency by endpoint."
4. The AI executes the code, returns the result, and, if needed, automatically configures alerts in Telegram or Slack.

This approach differs from traditional integrations, where you have to wait for platform developers to add service support. ASI Biont works with any API—you connect ELK Stack, Prometheus, Grafana, AWS CloudWatch, and any other tool that has a REST API.

What Tasks This Integration Automates

The integration of ASI Biont with ELK Stack covers three key scenarios that usually require manual work:

1. Real-Time Error Search

Instead of writing a query in Kibana like response.status_code >= 500 AND @timestamp > now-1h, you simply tell the AI: "Find all 500 errors from the last hour and show them in a table." The AI itself forms the query to Elasticsearch, parses the response, and returns a structured result.

Example:
- Chat query: "Show the last 10 critical errors in the backend server logs for today."
- Result: The AI returns a table with error time, status code, message, and source IP address. If needed, it immediately explains what might have caused the error (e.g., "503 error—database connection timeout").

2. Automatic Dashboard Creation in Kibana

Creating a dashboard in Kibana is a routine task: you need to select indices, configure visualizations, and save them to a panel. ASI Biont does this for you. You describe what you want to see, and the AI creates visualizations and dashboards via the Elasticsearch API.

Example:
- Chat query: "Create a dashboard with three graphs: request count by hour, top 5 endpoints by latency, and status code distribution."
- Result: A new dashboard with configured visualizations appears in Kibana. The AI can also add a description to each graph to explain what it shows.

3. Telegram Notifications About Failures

Setting up alerts in ELK via Watcher is a complex task, especially if you need to send notifications to Telegram. ASI Biont simplifies this: you specify a condition (e.g., "if there are more than 10 errors 500 in 5 minutes"), and the AI automatically creates an alert that sends a message to the specified Telegram chat.

Example:
- Chat query: "Set up an alert: if the number of 502 errors exceeds 5 in the last 5 minutes, send a notification to Telegram in the chat @my_team."
- Result: The AI creates a script that checks logs every 5 minutes via the Elasticsearch API, and if the condition is met, sends a message via the Telegram Bot API.

Examples of Specific Use Cases

Scenario 1: Incident Diagnosis

Imagine your microservice starts returning 503 errors. Instead of manually searching in Kibana, you write in the ASI Biont chat:

"Find all 503 errors from the last 30 minutes, group them by endpoint, and show the count. Also check if there is a correlation with database response time."

The AI executes the query to Elasticsearch, analyzes the data, and responds:

• Endpoint /api/users: 12 errors 503, average response time—5.2 seconds.
• Endpoint /api/orders: 3 errors 503, average response time—1.1 seconds.
• Correlation: 503 errors on /api/users coincide with database latency spikes (index db-logs-*).

You immediately see the problem—the database cannot handle the load on that specific endpoint.

Scenario 2: Automatic Old Log Cleanup

Elasticsearch requires index lifecycle management (ILM). ASI Biont can configure the policy automatically:

"Set up ILM so that logs older than 30 days are deleted, and logs from 7–30 days are compressed into a read-only index."

The AI creates the policy via the Elasticsearch API and applies it to the specified indices.

Scenario 3: Performance Comparison After Release

After each deployment, you need to compare metrics with the previous version:

"Compare the number of 4xx and 5xx errors from the last hour with the same period yesterday. If the difference is more than 20%, create a dashboard with details."

The AI executes two queries to Elasticsearch (today and yesterday), compares the results, and if the condition is met, creates a dashboard in Kibana with graphs.

Why It’s Beneficial: Time Savings and Routine Automation

• Speed: Writing a query in Kibana takes 1-2 minutes, while describing a task to the AI takes 10 seconds. With frequent queries, time savings reach 80%.
• No Routine: You don’t need to remember KQL syntax or manually configure dashboards. The AI does it for you, and you focus on analysis.
• Flexibility: ASI Biont connects to any service via API—not just ELK Stack. You can combine data: for example, analyze logs together with metrics from Prometheus or Grafana.
• Scalability: The AI can simultaneously process queries to multiple Elasticsearch clusters, which is useful for large infrastructures with hundreds of microservices.

According to the State of DevOps 2023 report (Google Cloud), teams that automate log analysis fix incidents 2.5 times faster. Integration with ASI Biont makes this automation accessible without special skills.

How to Get Started: Step-by-Step Guide

1. Get an Elasticsearch API key. In Kibana, go to Stack Management → API Keys and create a key with read permissions on the required indices and write permissions for creating dashboards (if you plan automatic visualization creation).
2. Open the chat with ASI Biont at asibiont.com.
3. Provide the API key and your cluster URL. For example: "Connect to my ELK Stack: URL https://my-cluster.es.us-east-1.aws.cloud.es.io, API key XXX."
4. Describe the task. For example: "Create a dashboard with errors for the week" or "Set up an alert in Telegram for 500 errors."

The entire connection takes less than a minute. The AI will write the code, execute it, and show the result. No control panels, "Add Integration" buttons, or waiting for support.

Conclusion

ELK Stack is a powerful monitoring tool, but its configuration takes time that could be better spent on product development. Integration with ASI Biont turns log analysis into a dialogue: you ask questions in natural language, and the AI does all the technical work—from Elasticsearch queries to creating dashboards and alerts.

Try the integration right now: go to asibiont.com, open the chat, and connect your ELK Stack. See how AI simplifies DevOps routine.