Capabilities · Metrics and logs
Explain what your metrics and logs show.
Ask about latency, errors and saturation in the Prometheus you already run, about what a service wrote to Splunk, or about the health of an Elasticsearch or OpenSearch cluster. Verbiqo builds and checks every query and search itself, and answers from what it measured.
The task
- Explain a latency, error or saturation spike over a time window, host by host (Prometheus, Thanos).
- Find what a service logged when it started failing, and what changed around it (Splunk).
- Review a search cluster: unassigned shards, disk against the watermarks, heap, rejections, lifecycle and snapshots (Elasticsearch, OpenSearch).
- Find security events and credentials written into logs, where your organization’s policy allows it (Splunk, Elasticsearch, OpenSearch).
- Ask across sources at once: metrics, logs and database events on one timeline.
Who it helps
SRE and operations teams explaining a spike. Developers and support engineers checking what a service logged. Platform teams running search clusters. Security teams reviewing logs. What each can ask depends on the sources your organization connects and the access it grants.
Supported sources
| Source | What Verbiqo reads | What it needs |
|---|---|---|
| Prometheus, Thanos | Measurements over time. Verbiqo keeps a map of the jobs, hosts and metrics your server holds on your computer, finds the right measurement for a question, and writes the queries itself. Hosts that were down, not monitored or without data are named. | Read access to the query API |
| Splunk | Searches built and checked by Verbiqo, bounded in time and size, over the indexes, hosts and sourcetypes the account may search. | A role that can search |
| Elasticsearch, OpenSearch | The monitoring and metadata APIs. Documents are never read for cluster questions. Security logs only where your organization’s policy allows. | A monitoring role |
Example
Prometheus · illustrative sample in Verbiqo’s output format, not a customer system
Question
Why was checkout slow between 14:00 and 15:00? Did the orders database play a part?
Checks Verbiqo ran
- Found the checkout and orders-db jobs in its map of your Prometheus
- Measured checkout’s latency, errors and wait for a database connection, per instance
- Measured the database’s connections over the same window
Findings Measured
- Checked 3 checkout instances and 1 database, 14:00–15:00.
- Checkout p95 latency rose from 180 ms to 2.4 s at 14:12, on all 3 instances, and was back to 190 ms by 14:42.
- orders-db used 200 of 200 connections from 14:11 to 14:40, then fell to 120.
- Checkout’s p95 wait for a database connection rose from under 5 ms to 1.9 s over the same minutes.
- Checkout’s error rate stayed below 0.1%.
Explanation Your model
Connection exhaustion is a likely contributor: all 200 orders-db connections were in use from 14:11 to 14:40, checkout’s p95 connection wait reached 1.9 s, and latency recovered as connections became available. That percentile is not the longest wait. Errors stayed below 0.1%; without a baseline, this does not establish whether errors increased. These measurements do not show why connections filled up. Session or log history from that window, if retained, may help test the cause; a live session sample cannot reconstruct it.
Limits stated
Only what your Prometheus already collects can be measured: here, checkout exports its connection wait time. Verbiqo does not collect or store measurements itself.
Limitations
- Verbiqo reads the monitoring and logging you already run, when you ask. It does not collect or store telemetry, watch continuously or send alerts, and it does not replace your observability platform.
- Answers cover what your sources hold: their retention, the metrics you collect, the indexes the account may search.
- Queries and searches are bounded in time and size, so a very broad question may be answered in part. The answer says what it did not read.
- The explanation is written by your model. The measurements beside it are Verbiqo’s.
Next step
Read how to connect each source, or try it on your own.