How AI can Investigate Every New Log Pattern at Scale

Nobody is reading every log, every hour, every day, across every service.

Whether you generate a few gigabytes a day or a few terabytes, most of your logs are not worth watching constantly. Teams check dashboards now and then and rely on alerts written in advance, yet both cover only the failures that someone saw coming. Everything else is found reactively: the new error after a deploy, the secrets logged without redaction, the user complaints that a feature is broken. As Jad wrote in “The Signal Was There. Nobody Was Watching.,” the signal is usually in the telemetry; the problem is that nobody is looking at it.

So why isn't everyone using LLMs to monitor their logs constantly? Well, until now, the cost was prohibitive.

The cost wall

Giving all your logs to an LLM cannot be justified at any scale. At 10 TB a day, Gemini 3.8 Flash would read about 2.5 trillion tokens a day. Even with prompt caching, that costs about $640,000 per day, or $234M a year.

Volume is the problem, but the signal is not in the volume. A system that serves 10x more requests often emits the same logs at 10x the volume. The number of new patterns grows only when your system does something it hasn’t done before: a new feature, a deploy, a failure. That number is small, and it captures most of your system’s changing behavior.

How Grepr identifies anomalous logs at scale

The Grepr platform consists of two primary components: the Autonomous Telemetry Pipeline and Grepr AI. Grepr’s pipeline detects log patterns dynamically, instead of relying on static rules. As logs stream through Grepr’s pipeline, Grepr groups them into unique patterns, detecting the underlying structure of each log event by masking the IDs, numbers, timestamps, and any other values that change from event to event. And it remembers every pattern it has seen.

When Grepr discovers a new pattern, the pipeline emits a signal to an agent within Grepr AI. The agent wakes up on the signal, reads the triggering event, and starts an investigation using an LLM to understand its importance to the rest of the system and to perform any necessary triage or alerting. This is why Grepr can identify issues in your logs at scale: the pipeline finds the few novel signals so LLM analysis is cost-effective. For instance: a deploy starts logging an unredacted API key, the new pattern triggers the security agent, and the team hears about it within minutes. See 30 Days On Call: What Grepr AI Caught Next to see what we’ve caught in our own environment.

What Grepr's log pattern analysis makes possible

A 24/7 on-call agent. Every new log pattern gets investigated, automatically and in real time, without any engineer having anticipated and built an alert beforehand.

A better model. Because only new patterns reach the LLM, you can afford a more capable model than you could ever run on every log.

More than one perspective. Create several agents with different goals to look at the same signal, at minimal cost. An SRE agent investigates whether something is broken. A security agent looks for secrets and unusual access. A cost agent looks for noisy log lines to remove.

Memory and self-improvement. The agents build a working memory of your system over time, so they get a better sense of what is common versus uncommon in your environment. They can also propose changes to your log pipelines, such as removing a noisy log line so your telemetry gets better over time.

Watch everything. Pay only for what is new.

Grepr's pipeline watches every log, so the LLM reads only what is new. That brings 24/7 AI monitoring down from hundreds of millions of dollars a year to thousands, and you hear about a problem when it happens, not after a customer reports it.

Try it out: Design partnership is open

We’re actively seeking design partners to provide feedback on what we’re building. In exchange, you’ll get to run Grepr AI for free. If you’d like to join the program, reach out to us.

FAQ

Why can’t I just send all my logs to an LLM?

Volume makes it impossible to justify. At 10 TB a day, a model like Gemini 3.8 Flash would read about 2.5 trillion tokens daily, roughly $640,000 a day or $234M a year, even with prompt caching. The signal you care about is not in the sheer volume, so paying to read all of it is wasted.

How does Grepr identify a new log pattern?

As logs stream through Grepr’s Autonomous Telemetry Pipeline, it groups them into patterns by masking the parts that change from event to event, like IDs, numbers, and timestamps, and it remembers every pattern it has seen. A pattern it has not seen before is flagged as new, with no static rules required.

What happens when a new pattern shows up?

The pipeline emits a signal to an agent in Grepr AI. The agent reads the triggering event and runs an LLM investigation to judge how much it matters and to handle any triage or alerting. For example, a deploy starts logging an unredacted API key, the new pattern triggers a security agent, and the team hears about it within minutes.

‍

‍