LogPilot — AI Agent That Turns Server Logs Into Plain English

Google Cloud Rapid Agent Hackathon 2026 — Partner Tracks: Elastic + GitLab

LogPilot is an AI agent built on Google Cloud Agent Builder and Gemini 3 that continuously monitors server logs indexed in Elastic, detects anomalies and error patterns in real time, translates raw technical data into plain-English insights, automatically creates incident tickets in GitLab, and delivers a daily digest to the engineering team.

Architecture

┌─────────────────────────────────────────────────────────┐
│  LAYER 1: Data Sources                                  │
│  App servers → Nginx → Databases → K8s pods → Cloud    │
│  Collected via Filebeat agents                          │
├─────────────────────────────────────────────────────────┤
│  LAYER 2: Elastic Stack                                 │
│  Logstash (parsing) → Elasticsearch (indexing)          │
│  Elastic MCP exposes search/aggregation APIs            │
├─────────────────────────────────────────────────────────┤
│  LAYER 3: AI Agent Core                                 │
│  Google Cloud Agent Builder + Gemini 3 reasoning engine │
│  Tool orchestration layer                               │
├─────────────────────────────────────────────────────────┤
│  LAYER 4: Actions & Output                              │
│  GitLab tickets → Slack/email → Daily digest → Dashboard│
└─────────────────────────────────────────────────────────┘

Quick Start

Prerequisites

• Node.js 20+
• Python 3.9+ (for dashboard)
• Elastic Cloud account (free trial)
• Google Gemini API key
• GitLab account (free tier)

Setup

# 1. Clone and install
git clone <repo> && cd LogPilot
npm install
pip install streamlit plotly requests

# 2. Configure environment
cp .env.template .env
# Edit .env with your credentials

# 3. Generate demo logs
node log-generator.js batch 1000 0.12
node log-generator.js incident payment-service 47 in-mumbai 60

# 4. Run the agent (dry-run with local data — no API keys needed)
npm run dry-run

# 5. Launch the dashboard
npm run dashboard

Commands

Command	Description
npm start	Run agent (requires .env)
npm run demo	Run agent with 24h lookback
npm run dry-run	Run agent using local incident files
npm run server	Start HTTP server for Cloud Run
npm run dashboard	Start Streamlit dashboard
npm run digest	Generate daily digest
npm run generate-logs -- 500 0.15	Generate batch logs
npm run generate-incident -- payment-service 47 in-mumbai 60	Simulate incident
npm test	Run unit tests

Agent Logic

The agent runs on a Plan → Act → Evaluate loop every 5 minutes:

1. Query Elastic — searches for ERROR/CRITICAL/FATAL log levels in the last N minutes
2. Classify Severity — rule-based: LOW (<10), MEDIUM (10-50), HIGH (50+), CRITICAL (100+)
3. Translate — Gemini 3 converts raw logs into plain-English summary
4. Create Ticket — auto-creates GitLab issue with full context
5. Store & Report — logs metrics, generates daily digest

Project Structure

LogPilot/
├── agent/
│   ├── index.js          # Main agent loop
│   ├── server.js         # HTTP server (Cloud Run)
│   ├── elastic-client.js # Elasticsearch queries
│   ├── gitlab-client.js  # GitLab API integration
│   ├── llm-client.js     # Gemini LLM integration
│   ├── severity.js       # Severity classification
│   ├── store.js          # Local JSON data store
│   └── digest.js         # Daily digest generator
├── data/                 # Generated logs, incidents, metrics
├── tests/                # Jest unit tests
├── dashboard.py          # Streamlit dashboard
├── log-generator.js      # Demo log data generator
├── logpilot.js           # Hackathon submission DOCX generator
├── Dockerfile            # Container config
├── cloudbuild.yaml       # GCP Cloud Build config
└── .env.template         # Environment variable template

Demo

The --dry-run mode lets you demo the full pipeline without any external services:

# Generate a realistic incident
node log-generator.js incident payment-service 47 in-mumbai 60

# Run the agent in dry-run mode
node agent/index.js --dry-run

# View the dashboard
streamlit run dashboard.py

Deployment

Cloud Run

gcloud builds submit --config cloudbuild.yaml

The agent runs as an HTTP server that accepts Pub/Sub triggers from Cloud Scheduler.

Environment Variables

See .env.template for all configuration options.

Built With

• Google Cloud Agent Builder — Agent orchestration
• Gemini 3 — LLM reasoning and plain-English translation
• Elastic Cloud — Log indexing, search, and aggregation
• GitLab — Issue tracking and incident management
• Streamlit — Demo dashboard
• Google Cloud Run — Serverless hosting
• Google Cloud Scheduler — Agent trigger scheduling