@sweny-ai/providers 0.2.0

package/dist/observability/cloudwatch.js

@@ -0,0 +1,182 @@
+import { z } from "zod";
+import { consoleLogger } from "../logger.js";
+import { ProviderApiError } from "../errors.js";
+export const cloudwatchConfigSchema = z.object({
+    region: z.string().default("us-east-1"),
+    logGroupPrefix: z.string().min(1, "CloudWatch log group prefix is required"),
+    logger: z.custom().optional(),
+});
+export function cloudwatch(config) {
+    const parsed = cloudwatchConfigSchema.parse(config);
+    return new CloudWatchProvider(parsed);
+}
+function parseTimeRange(timeRange) {
+    const match = timeRange.match(/^(\d+)(m|h|d)$/);
+    if (!match)
+        throw new Error(`Invalid time range: ${timeRange}`);
+    const [, value, unit] = match;
+    const ms = { m: 60_000, h: 3_600_000, d: 86_400_000 };
+    return parseInt(value, 10) * ms[unit];
+}
+class CloudWatchProvider {
+    region;
+    logGroupPrefix;
+    log;
+    client;
+    constructor(config) {
+        this.region = config.region;
+        this.logGroupPrefix = config.logGroupPrefix;
+        this.log = config.logger ?? consoleLogger;
+    }
+    async getClient() {
+        if (!this.client) {
+            const { CloudWatchLogsClient } = await import("@aws-sdk/client-cloudwatch-logs");
+            this.client = new CloudWatchLogsClient({ region: this.region });
+        }
+        return this.client;
+    }
+    async verifyAccess() {
+        this.log.info(`Verifying CloudWatch access (region: ${this.region})`);
+        const client = (await this.getClient());
+        const { DescribeLogGroupsCommand } = await import("@aws-sdk/client-cloudwatch-logs");
+        await client.send(new DescribeLogGroupsCommand({
+            logGroupNamePrefix: this.logGroupPrefix,
+            limit: 1,
+        }));
+        this.log.info("CloudWatch access verified");
+    }
+    async queryLogs(opts) {
+        this.log.info(`Querying CloudWatch logs (range: ${opts.timeRange}, severity: ${opts.severity})`);
+        const client = (await this.getClient());
+        const { StartQueryCommand, GetQueryResultsCommand } = await import("@aws-sdk/client-cloudwatch-logs");
+        const endTime = Date.now();
+        const startTime = endTime - parseTimeRange(opts.timeRange);
+        const serviceFilter = opts.serviceFilter && opts.serviceFilter !== "*" ? `| filter @logStream like /${opts.serviceFilter}/` : "";
+        const queryString = `fields @timestamp, @message, @logStream
+      ${serviceFilter}
+      | filter @message like /(?i)${opts.severity}/
+      | sort @timestamp desc
+      | limit 100`;
+        const startResult = await client.send(new StartQueryCommand({
+            logGroupName: this.logGroupPrefix,
+            startTime: Math.floor(startTime / 1000),
+            endTime: Math.floor(endTime / 1000),
+            queryString,
+        }));
+        const queryId = startResult.queryId;
+        if (!queryId)
+            throw new ProviderApiError("CloudWatch", 0, "StartQuery did not return a queryId", "");
+        // Poll for results
+        let results = [];
+        for (let i = 0; i < 30; i++) {
+            await new Promise((r) => setTimeout(r, 1000));
+            const queryResult = await client.send(new GetQueryResultsCommand({ queryId }));
+            if (queryResult.status === "Complete") {
+                results = queryResult.results ?? [];
+                break;
+            }
+        }
+        const logs = results.map((row) => {
+            const fields = Object.fromEntries(row.map((f) => [f.field, f.value]));
+            return {
+                timestamp: fields["@timestamp"] || "",
+                service: fields["@logStream"] || "unknown",
+                level: opts.severity,
+                message: fields["@message"] || "",
+                attributes: {},
+            };
+        });
+        this.log.info(`Found ${logs.length} CloudWatch log entries`);
+        return logs;
+    }
+    getAgentEnv() {
+        return {
+            AWS_REGION: this.region,
+            CW_LOG_GROUP_PREFIX: this.logGroupPrefix,
+        };
+    }
+    getPromptInstructions() {
+        return `### CloudWatch Logs Insights
+- \`AWS_REGION\` - AWS region (${this.region})
+- \`CW_LOG_GROUP_PREFIX\` - Log group prefix (${this.logGroupPrefix})
+
+**DO NOT make up data** - only use real data from APIs. If no data, report that honestly.
+
+Investigate logs from CloudWatch Logs across **BOTH production AND staging environments** to find bugs and issues.
+You have DIRECT ACCESS to AWS CloudWatch Logs via the AWS CLI.
+
+**Key Insight**: Catching issues in staging BEFORE they hit production is extremely valuable!
+- Issues in staging only → Fix before users are affected
+- Issues in both environments → Critical, affects users now
+- Issues in production only → May be load/scale related
+
+AWS credentials are configured via the standard AWS credential chain (environment variables or instance profile).
+
+#### Example: Start a Logs Insights query
+\`\`\`bash
+aws logs start-query \\
+  --log-group-name "\${CW_LOG_GROUP_PREFIX}" \\
+  --start-time $(date -d '-1 hour' +%s) \\
+  --end-time $(date +%s) \\
+  --query-string 'fields @timestamp, @message | filter @message like /(?i)error/ | sort @timestamp desc | limit 100' \\
+  --region "\${AWS_REGION}"
+\`\`\`
+
+#### Example: Get query results
+\`\`\`bash
+aws logs get-query-results --query-id "<query-id>" --region "\${AWS_REGION}"
+\`\`\`
+
+#### Example: Get error counts by log stream
+\`\`\`bash
+aws logs start-query \\
+  --log-group-name "\${CW_LOG_GROUP_PREFIX}" \\
+  --start-time $(date -d '-1 hour' +%s) \\
+  --end-time $(date +%s) \\
+  --query-string 'filter @message like /(?i)error/ | stats count(*) as errorCount by @logStream | sort errorCount desc | limit 20' \\
+  --region "\${AWS_REGION}"
+\`\`\``;
+    }
+    async aggregate(opts) {
+        this.log.info(`Aggregating CloudWatch errors (range: ${opts.timeRange})`);
+        const client = (await this.getClient());
+        const { StartQueryCommand, GetQueryResultsCommand } = await import("@aws-sdk/client-cloudwatch-logs");
+        const endTime = Date.now();
+        const startTime = endTime - parseTimeRange(opts.timeRange);
+        const serviceFilter = opts.serviceFilter && opts.serviceFilter !== "*" ? `| filter @logStream like /${opts.serviceFilter}/` : "";
+        const queryString = `fields @logStream
+      ${serviceFilter}
+      | filter @message like /(?i)error/
+      | stats count(*) as errorCount by @logStream
+      | sort errorCount desc
+      | limit 20`;
+        const startResult = await client.send(new StartQueryCommand({
+            logGroupName: this.logGroupPrefix,
+            startTime: Math.floor(startTime / 1000),
+            endTime: Math.floor(endTime / 1000),
+            queryString,
+        }));
+        const queryId = startResult.queryId;
+        if (!queryId)
+            throw new ProviderApiError("CloudWatch", 0, "StartQuery did not return a queryId", "");
+        let results = [];
+        for (let i = 0; i < 30; i++) {
+            await new Promise((r) => setTimeout(r, 1000));
+            const queryResult = await client.send(new GetQueryResultsCommand({ queryId }));
+            if (queryResult.status === "Complete") {
+                results = queryResult.results ?? [];
+                break;
+            }
+        }
+        const groups = results.map((row) => {
+            const fields = Object.fromEntries(row.map((f) => [f.field, f.value]));
+            return {
+                service: fields["@logStream"] || "unknown",
+                count: parseInt(fields["errorCount"] || "0", 10),
+            };
+        });
+        this.log.info(`Aggregated ${groups.length} service groups`);
+        return groups;
+    }
+}
+//# sourceMappingURL=cloudwatch.js.map

package/dist/observability/cloudwatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudwatch.js","sourceRoot":"","sources":["../../src/observability/cloudwatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,yCAAyC,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAU,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAIH,MAAM,UAAU,UAAU,CAAC,MAAwB;IACjD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAC9B,MAAM,EAAE,GAA2B,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;IAC9E,OAAO,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,kBAAkB;IACL,MAAM,CAAS;IACf,cAAc,CAAS;IACvB,GAAG,CAAS;IACrB,MAAM,CAAU;IAExB,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,aAAa,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wCAAwC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAEtE,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAmE,CAAC;QAC1G,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAErF,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,wBAAwB,CAAC;YAC3B,kBAAkB,EAAE,IAAI,CAAC,cAAc;YACvC,KAAK,EAAE,CAAC;SACT,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAqB;QACnC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,SAAS,eAAe,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAEjG,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAmE,CAAC;QAC1G,MAAM,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAEtG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE3D,MAAM,aAAa,GACjB,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,KAAK,GAAG,CAAC,CAAC,CAAC,6BAA6B,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7G,MAAM,WAAW,GAAG;QAChB,aAAa;oCACe,IAAI,CAAC,QAAQ;;kBAE/B,CAAC;QAEf,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CACnC,IAAI,iBAAiB,CAAC;YACpB,YAAY,EAAE,IAAI,CAAC,cAAc;YACjC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;YACvC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,WAAW;SACZ,CAAC,CACH,CAAC;QAEF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,YAAY,EAAE,CAAC,EAAE,qCAAqC,EAAE,EAAE,CAAC,CAAC;QAErG,mBAAmB;QACnB,IAAI,OAAO,GAAqD,EAAE,CAAC;QACnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,GAAG,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC;gBACpC,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAe,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;gBACrC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC1C,KAAK,EAAE,IAAI,CAAC,QAAQ;gBACpB,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;gBACjC,UAAU,EAAE,EAAE;aACf,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,yBAAyB,CAAC,CAAC;QAE7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW;QACT,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,mBAAmB,EAAE,IAAI,CAAC,cAAc;SACzC,CAAC;IACJ,CAAC;IAED,qBAAqB;QACnB,OAAO;iCACsB,IAAI,CAAC,MAAM;gDACI,IAAI,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqC5D,CAAC;IACN,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAuC;QACrD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yCAAyC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAmE,CAAC;QAC1G,MAAM,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAEtG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE3D,MAAM,aAAa,GACjB,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,KAAK,GAAG,CAAC,CAAC,CAAC,6BAA6B,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7G,MAAM,WAAW,GAAG;QAChB,aAAa;;;;iBAIJ,CAAC;QAEd,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CACnC,IAAI,iBAAiB,CAAC;YACpB,YAAY,EAAE,IAAI,CAAC,cAAc;YACjC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;YACvC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,WAAW;SACZ,CAAC,CACH,CAAC;QAEF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,YAAY,EAAE,CAAC,EAAE,qCAAqC,EAAE,EAAE,CAAC,CAAC;QAErG,IAAI,OAAO,GAAqD,EAAE,CAAC;QACnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,GAAG,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC;gBACpC,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAsB,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACpD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC1C,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;aACjD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAE5D,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/observability/datadog.d.ts

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import type { Logger } from "../logger.js";
+import type { ObservabilityProvider } from "./types.js";
+export declare const datadogConfigSchema: z.ZodObject<{
+    apiKey: z.ZodString;
+    appKey: z.ZodString;
+    site: z.ZodDefault<z.ZodString>;
+    logger: z.ZodOptional<z.ZodType<Logger, z.ZodTypeDef, Logger>>;
+}, "strip", z.ZodTypeAny, {
+    apiKey: string;
+    appKey: string;
+    site: string;
+    logger?: Logger | undefined;
+}, {
+    apiKey: string;
+    appKey: string;
+    site?: string | undefined;
+    logger?: Logger | undefined;
+}>;
+export type DatadogConfig = z.infer<typeof datadogConfigSchema>;
+export declare function datadog(config: DatadogConfig): ObservabilityProvider;
+//# sourceMappingURL=datadog.d.ts.map

package/dist/observability/datadog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"datadog.d.ts","sourceRoot":"","sources":["../../src/observability/datadog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,EAAE,qBAAqB,EAA8C,MAAM,YAAY,CAAC;AAEpG,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,wBAAgB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,qBAAqB,CAGpE"}

package/dist/observability/datadog.js

@@ -0,0 +1,139 @@
+import { z } from "zod";
+import { consoleLogger } from "../logger.js";
+import { ProviderApiError } from "../errors.js";
+export const datadogConfigSchema = z.object({
+    apiKey: z.string().min(1, "Datadog API key is required"),
+    appKey: z.string().min(1, "Datadog Application key is required"),
+    site: z.string().default("datadoghq.com"),
+    logger: z.custom().optional(),
+});
+export function datadog(config) {
+    const parsed = datadogConfigSchema.parse(config);
+    return new DatadogProvider(parsed);
+}
+class DatadogProvider {
+    apiKey;
+    appKey;
+    site;
+    log;
+    constructor(config) {
+        this.apiKey = config.apiKey;
+        this.appKey = config.appKey;
+        this.site = config.site;
+        this.log = config.logger ?? consoleLogger;
+    }
+    async request(path, body) {
+        const url = `https://api.${this.site}${path}`;
+        const response = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "DD-API-KEY": this.apiKey,
+                "DD-APPLICATION-KEY": this.appKey,
+            },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            const body = await response.text().catch(() => "");
+            throw new ProviderApiError("Datadog", response.status, response.statusText, body);
+        }
+        return (await response.json());
+    }
+    async verifyAccess() {
+        this.log.info(`Verifying Datadog access (site: ${this.site})`);
+        await this.request("/api/v2/logs/analytics/aggregate", {
+            filter: { query: "*", from: "now-5m", to: "now" },
+            compute: [{ type: "total", aggregation: "count" }],
+        });
+        this.log.info("Datadog API access verified");
+    }
+    async queryLogs(opts) {
+        const query = `service:${opts.serviceFilter} status:${opts.severity}`;
+        this.log.info(`Querying Datadog logs: ${query} (range: ${opts.timeRange})`);
+        const result = await this.request("/api/v2/logs/events/search", {
+            filter: { query, from: `now-${opts.timeRange}`, to: "now" },
+            sort: "-timestamp",
+            page: { limit: 100 },
+        });
+        const logs = (result.data || []).map((entry) => ({
+            timestamp: entry.attributes?.timestamp || "",
+            service: entry.attributes?.service || "",
+            level: entry.attributes?.status || "",
+            message: entry.attributes?.message || "",
+            attributes: entry.attributes?.attributes || {},
+        }));
+        this.log.info(`Found ${logs.length} ${opts.severity} logs for ${opts.serviceFilter} in last ${opts.timeRange}`);
+        return logs;
+    }
+    getAgentEnv() {
+        return {
+            DD_API_KEY: this.apiKey,
+            DD_APP_KEY: this.appKey,
+            DD_SITE: this.site,
+        };
+    }
+    getPromptInstructions() {
+        return `### Datadog Logs API
+- \`DD_API_KEY\` - API key (use in DD-API-KEY header)
+- \`DD_APP_KEY\` - Application key (use in DD-APPLICATION-KEY header)
+- \`DD_SITE\` - Datadog site (${this.site})
+
+**DO NOT make up data** - only use real data from APIs. If no data, report that honestly.
+
+Investigate logs from Datadog across **BOTH production AND staging environments** to find bugs and issues.
+You have DIRECT ACCESS to Datadog's Logs API via curl commands.
+
+**Key Insight**: Catching issues in staging BEFORE they hit production is extremely valuable!
+- Issues in staging only → Fix before users are affected
+- Issues in both environments → Critical, affects users now
+- Issues in production only → May be load/scale related
+
+Use these environment variables in your curl commands:
+- \`DD_API_KEY\` - API key (use in DD-API-KEY header)
+- \`DD_APP_KEY\` - Application key (use in DD-APPLICATION-KEY header)
+- \`DD_SITE\` - Datadog site (${this.site})
+
+#### Example: Get error counts by service
+\`\`\`bash
+curl -s -X POST "https://api.\${DD_SITE}/api/v2/logs/analytics/aggregate" \\
+  -H "Content-Type: application/json" \\
+  -H "DD-API-KEY: \${DD_API_KEY}" \\
+  -H "DD-APPLICATION-KEY: \${DD_APP_KEY}" \\
+  -d '{"filter":{"query":"service:* status:error","from":"now-1h","to":"now"},"compute":[{"type":"total","aggregation":"count"}],"group_by":[{"facet":"service","limit":20,"sort":{"type":"measure","aggregation":"count","order":"desc"}}]}'
+\`\`\`
+
+#### Example: Get recent error logs
+\`\`\`bash
+curl -s -X POST "https://api.\${DD_SITE}/api/v2/logs/events/search" \\
+  -H "Content-Type: application/json" \\
+  -H "DD-API-KEY: \${DD_API_KEY}" \\
+  -H "DD-APPLICATION-KEY: \${DD_APP_KEY}" \\
+  -d '{"filter":{"query":"service:* status:error","from":"now-1h","to":"now"},"sort":"-timestamp","page":{"limit":100}}'
+\`\`\``;
+    }
+    async aggregate(opts) {
+        this.log.info(`Aggregating Datadog errors for ${opts.serviceFilter} (range: ${opts.timeRange})`);
+        const result = await this.request("/api/v2/logs/analytics/aggregate", {
+            filter: {
+                query: `service:${opts.serviceFilter} status:error`,
+                from: `now-${opts.timeRange}`,
+                to: "now",
+            },
+            compute: [{ type: "total", aggregation: "count" }],
+            group_by: [
+                {
+                    facet: "service",
+                    limit: 20,
+                    sort: { type: "measure", aggregation: "count", order: "desc" },
+                },
+            ],
+        });
+        const groups = (result.data?.buckets || []).map((bucket) => ({
+            service: bucket.by?.service || "unknown",
+            count: bucket.computes?.c0 || 0,
+        }));
+        this.log.info(`Aggregated ${groups.length} service groups`);
+        return groups;
+    }
+}
+//# sourceMappingURL=datadog.js.map

package/dist/observability/datadog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"datadog.js","sourceRoot":"","sources":["../../src/observability/datadog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,6BAA6B,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,qCAAqC,CAAC;IAChE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAU,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAIH,MAAM,UAAU,OAAO,CAAC,MAAqB;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,eAAe;IACF,MAAM,CAAS;IACf,MAAM,CAAS;IACf,IAAI,CAAS;IACb,GAAG,CAAS;IAE7B,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,aAAa,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,IAA6B;QAClE,MAAM,GAAG,GAAG,eAAe,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,IAAI,CAAC,MAAM;gBACzB,oBAAoB,EAAE,IAAI,CAAC,MAAM;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAmC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAE/D,MAAM,IAAI,CAAC,OAAO,CAAC,kCAAkC,EAAE;YACrD,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE;YACjD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAqB;QACnC,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC,aAAa,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,KAAK,YAAY,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAU9B,4BAA4B,EAAE;YAC/B,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE;YAC3D,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;SACrB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAe,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3D,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE;YAC5C,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE;YACxC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE;YACrC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE;YACxC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU,IAAI,EAAE;SAC/C,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,aAAa,IAAI,CAAC,aAAa,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAEhH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW;QACT,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,OAAO,EAAE,IAAI,CAAC,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,qBAAqB;QACnB,OAAO;;;gCAGqB,IAAI,CAAC,IAAI;;;;;;;;;;;;;;;gCAeT,IAAI,CAAC,IAAI;;;;;;;;;;;;;;;;;;OAkBlC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAuC;QACrD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,IAAI,CAAC,aAAa,YAAY,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QAEjG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAO9B,kCAAkC,EAAE;YACrC,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW,IAAI,CAAC,aAAa,eAAe;gBACnD,IAAI,EAAE,OAAO,IAAI,CAAC,SAAS,EAAE;gBAC7B,EAAE,EAAE,KAAK;aACV;YACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;YAClD,QAAQ,EAAE;gBACR;oBACE,KAAK,EAAE,SAAS;oBAChB,KAAK,EAAE,EAAE;oBACT,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE;iBAC/D;aACF;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9E,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,IAAI,SAAS;YACxC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;SAChC,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAE5D,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/observability/elastic.d.ts

@@ -0,0 +1,42 @@
+import { z } from "zod";
+import type { Logger } from "../logger.js";
+import type { ObservabilityProvider } from "./types.js";
+export declare const elasticConfigSchema: z.ZodEffects<z.ZodObject<{
+    baseUrl: z.ZodString;
+    apiKey: z.ZodOptional<z.ZodString>;
+    username: z.ZodOptional<z.ZodString>;
+    password: z.ZodOptional<z.ZodString>;
+    index: z.ZodDefault<z.ZodString>;
+    logger: z.ZodOptional<z.ZodType<Logger, z.ZodTypeDef, Logger>>;
+}, "strip", z.ZodTypeAny, {
+    baseUrl: string;
+    index: string;
+    apiKey?: string | undefined;
+    logger?: Logger | undefined;
+    username?: string | undefined;
+    password?: string | undefined;
+}, {
+    baseUrl: string;
+    apiKey?: string | undefined;
+    logger?: Logger | undefined;
+    index?: string | undefined;
+    username?: string | undefined;
+    password?: string | undefined;
+}>, {
+    baseUrl: string;
+    index: string;
+    apiKey?: string | undefined;
+    logger?: Logger | undefined;
+    username?: string | undefined;
+    password?: string | undefined;
+}, {
+    baseUrl: string;
+    apiKey?: string | undefined;
+    logger?: Logger | undefined;
+    index?: string | undefined;
+    username?: string | undefined;
+    password?: string | undefined;
+}>;
+export type ElasticConfig = z.infer<typeof elasticConfigSchema>;
+export declare function elastic(config: ElasticConfig): ObservabilityProvider;
+//# sourceMappingURL=elastic.d.ts.map

package/dist/observability/elastic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elastic.d.ts","sourceRoot":"","sources":["../../src/observability/elastic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,EAAE,qBAAqB,EAA8C,MAAM,YAAY,CAAC;AAEpG,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW5B,CAAC;AAEL,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,wBAAgB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,qBAAqB,CAGpE"}

package/dist/observability/elastic.js

@@ -0,0 +1,244 @@
+import { z } from "zod";
+import { consoleLogger } from "../logger.js";
+import { ProviderApiError } from "../errors.js";
+export const elasticConfigSchema = z
+    .object({
+    baseUrl: z.string().min(1, "Elasticsearch URL is required"),
+    apiKey: z.string().min(1).optional(),
+    username: z.string().min(1).optional(),
+    password: z.string().min(1).optional(),
+    index: z.string().default("logs-*"),
+    logger: z.custom().optional(),
+})
+    .refine((c) => c.apiKey || (c.username && c.password), {
+    message: "Either apiKey or both username and password must be provided",
+});
+export function elastic(config) {
+    const parsed = elasticConfigSchema.parse(config);
+    return new ElasticProvider(parsed);
+}
+/** Safely extract a string from an unknown value, returning undefined for non-strings. */
+function str(v) {
+    return typeof v === "string" ? v : undefined;
+}
+class ElasticProvider {
+    baseUrl;
+    apiKey;
+    username;
+    password;
+    index;
+    log;
+    constructor(config) {
+        this.baseUrl = config.baseUrl.replace(/\/+$/, "");
+        this.apiKey = config.apiKey;
+        this.username = config.username;
+        this.password = config.password;
+        this.index = config.index;
+        this.log = config.logger ?? consoleLogger;
+    }
+    authHeaders() {
+        if (this.apiKey) {
+            return { Authorization: `ApiKey ${this.apiKey}` };
+        }
+        const encoded = Buffer.from(`${this.username}:${this.password}`).toString("base64");
+        return { Authorization: `Basic ${encoded}` };
+    }
+    async request(method, path, body) {
+        const url = `${this.baseUrl}${path}`;
+        const response = await fetch(url, {
+            method,
+            headers: {
+                "Content-Type": "application/json",
+                ...this.authHeaders(),
+            },
+            ...(body ? { body: JSON.stringify(body) } : {}),
+        });
+        if (!response.ok) {
+            const body = await response.text().catch(() => "");
+            throw new ProviderApiError("Elasticsearch", response.status, response.statusText, body);
+        }
+        return (await response.json());
+    }
+    /**
+     * Convert time range strings like "1h", "24h", "7d" to Elasticsearch
+     * date math format "now-1h", "now-24h", "now-7d".
+     */
+    toElasticRange(timeRange) {
+        // Already in Elasticsearch format
+        if (timeRange.startsWith("now-")) {
+            return timeRange;
+        }
+        return `now-${timeRange}`;
+    }
+    async verifyAccess() {
+        this.log.info(`Verifying Elasticsearch access (${this.baseUrl})`);
+        const info = await this.request("GET", "/");
+        this.log.info(`Elasticsearch access verified (cluster: ${info.cluster_name ?? "unknown"}, version: ${info.version?.number ?? "unknown"})`);
+    }
+    async queryLogs(opts) {
+        this.log.info(`Querying Elasticsearch logs (severity: ${opts.severity}, range: ${opts.timeRange}, service: ${opts.serviceFilter})`);
+        const must = [
+            {
+                range: {
+                    "@timestamp": {
+                        gte: this.toElasticRange(opts.timeRange),
+                        lte: "now",
+                    },
+                },
+            },
+        ];
+        if (opts.severity && opts.severity !== "*") {
+            must.push({ match: { "log.level": opts.severity } });
+        }
+        if (opts.serviceFilter && opts.serviceFilter !== "*") {
+            must.push({
+                bool: {
+                    should: [{ match: { "service.name": opts.serviceFilter } }, { match: { "host.name": opts.serviceFilter } }],
+                    minimum_should_match: 1,
+                },
+            });
+        }
+        const result = await this.request("POST", `/${this.index}/_search`, {
+            size: 100,
+            sort: [{ "@timestamp": { order: "desc" } }],
+            query: {
+                bool: { must },
+            },
+        });
+        const hits = result.hits?.hits ?? [];
+        const logs = hits.map((hit) => {
+            const src = hit._source ?? {};
+            const service = str(src["service.name"]) ??
+                (src["service"] && typeof src["service"] === "object"
+                    ? str(src["service"]["name"])
+                    : undefined) ??
+                str(src["host.name"]) ??
+                (src["host"] && typeof src["host"] === "object"
+                    ? str(src["host"]["name"])
+                    : undefined) ??
+                "unknown";
+            const level = str(src["log.level"]) ??
+                (src["log"] && typeof src["log"] === "object"
+                    ? str(src["log"]["level"])
+                    : undefined) ??
+                "unknown";
+            return {
+                timestamp: str(src["@timestamp"]) ?? "",
+                service,
+                level,
+                message: str(src["message"]) ?? "",
+                attributes: src,
+            };
+        });
+        this.log.info(`Found ${logs.length} log entries`);
+        return logs;
+    }
+    async aggregate(opts) {
+        this.log.info(`Aggregating Elasticsearch logs (range: ${opts.timeRange}, service: ${opts.serviceFilter})`);
+        const must = [
+            {
+                range: {
+                    "@timestamp": {
+                        gte: this.toElasticRange(opts.timeRange),
+                        lte: "now",
+                    },
+                },
+            },
+        ];
+        if (opts.serviceFilter && opts.serviceFilter !== "*") {
+            must.push({
+                bool: {
+                    should: [{ match: { "service.name": opts.serviceFilter } }, { match: { "host.name": opts.serviceFilter } }],
+                    minimum_should_match: 1,
+                },
+            });
+        }
+        const result = await this.request("POST", `/${this.index}/_search`, {
+            size: 0,
+            query: {
+                bool: { must },
+            },
+            aggs: {
+                services: {
+                    terms: {
+                        field: "service.keyword",
+                        size: 50,
+                        order: { _count: "desc" },
+                    },
+                },
+            },
+        });
+        const buckets = result.aggregations?.services?.buckets ?? [];
+        const results = buckets.map((bucket) => ({
+            service: bucket.key,
+            count: bucket.doc_count,
+        }));
+        this.log.info(`Aggregated ${results.length} service groups`);
+        return results;
+    }
+    getAgentEnv() {
+        const env = {
+            ELASTIC_URL: this.baseUrl,
+            ELASTIC_INDEX: this.index,
+        };
+        if (this.apiKey) {
+            env.ELASTIC_API_KEY = this.apiKey;
+        }
+        else {
+            // Zod refine guarantees username+password exist when apiKey is absent
+            env.ELASTIC_USERNAME = this.username ?? "";
+            env.ELASTIC_PASSWORD = this.password ?? "";
+        }
+        return env;
+    }
+    getPromptInstructions() {
+        const authHeader = this.apiKey
+            ? `-H "Authorization: ApiKey \${ELASTIC_API_KEY}"`
+            : `-u "\${ELASTIC_USERNAME}:\${ELASTIC_PASSWORD}"`;
+        return `### Elasticsearch Logs API
+- \`ELASTIC_URL\` - Elasticsearch base URL (${this.baseUrl})
+- \`ELASTIC_INDEX\` - Index pattern (${this.index})
+${this.apiKey ? "- `ELASTIC_API_KEY` - API key for authentication" : "- `ELASTIC_USERNAME` / `ELASTIC_PASSWORD` - Basic auth credentials"}
+
+**DO NOT make up data** - only use real data from APIs. If no data, report that honestly.
+
+Investigate logs from Elasticsearch across **BOTH production AND staging environments** to find bugs and issues.
+You have DIRECT ACCESS to Elasticsearch's REST API via curl commands.
+
+**Key Insight**: Catching issues in staging BEFORE they hit production is extremely valuable!
+- Issues in staging only -> Fix before users are affected
+- Issues in both environments -> Critical, affects users now
+- Issues in production only -> May be load/scale related
+
+#### Example: Search for error logs in the last hour
+\`\`\`bash
+curl -s -X POST "\${ELASTIC_URL}/\${ELASTIC_INDEX}/_search" \\
+  -H "Content-Type: application/json" \\
+  ${authHeader} \\
+  -d '{"size":100,"sort":[{"@timestamp":{"order":"desc"}}],"query":{"bool":{"must":[{"range":{"@timestamp":{"gte":"now-1h","lte":"now"}}},{"match":{"log.level":"error"}}]}}}'
+\`\`\`
+
+#### Example: Aggregate log counts by service
+\`\`\`bash
+curl -s -X POST "\${ELASTIC_URL}/\${ELASTIC_INDEX}/_search" \\
+  -H "Content-Type: application/json" \\
+  ${authHeader} \\
+  -d '{"size":0,"query":{"bool":{"must":[{"range":{"@timestamp":{"gte":"now-24h","lte":"now"}}}]}},"aggs":{"services":{"terms":{"field":"service.keyword","size":50,"order":{"_count":"desc"}}}}}'
+\`\`\`
+
+#### Example: Filter logs by service name
+\`\`\`bash
+curl -s -X POST "\${ELASTIC_URL}/\${ELASTIC_INDEX}/_search" \\
+  -H "Content-Type: application/json" \\
+  ${authHeader} \\
+  -d '{"size":100,"sort":[{"@timestamp":{"order":"desc"}}],"query":{"bool":{"must":[{"range":{"@timestamp":{"gte":"now-1h","lte":"now"}}},{"match":{"service.name":"my-service"}}]}}}'
+\`\`\`
+
+#### Example: Get cluster health
+\`\`\`bash
+curl -s "\${ELASTIC_URL}/_cluster/health" \\
+  ${authHeader}
+\`\`\``;
+    }
+}
+//# sourceMappingURL=elastic.js.map