AI & LLM Functions¶

DECLARE prompt STRING = 'Explain what Elasticsearch is in one sentence.';
DECLARE response STRING = LLM_COMPLETE(prompt);
PRINT response;
-- Output: Elasticsearch is a distributed search and analytics engine...

DECLARE response STRING = LLM_COMPLETE(prompt, 'gpt-4');

DECLARE long_text STRING = '... lengthy document content ...';
DECLARE summary STRING = LLM_SUMMARIZE(long_text);
PRINT summary;

DECLARE text STRING = 'The server is experiencing high latency';
DECLARE embedding ARRAY = ES_INFERENCE('text-embedding', text);

CREATE PROCEDURE summarize_errors()
BEGIN
    -- Fetch recent errors
    DECLARE errors CURSOR FOR ESQL_QUERY('
        FROM logs-*
        | WHERE level = "ERROR"
        | SORT @timestamp DESC
        | LIMIT 20
    ');

    -- Collect error messages
    DECLARE messages ARRAY = [];
    FOR error IN errors LOOP
        SET messages = ARRAY_APPEND(messages, DOCUMENT_GET(error, 'message'));
    END LOOP;

    IF ARRAY_LENGTH(messages) = 0 THEN
        PRINT 'No errors found';
        RETURN 'No errors to summarize';
    END IF;

    -- Create summary prompt
    DECLARE prompt STRING = 'Summarize these error messages and identify the root cause:\n\n' 
        || ARRAY_JOIN(messages, '\n');

    -- Get AI summary
    DECLARE summary STRING = LLM_COMPLETE(prompt);

    PRINT '=== Error Summary ===';
    PRINT summary;

    RETURN summary;
END PROCEDURE;

CREATE PROCEDURE classify_alert(alert_message STRING)
BEGIN
    DECLARE prompt STRING = 'Classify this alert into one of: CRITICAL, HIGH, MEDIUM, LOW.
Only respond with the classification level.

Alert: ' || alert_message;

    DECLARE classification STRING = LLM_COMPLETE(prompt);
    DECLARE level STRING = TRIM(UPPER(classification));

    -- Validate response
    IF level NOT IN ('CRITICAL', 'HIGH', 'MEDIUM', 'LOW') THEN
        SET level = 'MEDIUM';  -- Default
    END IF;

    PRINT 'Alert classified as: ' || level;
    RETURN level;
END PROCEDURE;

CREATE PROCEDURE generate_runbook(incident DOCUMENT)
BEGIN
    DECLARE service STRING = DOCUMENT_GET(incident, 'service');
    DECLARE error STRING = DOCUMENT_GET(incident, 'error');

    DECLARE prompt STRING = 'Generate a step-by-step runbook to resolve this incident:

Service: ' || service || '
Error: ' || error || '

Provide numbered steps that an on-call engineer can follow.';

    DECLARE runbook STRING = LLM_COMPLETE(prompt);

    -- Store runbook
    DECLARE doc DOCUMENT = {
        "incident_id": DOCUMENT_GET(incident, 'id'),
        "generated_runbook": runbook,
        "generated_at": CURRENT_TIMESTAMP()
    };
    ES_INDEX('incident-runbooks', NULL, doc);

    RETURN runbook;
END PROCEDURE;

CREATE PROCEDURE semantic_search(query STRING)
BEGIN
    -- Generate embedding for query
    DECLARE query_embedding ARRAY = ES_INFERENCE('text-embedding', query);

    -- Search using KNN
    DECLARE results CURSOR FOR ESQL_QUERY('
        FROM knowledge-base
        | WHERE knn(embedding, ' || query_embedding || ', 10)
        | LIMIT 5
    ');

    FOR result IN results LOOP
        PRINT DOCUMENT_GET(result, 'title');
        PRINT '  ' || DOCUMENT_GET(result, 'summary');
    END LOOP;
END PROCEDURE;