🔎 Building IncidentCopilot: Designing a Deterministic Log Correlation Engine

Milestone four of the IncidentCopilot project—a free and local AI DevOps incident assistant—centred on constructing a deterministic log correlation engine. This tool aims to assist developers in collecting, correlating, and explaining logs before incorporating artificial intelligence. The engine focuses on logs from various sources such as Nginx, Kubernetes, Docker, application logs, and GitHub Actions.

To correlate events, the engine employs five weighted signals: temporal proximity (25%), service relationships (25%), error signatures (25%), severity weighting (15%), and causal ordering (10%). Scores are capped at 1.0, with timing alone not creating correlations. The engine returns structured signals, including related log IDs, relevance scores, relationship types, and reasons.

These structured explanations feature time differences, shared services, matching error patterns, and ordering to make correlations transparent and verifiable.

The correlation engine does not query databases, call large language models, or utilize vector databases. Instead, it provides benefits like testability with fixtures, predictability, separation of concerns, and flexibility for future integration. Testing covered temporal correlation, error-signature matching, severity weighting, service correlation, negative tests for unrelated events, ordering explanations, invalid window values, timezone-aware timestamps, and score bounds.

Milestone four explicitly states that the engine does not prove root causes, understand error messages semantically, employ LLMs for relationships, build full incident timelines, or differentiate correlation from causation. Instead, its role is to generate deterministic correlation signals for future workflows. The project's next step is Milestone 5, which will introduce incident timeline and lifecycle organization.

This incremental development approach controls complexity while maintaining core priorities of local-first operation, testability, and transparency. IncidentCopilot is being developed step-by-step, with the full source code available on GitHub.