How It Works — ungrep AI

1. Connect Any Log Source

ungrep AI integrates with your existing infrastructure in minutes. No log forwarder agents to install, no config files to maintain. We read from where your logs already live.

Syslog, journald, Docker stdout/stderr
Kubernetes pod logs via the API
AWS CloudWatch, GCP Cloud Logging, Azure Monitor
Plain log files on disk (tail -f style)
OpenTelemetry log signals via OTLP/gRPC

Self-hosted deployments run a single Docker container. SaaS mode uses a lightweight forwarder that streams logs over TLS with at-least-once delivery.

          
          docker-compose.yml
        
services:
  ungrep:
    image: ungrep/server:latest
    ports:
      - "8080:8080"
    volumes:
      - /var/log:/logs:ro
    environment:
      - UNGREP_SOURCES=/logs/**/*.log
      - UNGREP_MODEL=local
      - UNGREP_STORAGE=./data

❙

Raw Log Lines

Structured & unstructured text from all sources

↓

✦

Chunking & Normalization

Smart boundary detection, timestamp parsing, deduplication

↓

➤

Vector Embeddings

768-dim vectors capturing semantic meaning

↓

⬢

Vector Index

HNSW index for sub-10ms approximate nearest neighbor search

2. Semantic Embedding Pipeline

Traditional log tools rely on keyword indexing — you can only find what you know to search for. ungrep AI converts every log line into a high-dimensional vector that captures its meaning, not just its words.

This means a search for "payment failures" will find entries that say "transaction declined", "charge refused", or "billing exception" — even if those exact keywords never appear in your query.

Custom embedding model fine-tuned on 50B+ log tokens
Handles structured JSON, plain text, and mixed formats
Incremental indexing — new logs are searchable in <5 seconds
10x cheaper storage than traditional full-text indexing

3. RAG-Powered Answers

When you ask a question, ungrep uses a Retrieval-Augmented Generation pipeline to find the most relevant log entries, then feeds them to an LLM that reasons over the evidence and produces a structured answer.

The Query Pipeline

Intent parsing: Extracts time ranges, service names, severity filters from natural language
Multi-vector retrieval: Searches across multiple embedding spaces (content, timestamp, service topology)
Re-ranking: Cross-encoder model scores relevance of top-100 candidates
LLM reasoning: Generates a root-cause analysis with cited log entries
Confidence scoring: Returns a reliability score so you know when to dig deeper

The entire pipeline runs in under 200ms P99 — faster than loading a Kibana dashboard.

          
          ungrep query response
        
{
  "query": "Why did checkout fail at 3am?",
  "confidence": 0.94,
  "root_cause": "Redis connection pool
    exhaustion caused cascading
    auth timeouts",
  "evidence": [
    {
      "service": "redis-cache",
      "time": "03:14:02Z",
      "relevance": 0.97
    },
    ...
  ],
  "latency_ms": 142
}

Enterprise-Grade Architecture

Built for teams that run production systems at scale.

Multi-Tenant Isolation

Each tenant's data is cryptographically isolated. Separate encryption keys, separate vector namespaces, separate access controls.

Horizontal Scaling

Stateless query nodes scale to thousands of concurrent users. Vector index shards distribute across nodes automatically.

On-Premise Deployment

Run the entire stack on your hardware. No data leaves your network. Air-gapped mode available for regulated industries.

SOC2 Type II

Fully audited infrastructure with end-to-end encryption, role-based access control, and comprehensive audit logging.

Smart Retention

Embeddings are 10x smaller than raw indexed logs. Keep months of searchable history at a fraction of the cost.

OpenTelemetry Native

First-class OTLP support. Correlate logs with traces and metrics in a single conversational interface.

How ungrep AI Works