@grepr/cli 1.11.3 → 1.11.5-173e2da

package/build/dist/docs-index/dbed0239-8efd-4f71-aa4c-c2e1e8a639e0.txt

@@ -0,0 +1,30 @@
+# Preview authorization scopes for keys not yet saved to any integration
+
+**POST** `/v1/integrations/datadog/app-key/scopes/preview`
+
+**Operation ID**: `previewNewDatadogAppKeyScopes`
+**Summary**: Preview authorization scopes for keys not yet saved to any integration
+Probes Datadog with the supplied site and keys and reports each authorization scope. For the create form, where there is no integration to take keys from, so every field is required. Nothing is written and nothing is stored.
+
+## Tags
+- Datadog Integration
+## Request Body
+
+**Content-Type**: `application/json`
+
+**Schema**: `CheckAppKeyScopesRequest`
+
+## Responses
+
+### 200
+
+Scopes checked successfully
+
+- **Content-Type**: `application/json` / array of `AppKeyScopeCheck`
+### 400
+
+The supplied site is not allowed for this organization.
+
+### 401
+
+Unauthorized

package/build/dist/docs-index/{ca1fe484-d0bb-46b1-93c1-6de0c2eccf32.txt → dc6075cb-b04c-4d74-86d6-e2edf0bd282b.txt}

@@ -4,6 +4,8 @@
 
 **Operation ID**: `currentWindow`
 **Summary**: Get the current maxTokens window of one LLM integration
+## Tags
+- LLM Usage
 ## Parameters
 
 - **integrationId** (required) - path

package/build/dist/docs-index/{ba4f9978-7ee2-4588-ab34-56a85ed42064.txt → ddd84522-124e-4a76-98ac-790ea50a20d3.txt}

@@ -4,6 +4,8 @@
 
 **Operation ID**: `archive`
 **Summary**: Archive an organization skill
+## Tags
+- Skills
 ## Parameters
 
 - **id** (required) - path

package/build/dist/docs-index/e35663f8-01e5-403c-a725-fb21cd6aeda1.txt

@@ -0,0 +1,39 @@
+# Preview authorization scopes for unsaved changes to an integration
+
+**POST** `/v1/integrations/datadog/{id}/app-key/scopes/preview`
+
+**Operation ID**: `previewDatadogAppKeyScopes`
+**Summary**: Preview authorization scopes for unsaved changes to an integration
+Probes Datadog with the integration's stored keys, overridden by whatever the body supplies, and reports each authorization scope. Nothing is written. An omitted field means "use what is stored", so an empty body reports what the stored key can do right now. A scope whose probe does not complete is reported UNKNOWN rather than as a permission the user has to grant.
+
+## Tags
+- Datadog Integration
+## Parameters
+
+- **id** (required) - path
+  - Type: string
+
+## Request Body
+
+**Content-Type**: `application/json`
+
+**Schema**: `PreviewAppKeyScopesRequest`
+
+## Responses
+
+### 200
+
+Scopes checked successfully
+
+- **Content-Type**: `application/json` / array of `AppKeyScopeCheck`
+### 400
+
+The supplied site is not allowed for this organization.
+
+### 401
+
+Unauthorized
+
+### 404
+
+Integration not found.

package/build/dist/docs-index/{bb5a3cd1-99b3-4a3f-bbcc-b6cbd2194d3d.txt → e3b61552-9323-4d0c-955b-8dfd9b0f3084.txt}

@@ -8,6 +8,8 @@ Before sending log data to the destination platform, Grepr uses machine learning
 
 Grepr supports popular observability platforms, including Datadog, Splunk, New Relic, Sumo Logic, Grafana Cloud, and OpenTelemetry-compatible platforms.
 
+Grepr AI agents build on the same data. An agent examines your logs and pipeline configuration with the capabilities you grant it and reports what it found. Start an investigation yourself, or connect an agent to a pipeline or another system so it investigates on its own. To learn more, see [_](/ai-agents).
+
 If you're just getting started with Grepr, follow the **Get started** guides below. If you're already using Grepr and need information on creating pipelines to process logs or to query raw logs stored in Grepr, see the guides under **Process and explore your logs**. If you need to automate your Grepr tasks or implement clients that use Grepr features, or use JavaScript to code reusable components for your pipelines, see the **Developers** documentation.
 
 ## Get started
@@ -24,6 +26,8 @@ If you're just getting started with Grepr, follow the **Get started** guides bel
 
 [Query logs in the data lake](/queries)
 
+[Grepr AI agents](/ai-agents)
+
 ## Developers
 
 [Use the Grepr Rest API](/apis)

package/build/dist/docs-index/{7519135b-b14c-49b8-8190-13d72ca49a10.txt → e3c74a5e-fb4c-4356-9edb-32b065b7f244.txt}

@@ -6,6 +6,9 @@ Request constraints, followed by the first SQL failure when the request is compl
 
 ## Properties
 
+- name: fix (optional)
+  type: `AnalyticsDiagnosticFix`
+
 - name: message (required)
   type: string
   description: What is wrong, as a finished sentence to show the person editing the query.

package/build/dist/{openapi-docs/api/Status-Metrics/query_1.md → docs-index/e3e72428-f975-4641-9815-42c2d5ef5618.txt}

@@ -1,8 +1,8 @@
-# query_1
+# query
 
 **POST** `/v1/metrics/query`
 
-**Operation ID**: `query_1`
+**Operation ID**: `query`
 **Summary**: No summary provided.
 ## Tags
 - Status Metrics

package/build/dist/docs-index/e42d18dd-d5b5-4378-bd95-f762f2d5d735.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/e5b02f11-d1ee-4bcf-8efd-136c8bf1d8f8.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/{c2067a77-5aba-422d-8991-7b1f027427ca.txt → e5b02f11-d1ee-4bcf-8efd-136c8bf1d8f8.txt}

@@ -10,14 +10,16 @@ Log Explorer's Analyze mode groups and aggregates the logs your search returns i
 2. Enter a search query to filter the logs you want to analyze. Analyze mode accepts the same [Datadog-like syntax](/queries/datadog) and [New Relic log query-like syntax](/queries/new-relic) as searching.
 3. Open the **Analyze...** drawer under the search controls.
 4. Under **SELECT**, enter one expression per result column, and name it in the **Alias** field beside it. An alias is optional; a column you leave unnamed is named for you, after the field or function it computes.
-5. Under **GROUP BY**, add the expressions whose distinct combinations you want as rows. When you finish a new grouping expression, the builder adds a SELECT row for it and groups by that row's alias, so the expression is written once. Renaming the alias renames the grouping with it, and removing the column puts the expression back under GROUP BY. A GROUP BY row can name any SELECT alias. Without a grouping expression, an analysis made only of aggregates returns a single row.
+5. Under **GROUP BY**, add the expressions whose distinct combinations you want as rows. Each grouping expression also becomes a result column, so the rows show the values they are grouped on. Without a grouping expression, an analysis made only of aggregates returns a single row.
 6. Under **HAVING**, enter a condition over the aggregates to keep only some of the groups. Leave it empty to keep every group.
 7. Under **ORDER BY**, add the expressions to sort by and pick ascending or descending for each one.
-8. Set **Row limit**, the maximum number of rows to return. An analysis returns 2,500 rows by default. The field stops at the largest limit your deployment allows, and a larger one is refused with a message naming that maximum.
+8. Set **Row limit**, the maximum number of rows to return. An analysis returns 2,500 rows by default, up to the largest limit your deployment allows.
 9. Set **Scan budget** to cap how much of the lake the query may read, then run the analysis.
 
 The drawer's clauses are the SQL ones, so an analysis reads the way the query does: SELECT computes, GROUP BY collapses, HAVING filters the groups, ORDER BY and the row limit choose which of them you see. GROUP BY, HAVING and ORDER BY can refer to a result by its alias.
 
+Every SELECT column is either an aggregate or one of the grouping expressions. To count events by a field, add the field under SELECT and group by it.
+
 ## Log fields
 
 Expressions address the stored log columns by the following names:
@@ -34,7 +36,7 @@ Expressions address the stored log columns by the following names:
 
 > These are the Grepr SQL column names, which use `snake_case`. They are not the camelCase field names of the log event JSON that the search and export APIs return.
 
-A tag holds an array of values, so the suggestion for a tag key groups by the sorted, comma-joined set of its values — two events tagged with the same values in a different order land in one group. The suggestion shows this expression beside the key, so you can see what picking the key inserts:
+A tag holds an array of values, so picking a tag key from the suggestions groups by the sorted, comma-joined set of its values — two events tagged with the same values in a different order land in one group:
 
 ```sql
 ARRAY_TO_STRING(SORT_ARRAY(tags['service']), ',')
@@ -58,6 +60,15 @@ Grepr parses structured logs into an attribute document. Address a single attrib
 
 The shorthand reads one value out of the parsed document. The `attributes` column is the whole document, so use `@` when you want a field and `attributes` when you want the object itself.
 
+An attribute name is a dotted path of letters, digits, and underscores. A hyphen or a slash can join characters inside a segment, so `@trace-id` and `@app.kubernetes.io/name` are each one name. Because `-` and `/` are name characters, put whitespace around them when you mean subtraction or division: write `@bytes / 1024`, not `@bytes/1024` (which reads `bytes/1024` as one name). Every other character ends the name, so `@status=500` and `@duration_ms*2` work without spaces.
+
+To read a key that uses any other character, such as a space, comma, or bracket, reference it through the `attributes` column with a single-quoted key in brackets. The bracketed key can be any string, dots included, and names exactly one key; double a single quote to include one. Add one bracketed key per level of a nested path:
+
+```sql
+attributes['service.status']
+attributes['special outer key']['special inner key']
+```
+
 An attribute has no declared type, because two logs in the same dataset can carry different types under the same name. Grepr infers a type from how you use the value, so `SUM(@duration_ms)` reads it as a number and `LOWER(@user.email)` reads it as a string.
 
 Cast the attribute when you need a specific type or precision, and when you sort:
@@ -70,15 +81,17 @@ CAST(@duration_ms AS BIGINT)
 MIN(CAST(@duration_ms AS DOUBLE))
 ```
 
+Grepr reads a numeric attribute as a 64-bit floating point value, which represents whole numbers exactly only up to 9,007,199,254,740,992. Above that limit, two different whole numbers can compare as equal. Store large identifiers such as trace ids and 64-bit request ids as strings, which always match exactly. If an attribute already holds a large whole number, cast it to `BIGINT` to compare it exactly.
+
 > Sorting by an attribute you have not cast sorts it as text, so `100` sorts before `99`. Cast it to sort numerically.
 
-A path segment is a name or a number, and the segments are separated by dots. An `@` with nothing after it, or a segment that starts with a digit, is a syntax error, and Log Explorer reports it against the expression you typed.
+A path segment is a name or a number, and the segments are separated by dots.
 
 ## Expressions
 
 Expressions are Grepr SQL, so aggregates, `CASE`, `CAST` and scalar functions are all available.
 
-Every function an analysis can call is listed in the [Analyze function reference](/queries/analyze/functions), with its arguments and a worked example. Focus an expression box or start typing to find fields, functions, sampled tag and attribute keys, and result aliases. Suggestions match the text you type; they do not check whether each option fits the surrounding SQL. Typing a space closes the menu. Press the Down arrow key to open it again.
+Every function an analysis can call is listed in the [Analyze function reference](/queries/analyze/functions), with its arguments and a worked example. Focus an expression box or start typing to find fields, functions, sampled tag and attribute keys, and result aliases.
 
 > The [SQL transform function reference](/transforms/sql-transform/sql-functions) does **not** describe Analyze. A SQL transform runs inside a pipeline on Flink SQL; an analysis runs on the query engine over the data lake. The two support different functions, so a function listed there may not exist here, and the autocomplete offers functions that page does not list.
 
@@ -95,7 +108,7 @@ APPROX_PERCENTILE(@duration_ms, 0.95)
 CASE WHEN severity >= 4 THEN 'error' ELSE 'ok' END
 ```
 
-`SEVERITY_TEXT` names the OpenTelemetry severity bucket a severity number falls in: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR` or `FATAL`, and nothing for a log with no severity. It takes a whole number, so text and fractional operands are errors rather than values Grepr will quietly convert. Grouping by it is the usual way to count logs per level:
+`SEVERITY_TEXT` names the OpenTelemetry severity bucket a severity number falls in: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR` or `FATAL`, and nothing for a log with no severity. It takes a whole number, so cast an attribute before passing it. Grouping by it is the usual way to count logs per level:
 
 ```sql
 -- Under SELECT
@@ -107,7 +120,7 @@ SEVERITY_TEXT(severity)
 
 ## Name the results
 
-Every SELECT column takes an optional alias, entered in the **Alias** field beside the expression. The alias becomes the result column's name. Pick a tag from the suggestions and the alias is filled in with the tag's own key, since the expression that reads a tag is a call wrapped around it. Leave the alias empty and Grepr names the column after the expression itself:
+Every SELECT column takes an optional alias, entered in the **Alias** field beside the expression. The alias becomes the result column's name. Leave it empty and Grepr names the column after the expression itself:
 
 | Expression | Alias | Result column |
 | --- | --- | --- |
@@ -129,9 +142,9 @@ p95 / 1000
 
 Aliases are lowercase, made of letters, digits and underscores, up to 128 characters, and a reference has to match exactly.
 
-> The alias goes in its own field, not in the expression: writing `AS p95` inside an expression is rejected. An alias is available to GROUP BY, HAVING and ORDER BY, and to the SELECT columns after the one that defines it.
+> Enter the alias in its own field, not in the expression: `AS p95` inside an expression is not valid. An alias is available to GROUP BY, HAVING and ORDER BY, and to the SELECT columns after the one that defines it.
 
-Reserved SQL words cannot be aliases, because the query engine would read them as syntax. Log Explorer refuses one and suggests an alternative, which is why the default first column is `count0` rather than `count`. The same rule applies to an alias Grepr derives for you: a derived name that lands on a reserved word gains a `0`.
+Reserved SQL words cannot be aliases, because the query engine would read them as syntax. That is why the default first column is `count0` rather than `count`, and why a name Grepr derives for you gains a `0` when it lands on a reserved word.
 
 > `count`, `max`, `min`, `sum`, `value`, `date` and `year` are reserved. Ordinary field names such as `level`, `name`, `type`, `path`, `service`, `host` and `user` are not.
 
@@ -148,8 +161,6 @@ Each duration is a whole number of milliseconds, seconds, minutes, hours, or day
 
 Windows are aligned to the clock rather than to the start of your time range, so the first and last windows of a range can be partial.
 
-Setting a window puts `window_start` and `window_end` first among the result columns and sorts the analysis by `window_start` descending, so the newest window leads without any further setup. Both are yours to change: drag the columns elsewhere, or edit the sort. Removing the window removes the bound columns and drops the sorts that referred to them.
-
 In the API, the window is the `window` object of the structured analytics query, with ISO-8601 durations:
 
 ```json
@@ -160,7 +171,7 @@ In the API, the window is the `window` object of the structured analytics query,
 
 Click a column header to sort the rows you already have. No second run happens and no scan budget is spent; Shift-click adds a second sort instead of replacing the first.
 
-When an analysis comes back at its row limit, the rows you have are only the top of the ranking, so sorting them on the page can put the wrong rows first. The table says so and offers **Sort on the server**, which puts the sort into ORDER BY and runs the analysis again so the engine ranks every matching row.
+When an analysis comes back at its row limit, the rows you have are only the top of the ranking, so sorting them on the page can put the wrong rows first. **Sort on the server** puts the sort into ORDER BY and runs the analysis again, so the engine ranks every matching row.
 
 ## Share an analysis
 
@@ -168,8 +179,6 @@ The whole analysis lives in the page URL, so copying the link from the address b
 
 Opening such a link seats every control and runs the analysis once, so the recipient sees the rows rather than a filled-in form waiting for a click. Back and Forward move between analyses you have already run, restoring the controls without re-running and spending scan budget again.
 
-An analysis long enough to overflow the address bar cannot be carried, and Log Explorer says so rather than sharing a link that silently restores something different.
-
 ## Result values
 
 Each result row is a JSON object keyed by column name, so a column holds whatever the underlying attribute held, such as a number, a string, a boolean, or a nested object. Timestamps are returned as UTC ISO 8601 strings.
@@ -183,7 +192,7 @@ Each result row is a JSON object keyed by column name, so a column holds whateve
 * An analysis too long to fit in the address bar cannot be shared as a link.
 * An analysis can compute at most 128 values, group by at most 64 expressions, and sort by at most 64 expressions. Each expression can be at most 4,096 characters long.
 * A time window's size and slide are whole milliseconds, and a sliding window covers at most 100 slides. `window_start` and `window_end` cannot be used as result aliases while a window is set.
-* Row, array, and map values are converted to nested JSON automatically. A column is rejected with an error that names it only if its value type has no JSON representation at all, or a constructed row has two fields with the same name.
+* Row, array, and map values are converted to nested JSON automatically. A value whose type has no JSON representation at all, or a constructed row with two fields of the same name, cannot be returned.
 
 ## Frequently Asked Questions
 
@@ -201,7 +210,7 @@ Add a time window under the grouping expressions in Analyze mode. Choose tumblin
 
 ### How many rows can an analysis return?
 
-An analysis returns 2,500 rows by default. The largest limit you can ask for is set by your deployment; asking for more is refused with a message naming the maximum.
+An analysis returns 2,500 rows by default. The largest limit you can ask for is set by your deployment.
 
 ### How do I share a Grepr analysis?
 
@@ -209,7 +218,7 @@ Copy the page URL. The link carries the dataset, time range, query, every expres
 
 ### Why can't I name a result column count?
 
-count is a reserved SQL word, so the query engine would read it as syntax rather than as an alias. Log Explorer suggests count0 instead, which is also why the default first column is named count0.
+count is a reserved SQL word, so the query engine would read it as syntax rather than as an alias. Name the column count0 or anything else that is not reserved; that is why the default first column is named count0.
 
 ### How do I turn severity numbers into names in Grepr?
 
@@ -217,4 +226,4 @@ Use SEVERITY_TEXT(severity), which names the OpenTelemetry bucket: TRACE, DEBUG,
 
 ### How do I sort an analysis by a result column?
 
-Click the column header in the results table. The rows on the page reorder immediately, without a second run. If the analysis returned its row limit, the table offers Sort on the server, which puts the sort into ORDER BY and runs the analysis again.
+Click the column header in the results table. The rows on the page reorder immediately, without a second run. If the analysis returned its row limit, use Sort on the server, which puts the sort into ORDER BY and runs the analysis again.

package/build/dist/docs-index/{b1c916e0-2ad1-4a72-b301-ac77280eca5d.txt → e6f94df7-51ee-4353-9c70-83b3e182129d.txt}

@@ -4,6 +4,8 @@
 
 **Operation ID**: `list_3`
 **Summary**: List skills
+## Tags
+- Skills
 ## Parameters
 
 - **query** (optional) - query

package/build/dist/docs-index/e891d3f9-80a2-4142-af06-c3399bf71995.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/{c770124a-829c-4ee7-be2c-1767ce5f68df.txt → e891d3f9-80a2-4142-af06-c3399bf71995.txt}

@@ -10,10 +10,13 @@ You can use the Grepr UI or the REST API to create and manage integrations. To u
 
 ## Integration types
 
-The Grepr platform includes two integration types:
+The Grepr platform includes the following integration types:
 
 * Observability platform integrations: Connections to monitoring, logging, and APM platforms, such as Datadog, Splunk, New Relic, and Sumo Logic.
 * Cloud storage integrations: Connections to cloud storage. The Grepr data lake uses cloud storage to store your raw data and metadata.
+* AI integrations: Connections that Grepr AI agents use, covering the model providers they reason with, the MCP servers they call, the webhook endpoints that trigger them, and the vector indexes that store their memories. See [Supported AI integrations](#ai-integrations).
+
+Observability platform and cloud storage integrations become the sources and sinks of your pipelines. AI integrations are used by AI agents instead, so they are not selectable as a pipeline source or sink.
 
 ## Supported platform and storage integrations \[#supported-integrations]
 
@@ -75,6 +78,34 @@ To configure the Grepr-hosted integration, you only need to assign a name to the
 
 Using the integration with your own S3 bucket requires that you deploy and configure an S3 bucket in your AWS account, but it provides more control over your data. See [Host a Grepr data lake with the Amazon S3 integration](/integrations/aws-s3).
 
+## Supported AI integrations \[#ai-integrations]
+
+The following integrations support Grepr AI agents. They appear on the **Integrations** page only when AI agents are enabled for your organization. To turn on AI agents, contact <support@grepr.ai>. To learn what AI agents do, see [_](/ai-agents).
+
+### LLM providers
+
+An LLM integration holds the credentials for a large language model provider. Grepr AI agents use generative models for reasoning and embedding models for memories.
+
+See [_](/integrations/llm).
+
+### MCP servers
+
+An MCP integration connects Grepr to a MCP server run by another system, so an agent can call that system's tools during an investigation. You set each integration's server URL, so you can point one at a self-hosted or regional endpoint.
+
+See [_](/integrations/mcp).
+
+### Grepr Agent webhooks
+
+A Grepr Agent integration is a webhook endpoint that turns events from another system, such as an alerting platform or a Kubernetes event forwarder, into AI agent investigations.
+
+See [_](/integrations/grepr-agent-webhooks).
+
+### Vector indexes
+
+A vector index integration stores the search index for agent memory, which is what lets an agent find past investigations that reached a similar conclusion. You create one in the **S3 Vector Index** section of the **Integrations** page.
+
+See [_](/ai-agents/memory#vector-index).
+
 ## Manage integrations in the Grepr UI \[#manage-integrations-in-ui]
 
 The **Integrations** page displays your integrations as cards, organized by observability vendor integrations and storage integrations. In each section, cards are ordered by recent activity, with the most active integrations appearing first.

package/build/dist/docs-index/eaeb8a3f-8680-4759-9f1c-fdef246c0056.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/{603b3003-8362-4099-9d8c-b8144cd77d36.txt → eaeb8a3f-8680-4759-9f1c-fdef246c0056.txt}

@@ -43,6 +43,21 @@ This table lists all available permissions for organization and team-level roles
 | Edit | Datasets | Organization or Team |
 | View | Datasets | Organization or Team |
 
+## Permissions for AI agent resources \[#ai-agent-permissions]
+
+AI agents, skills, and agent memory do not have permissions of their own. They are governed by the permissions already in the table:
+
+| To do this | You need |
+| --- | --- |
+| View an agent, its investigations, or its skills | View on integrations |
+| Create, edit, or delete an agent or an organization skill | Edit on integrations |
+| Create or edit an LLM, MCP, or Grepr Agent integration | Edit on integrations |
+| Subscribe an agent to a pipeline, or unsubscribe it | Edit on jobs |
+| View the pipeline changes an agent proposed | View on jobs |
+| Apply or reject a pipeline change an agent proposed | Edit on jobs |
+
+An agent's own reach is separate from yours. An agent acts as the service account you assign it, and that account's roles cap what the agent can read and change, whatever tools it holds. To learn more, see [_](/ai-agents/capabilities#service-account).
+
 ## Permissions by role
 
 The following are the permissions granted to each role type in the Grepr platform:

package/build/dist/docs-index/{165e2c41-e371-40d3-a7b6-489d044f1059.txt → eb2e1a0d-e070-4906-9ed0-09c77c4a9c8b.txt}

@@ -4,6 +4,8 @@
 
 **Operation ID**: `create_2`
 **Summary**: Create an organization skill
+## Tags
+- Skills
 ## Request Body
 
 **Content-Type**: `application/json`

package/build/dist/docs-index/ecbe9b08-6687-4187-85f9-0d9e234fbd90.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/ef8be805-76b3-4c0e-98c4-de6ced921df6.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/{f4815d14-3f6c-489a-a657-ed9b81b4505e.txt → ef8be805-76b3-4c0e-98c4-de6ced921df6.txt}

@@ -10,6 +10,10 @@ An example of a pipeline is a log or trace reduction pipeline that reduces the v
 
 Trace reduction pipelines process the APM data produced by your applications and agents by applying configured transformations, sampling to create representative subsets of the data, and forwarding the results to your observability platform. Grepr uses a novel approach to identify and sample every path through your system. Sampling reduces the volume and cost of data sent to your observability platform, while the complete set of raw traces is retained in a Grepr data lake. If you use Datadog, you can also derive and forward metrics from your trace data to track trends across your traces without forwarding every trace. See [_](/pipelines/trace-pipelines).
 
+## AI agent signals and suggestions
+
+A log reduction pipeline can report each newly detected log pattern to your Grepr AI agents, so an agent investigates behavior that is new in your systems. An agent can also propose a change to the pipeline it investigated, such as a new Grok parser or an added SQL transform, which appears on the pipeline's **Suggestions** step for you to review and apply. To turn on signals, see [_](/transforms/reducer/configuration#agent-signals). To review a proposed change, see [_](/ai-agents/investigations#suggestions).
+
 ## Agent sessions pipelines
 
 Agent sessions pipelines process the telemetry produced by coding agents such as Claude Code, Codex, and OpenCode. A coding agent reports its conversation as OpenTelemetry log events and its execution as OpenTelemetry spans, and neither signal is readable as a session on its own. An agent sessions pipeline reads both signals, reconstructs each run into a single session, and stores it in a Grepr data lake, so you can read the transcript, measure the tokens and cost the run consumed, and find the runs that failed. See [_](/pipelines/agent-sessions).

package/build/dist/docs-index/f0b6ab5b-1c1a-41c1-8761-072da18acac3.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/f98d64fc-af78-45b8-bd95-9a7f10f0571f.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/f9b7b2f4-4d60-43ed-be72-a9609e9d6c16.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/{690773cd-592b-4e9d-9b0e-749349181316.txt → f9b7b2f4-4d60-43ed-be72-a9609e9d6c16.txt}

@@ -440,6 +440,7 @@ The Grepr CLI includes commands to:
 * Manage datasets for log storage and querying: `dataset:create`, `dataset:list`, `dataset:get`, `dataset:update`, `dataset:delete`.
 * Search and retrieve Grepr documentation: `docs:search`, `docs:get`.
 * Test Grok rules: `grok:parse`.
+* Read AI agents and their investigations: `agent:list`, `agent:get`, `investigation:list`, `investigation:get`, `investigation:turns`, `investigation:transcript`, `investigation:memory:search`.
 
 The following sections contain examples demonstrating how to use these commands. Most of these examples assume you have already saved a default configuration. If you haven't saved a default configuration, include the `--conf` option to specify a saved configuration when you run CLI commands. To learn how to create a default configuration, see [Configure the Grepr CLI](#cli-configuration).
 
@@ -951,6 +952,81 @@ grepr grok:parse \
   --helper-rules "CUSTOM_TIMESTAMP %{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}" "SEVERITY (CRITICAL|ERROR|WARN|INFO|DEBUG)"
 ```
 
+## Examples: AI agent and investigation commands \[#agent-command-examples]
+
+Use these commands to read your AI agents, the investigations they ran, and the conclusions they recorded. The commands are read-only: you create and configure agents in the Grepr UI or through the REST API. To learn what agents are, see [_](/ai-agents).
+
+### List agents
+
+```console
+# List the agents in your organization, with their identifiers
+grepr agent:list
+```
+
+```console
+# Get one agent's configuration and its aggregate metrics
+grepr agent:get <agent-id>
+```
+
+The configuration `agent:get` returns is the agent's configuration now, which is not necessarily the configuration an older investigation ran under.
+
+### List and read investigations
+
+```console
+# List an agent's investigations
+grepr investigation:list --agent-id <agent-id> --page-size 10
+```
+
+```console
+# List only the failed investigations, repeating --status to include more states
+grepr investigation:list --agent-id <agent-id> --status FAILED --status DISCARDED
+```
+
+```console
+# Read one investigation's metadata, summary, and the changes it made
+grepr investigation:get <investigation-id>
+```
+
+```console
+# Read the turns of an investigation, including tool calls and their results
+grepr investigation:turns <investigation-id> --page-size 10
+```
+
+To page through turns, pass the last sequence number you read to `--after-seq`. To follow a running investigation as it progresses, add `--follow`, which stops when the investigation pauses, reaches a terminal state, or hits the deadline. To learn what each investigation state means, see [_](/ai-agents/investigations#states).
+
+### Export a transcript
+
+```console
+# Export up to 50 turns to a file
+grepr investigation:transcript <investigation-id> --output investigation.json
+```
+
+```console
+# Export every turn, allowing more time for a long investigation
+grepr investigation:transcript <investigation-id> --all --timeout 5m
+```
+
+An export reports its own coverage, so check that before you treat one as complete.
+
+### Search agent memories
+
+```console
+# Find investigations mentioning a literal string
+grepr investigation:memory:search --mode text --query "connection refused" --limit 5
+```
+
+```console
+# Find investigations whose conclusions are similar in meaning
+grepr investigation:memory:search --mode semantic --agent-id <agent-id> --query "intermittent ingestion failures"
+```
+
+```console
+# See what has been happening to one service lately
+grepr investigation:memory:search --mode timeline --entity-tag entity:service=checkout
+```
+
+A semantic search needs an agent id, because a query can only be compared inside the index that agent embeds into. A timeline search needs at least one entity tag. To learn what memories hold and how the modes differ, see [_](/ai-agents/memory#search-modes).
+
 ## Examples: Documentation commands
 
 Use the CLI documentation commands to perform semantic searches of the Grepr documentation and retrieve documentation content. The CLI commands allow you to find and read relevant information without leaving the terminal, and can be particularly useful for tasks like working with AI assistants or scripting workflows.

package/build/dist/docs-index/f9dbf0cc-1986-4904-afc4-2015e7060e88.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/{32634c48-9d42-46ab-8a0b-31550f3a89ec.txt → fbba5164-88f5-4e69-ab74-627f35e48c9e.txt}

@@ -11,7 +11,7 @@
   type: `ReadOrgConstraints`
 
 - name: featureFlags (optional)
-  type: array of enum: `DATADOG_BROWSER_LOGS_INTEGRATION`, `METRICS_SOURCE`, `S3_LOGS_FILE_SOURCE`, `PIPELINE_TEMPLATES`, `AI_WORKFLOWS`, `SEARCH_ICEBERG_SOURCE`, `QUERY_JOBS`, `AUTH0_SSO_CONNECTION`, `TRINO_QUERY_ENGINE`, `UNKNOWN`
+  type: array of enum: `DATADOG_BROWSER_LOGS_INTEGRATION`, `METRICS_SOURCE`, `S3_LOGS_FILE_SOURCE`, `PIPELINE_TEMPLATES`, `AI_WORKFLOWS`, `SEARCH_ICEBERG_SOURCE`, `MULTI_GROK_PARSER`, `AUTH0_SSO_CONNECTION`, `TRINO_QUERY_ENGINE`, `UNKNOWN`
 
 - name: name (required)
   type: string

package/build/dist/docs-index/fc0778ee-567a-4eda-94c9-c7d0bc4ed54d.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/fc5316de-b218-478e-b647-7fc56072cb7c.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/fe0608a7-13bb-418c-b3fe-0c5e0c25ca2e.json

@@ -0,0 +1 @@
+{"docType":"schema"}

package/build/dist/docs-index/fe230d2f-a93b-41a8-8904-119de67e463a.json

@@ -0,0 +1 @@
+{"docType":"api"}

package/build/dist/docs-index/fe4c32b1-4d14-4afc-8cf4-ea532930bc2e.json

@@ -0,0 +1 @@
+{"docType":"schema"}

package/build/dist/docs-index/fe60af94-adc2-4fdb-b3a3-e1fa7533afa6.json

@@ -0,0 +1 @@
+{"docType":"api"}

package/build/dist/docs-index/fec294a1-4d49-43b6-a2e0-84c6d707ad3a.json

@@ -0,0 +1 @@
+{"docType":"api"}

package/build/dist/docs-index/fed85588-5c19-40ba-96a1-c84d38a37f60.json

@@ -0,0 +1 @@
+{"docType":"doc"}

package/build/dist/docs-index/fff6a7f8-1076-42e1-970d-359f1d7a287b.json

@@ -0,0 +1 @@
+{"docType":"api"}