holmesgpt 0.14.3a0__py3-none-any.whl → 0.15.0__py3-none-any.whl

holmes/plugins/toolsets/opensearch/opensearch_query_assist.py

@@ -0,0 +1,78 @@
+import logging
+import os
+from typing import Any, Dict
+
+from holmes.core.tools import (
+    StructuredToolResult,
+    StructuredToolResultStatus,
+    Tool,
+    ToolParameter,
+    Toolset,
+    ToolsetTag,
+    ToolInvokeContext,
+    ToolsetEnvironmentPrerequisite,
+)
+
+
+class PplQueryAssistTool(Tool):
+    def __init__(self, toolset: "OpenSearchQueryAssistToolset"):
+        super().__init__(
+            name="opensearch_ppl_query_assist",
+            description="Generate valid OpenSearch Piped Processing Language (PPL) queries to suggest to users for execution",
+            parameters={
+                "query": ToolParameter(
+                    description="Valid OpenSearch Piped Processing Language (PPL) query to suggest to users for execution",
+                    type="string",
+                    required=True,
+                ),
+            },
+        )
+        self._toolset = toolset
+
+    def _invoke(self, params: dict, context: ToolInvokeContext) -> StructuredToolResult:
+        try:
+            query = params.get("query", "")
+            response_data = {"query": query}
+            return StructuredToolResult(
+                status=StructuredToolResultStatus.SUCCESS,
+                data=response_data,
+                params=params,
+            )
+
+        except Exception as e:
+            logging.exception(f"error using {self.name} tool")
+            return StructuredToolResult(
+                status=StructuredToolResultStatus.ERROR,
+                error=f"Failed to generate PPL query: {str(e)}",
+                params=params,
+            )
+
+    def get_parameterized_one_liner(self, params: Dict) -> str:
+        query = params.get("query", "")
+        return f"OpenSearchQueryToolset: Query ({query})"
+
+
+class OpenSearchQueryAssistToolset(Toolset):
+    """OpenSearch query assist with PPL queries"""
+
+    def __init__(self):
+        super().__init__(
+            name="opensearch/query_assist",
+            description="OpenSearch query assist with PPL queries.",
+            experimental=True,
+            icon_url="https://opensearch.org/assets/brand/PNG/Mark/opensearch_mark_default.png",
+            tools=[PplQueryAssistTool(self)],
+            tags=[ToolsetTag.CORE],
+            prerequisites=[ToolsetEnvironmentPrerequisite(env=["OPENSEARCH_URL"])],
+        )
+
+    def get_example_config(self) -> Dict[str, Any]:
+        return {"opensearch_url": "http://localhost:9200"}
+
+    def _reload_instructions(self):
+        template_file_path = os.path.abspath(
+            os.path.join(
+                os.path.dirname(__file__), "opensearch_query_assist_instructions.jinja2"
+            )
+        )
+        self._load_llm_instructions(jinja_template=f"file://{template_file_path}")

holmes/plugins/toolsets/opensearch/opensearch_query_assist_instructions.jinja2

@@ -0,0 +1,223 @@
+# Query Generation
+You have access to the opensearch_ppl_query_assist tool to help you generate your valid, accurate OpenSearch Piped Processing Language (PPL) queries.
+DO NOT PROVIDE INVALID QUERIES. ALWAYS CHECK YOUR QUERY WITH VALID QUERIES FIRST.
+
+Once a valid query is generated, you MUST provide a concise, but informative breakdown of each part of the query structure
+
+## CRITICAL: Query Intent Detection
+
+ALWAYS check if the user's question is about:
+
+* Log Analysis: Errors, warnings, messages, patterns, tool usage
+* Metrics Analysis: Performance, latency, throughput, resource usage
+* Time-based Analysis: "Last X hours/days", "recent", "today", "since"
+* Aggregation Requests: Count, sum, average, top, frequency
+* Troubleshooting: Issues, problems, failures, debugging
+
+If ANY of the above apply → Generate PPL query IMMEDIATELY and use the OpenSearch Dashboards Page State
+
+### Example GOOD response:
+I've retrieved your current query from the query bar `source=logs-otel-v1* | STAT count() BY severityText` and it
+appears there is a typo in "STAT", it should be "STATS". Below is the fixed query:
+```
+source=logs-otel-v1* | STATS count() BY severityText
+```
+
+
+## CRITICAL: OpenSearch Dashboards Page State
+User may be using this agent from OpenSearch Dashboards (OSD) for which provides the current page state.
+It may be included in the conversation history as a system message.
+
+IMPORTANT: YOU CAN USE THE CURRENT USE QUERY TO HELP ENHANCE/MODIFY/FIX/SUGGEST VALID QUERY USING THE SAME INDEX PATTERN
+REFER TO "Core PPL Commands" FOR SYNTAX
+
+```
+## OpenSearch PPL Query Language
+
+### PPL (Piped Processing Language) Overview
+PPL is OpenSearch's query language for analyzing logs, metrics, and traces. It uses a pipe-based syntax similar to Unix commands, processing data through sequential transformations.
+
+### Core PPL Commands
+
+**Data Source & Search:**
+- `source=<index>` or `search source=<index>` - Specify data source
+- `source=<cluster>:<index>` - Cross-cluster search
+- `| where <condition>` - Filter results
+- `| fields <field-list>` - Project specific fields
+- `| fields - <field-list>` - Exclude specific fields
+
+**Data Transformation:**
+- `| stats <aggregation> by <field>` - Aggregate data (count(), sum(), avg(), min(), max())
+- `| eval <field>=<expression>` - Create calculated fields
+- `| sort [+|-] <field>` - Sort results (+ ascending, - descending)
+- `| head <n>` - Return first n results
+- `| tail <n>` - Return last n results
+- `| dedup <field-list>` - Remove duplicates
+
+**Advanced Analysis:**
+- `| top [N] <field>` - Find most common values
+- `| rare [N] <field>` - Find least common values
+- `| parse <field> <regex>` - Extract fields using regex patterns
+- `| grok <field> <pattern>` - Parse using grok patterns
+- `| patterns <field> [SIMPLE_PATTERN|BRAIN]` - Extract log patterns
+
+**Time Series:**
+- `| trendline SMA(<period>, <field>)` - Calculate moving averages
+- `| fillnull with <value> in <fields>` - Replace null values
+
+**Joins & Lookups:**
+- `| join <table>` - Join with another dataset
+- `| lookup <table> <field>` - Enrich with lookup data (requires Calcite)
+
+**Pattern Extraction:**
+- `| patterns message BRAIN` - Semantic log pattern extraction
+- `| patterns new_field='extracted' pattern='[0-9]' message` - Custom regex patterns
+
+### PPL Query Examples for Observability
+
+**Error Analysis:**
+```ppl
+source=ai-agent-logs-*
+| where level="ERROR"
+| stats count() by message
+| sort - count
+```
+
+**Service Latency Analysis:**
+```ppl
+source=traces
+| where service="checkout"
+| stats avg(duration) as avg_latency, max(duration) as max_latency by endpoint
+| where avg_latency > 100
+```
+
+**Log Pattern Detection:**
+```ppl
+source=ai-agent-audit-logs-*
+| patterns message BRAIN
+| stats count() by patterns_field
+| top 10 patterns_field
+```
+
+**Time-based Aggregation:**
+```ppl
+source=metrics
+| eval hour=date_format(timestamp, 'HH')
+| stats avg(cpu_usage) by hour, host
+| sort hour
+```
+
+**Multi-field Correlation:**
+```ppl
+source=ai-agent-logs-*
+| parse message '.*thread_id=(?<tid>[^,]+).*run_id=(?<rid>[^,]+)'
+| stats count() by tid, rid, level
+| where count > 100
+```
+
+**Advanced PPL Query Patterns:**
+
+**Top N Analysis with Filtering:**
+```ppl
+source=ai-agent-logs-*
+| where timestamp >= now() - 1h
+| top 20 message by level
+| where level in ["ERROR", "WARN"]
+```
+
+**Deduplication and Unique Values:**
+```ppl
+source=ai-agent-audit-logs-*
+| dedup thread_id
+| fields thread_id, run_id, timestamp
+| sort - timestamp
+```
+
+**Fillnull for Missing Data Handling:**
+```ppl
+source=ai-agent-metrics-*
+| fillnull with 0 in cpu_usage, memory_usage
+| stats avg(cpu_usage) as avg_cpu, avg(memory_usage) as avg_mem by host
+```
+
+**Rare Events Detection:**
+```ppl
+source=ai-agent-logs-*
+| rare 10 error_code
+| where count < 5
+```
+
+**Field Extraction with Grok:**
+```ppl
+source=ai-agent-logs-*
+| grok message '%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:msg}'
+| stats count() by level
+```
+
+**Time Span Aggregations:**
+```ppl
+source=ai-agent-metrics-*
+| stats count() by span(timestamp, 5m) as time_bucket, status
+| where status != 200
+```
+
+**Eval with Conditional Logic:**
+```ppl
+source=ai-agent-logs-*
+| eval severity = case(
+    level = "ERROR", 1,
+    level = "WARN", 2,
+    level = "INFO", 3,
+    else = 4
+  )
+| stats count() by severity
+```
+
+**Join Operations (with Calcite enabled):**
+```ppl
+source=ai-agent-logs-*
+| join left=l right=r on l.thread_id = r.thread_id
+  [ source=ai-agent-audit-logs-* ]
+| fields l.timestamp, l.message, r.tool_name
+```
+
+**Subquery for Complex Filtering:**
+```ppl
+source=ai-agent-logs-*
+| where thread_id in [
+    source=ai-agent-audit-logs-*
+    | where tool_name = "opensearch__search"
+    | fields thread_id
+  ]
+```
+
+**Trendline for Moving Averages:**
+```ppl
+source=ai-agent-metrics-*
+| trendline SMA(5, cpu_usage) as cpu_trend
+| fields timestamp, cpu_usage, cpu_trend
+```
+
+### PPL Best Practices
+
+1. **Index Patterns**: Use wildcards for daily indices: `source=ai-agent-logs-*`
+2. **Field Extraction**: Use `parse` for structured logs, `patterns` for unstructured
+3. **Performance**: Apply `where` filters early in the pipeline
+4. **Aggregations**: Use `stats` before `sort` for better performance
+5. **Null Handling**: Use `fillnull` to handle missing data in calculations
+
+### OpenSearch Index Patterns (Current Environment)
+- `ai-agent-logs-YYYY.MM.DD` - Application logs
+- `ai-agent-audit-logs-YYYY.MM.DD` - Audit logs
+- `ai-agent-metrics-YYYY.MM.DD` - Prometheus metrics
+
+## Query Response Formatting
+You MUST respond with queries in the following format. `ppl` contains the valid ppl query
+```typescript
+query: {
+ ppl: string,
+}
+```
+
+## More PPL Queries
+{% include "opensearch_ppl_query_docs.jinja2" %}

holmes/plugins/toolsets/prometheus/prometheus.py

@@ -92,9 +92,12 @@ class PrometheusConfig(BaseModel):
     rules_cache_duration_seconds: Optional[int] = 1800  # 30 minutes
     additional_labels: Optional[Dict[str, str]] = None
     prometheus_ssl_enabled: bool = True
-    query_response_size_limit_pct: Optional[int] = (
-        2  # Limit the max number of tokens that a query result can take to proactively prevent token limit issues. Expressed in % of the model's context window
-    )
+
+    # Custom limit to the max number of tokens that a query result can take to proactively
+    #   prevent token limit issues. Expressed in % of the model's context window.
+    # This limit only overrides the global limit for all tools  (TOOL_MAX_ALLOCATED_CONTEXT_WINDOW_PCT)
+    #   if it is lower.
+    query_response_size_limit_pct: Optional[int] = None
 
     @field_validator("prometheus_url")
     def ensure_trailing_slash(cls, v: Optional[str]) -> Optional[str]:
@@ -1588,7 +1591,7 @@ class PrometheusToolset(Toolset):
                 )
 
         except Exception as e:
-            logging.exception("Failed to initialize Prometheus", exc_info=True)
+            logging.debug("Failed to initialize Prometheus", exc_info=True)
             return (
                 False,
                 f"Failed to initialize using url={url}. Unexpected error: {str(e)}",

holmes/plugins/toolsets/service_discovery.py

@@ -36,7 +36,7 @@ def find_service_url(label_selector):
         port = svc.spec.ports[0].port
         url = f"http://{name}.{namespace}.svc.{CLUSTER_DOMAIN}:{port}"
         logging.info(
-            f"discovered service with label-selector: `{label_selector}` at url: `{url}`"
+            f"Discovered service with label-selector: `{label_selector}` at url: `{url}`"
         )
         return url
     except Exception:

holmes/plugins/toolsets/servicenow/servicenow.py

@@ -37,7 +37,6 @@ class ServiceNowToolset(Toolset):
     def __init__(self):
         super().__init__(
             prerequisites=[CallablePrerequisite(callable=self.prerequisites_callable)],
-            experimental=True,
             tools=[
                 ReturnChangesInTimerange(toolset=self),
                 ReturnChange(toolset=self),

holmes/utils/stream.py

@@ -1,11 +1,15 @@
 import json
 from enum import Enum
-from typing import Generator, Optional, List
+from typing import Generator, Optional, List, Union
 import litellm
 from pydantic import BaseModel, Field
 from holmes.core.investigation_structured_output import process_response_into_sections
 from functools import partial
 import logging
+from litellm.litellm_core_utils.streaming_handler import CustomStreamWrapper
+from litellm.types.utils import ModelResponse, TextCompletionResponse
+
+from holmes.core.llm import TokenCountMetadata, get_llm_usage
 
 
 class StreamEvents(str, Enum):
@@ -15,6 +19,7 @@ class StreamEvents(str, Enum):
     ERROR = "error"
     AI_MESSAGE = "ai_message"
     APPROVAL_REQUIRED = "approval_required"
+    TOKEN_COUNT = "token_count"
 
 
 class StreamMessage(BaseModel):
@@ -112,3 +117,27 @@ def stream_chat_formatter(
             yield create_rate_limit_error_message(str(e))
         else:
             yield create_sse_error_message(description=str(e), error_code=1, msg=str(e))
+
+
+def add_token_count_to_metadata(
+    tokens: TokenCountMetadata,
+    metadata: dict,
+    max_context_size: int,
+    maximum_output_token: int,
+    full_llm_response: Union[
+        ModelResponse, CustomStreamWrapper, TextCompletionResponse
+    ],
+):
+    metadata["usage"] = get_llm_usage(full_llm_response)
+    metadata["tokens"] = tokens.model_dump()
+    metadata["max_tokens"] = max_context_size
+    metadata["max_output_tokens"] = maximum_output_token
+
+
+def build_stream_event_token_count(metadata: dict) -> StreamMessage:
+    return StreamMessage(
+        event=StreamEvents.TOKEN_COUNT,
+        data={
+            "metadata": metadata,
+        },
+    )

{holmesgpt-0.14.3a0.dist-info → holmesgpt-0.15.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: holmesgpt
-Version: 0.14.3a0
+Version: 0.15.0
 Summary: 
 Author: Natan Yellin
 Author-email: natan@robusta.dev
@@ -8,6 +8,7 @@ Requires-Python: >=3.10,<4.0
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
+Requires-Dist: ag-ui-protocol (>=0.1.9,<0.2.0)
 Requires-Dist: azure-core (>=1.34.0,<2.0.0)
 Requires-Dist: azure-identity (>=1.23.0,<2.0.0)
 Requires-Dist: azure-mgmt-alertsmanagement (>=1.0.0,<2.0.0)
@@ -23,6 +24,7 @@ Requires-Dist: certifi (>=2024.7.4,<2025.0.0)
 Requires-Dist: colorlog (>=6.8.2,<7.0.0)
 Requires-Dist: confluent-kafka (>=2.6.1,<3.0.0)
 Requires-Dist: fastapi (>=0.116,<0.117)
+Requires-Dist: google-cloud-aiplatform (>=1.38)
 Requires-Dist: httpx[socks] (<0.28)
 Requires-Dist: humanize (>=4.9.0,<5.0.0)
 Requires-Dist: jinja2 (>=3.1.2,<4.0.0)

{holmesgpt-0.14.3a0.dist-info → holmesgpt-0.15.0.dist-info}/RECORD

@@ -1,19 +1,19 @@
 holmes/.git_archival.json,sha256=PbwdO7rNhEJ4ALiO12DPPb81xNAIsVxCA0m8OrVoqsk,182
-holmes/__init__.py,sha256=Xkcdfkht6ggBl_hP1QR015rQn_M9AemtEWj2KaFd9X4,263
-holmes/clients/robusta_client.py,sha256=rWst1PANJaIsprp3jZ7RV5UpttM_YLBGQ8B5noZqvgg,1532
-holmes/common/env_vars.py,sha256=p9xO7bDjyPNJr7S4OO-GkMR1RYaj4aWxTtcy5JTzJKU,3521
+holmes/__init__.py,sha256=HuRDI7eNkzrIUbLoCG2vywrs3ODLoIjFkloiICdi2FU,257
+holmes/clients/robusta_client.py,sha256=YZA70OXGO0WZGTqtBhKiOtP7bhsrSW_f2Ea3Qcg9aMY,1530
+holmes/common/env_vars.py,sha256=rAZDq3qmEXfERN_bC1M_Vx4M9IT9-GifZQSOHzfvSKU,4025
 holmes/common/openshift.py,sha256=akbQ0GpnmuzXOqTcotpTDQSDKIROypS9mgPOprUgkCw,407
-holmes/config.py,sha256=uwSbVxWvXp5B4XRk9GkMMcQG8tgFfrYj7PRex-qn54w,21743
+holmes/config.py,sha256=1t732ILkEBKxzXchupNHwxVsRy7H-v4LpYNbi5DqE8Y,23330
 holmes/core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 holmes/core/config.py,sha256=9QGIXeYff9FPWa91as2OkRO2SupHzfNQZWzfNC4Vl-8,113
-holmes/core/conversations.py,sha256=iSfYBD88fO-irkCKqy3wm7CV1wn8g89e5GxJlpdn1MA,21723
+holmes/core/conversations.py,sha256=3pSKGJi2gjAiCJ9HQYC2EsNLyQkjV1YlTV1_puNqQw4,21744
 holmes/core/feedback.py,sha256=Gu69ghRYGSCPDgFA77xOB5RPbVdQX-9Qpv4yVVegL4g,6793
 holmes/core/investigation.py,sha256=HrRi1-myPF7ndOwwZ4Sv8iUbvPkrd5M02RPhZzln7NM,5900
 holmes/core/investigation_structured_output.py,sha256=sNxyqmsElQ-B22OlzTOrJtfrlipjyidcTU07idOBO7w,10570
 holmes/core/issue.py,sha256=dbctGv8KHAXC1SeOMkEP-BudJ50u7kA8jLN5FN_d808,2426
-holmes/core/llm.py,sha256=UQ2Ml4hJS1YDidCaU1Rz6km3qcgycjz-cuuo2coSPxw,22773
+holmes/core/llm.py,sha256=U7Ba7uVTShiXWpCNOIjBa1-ykKfl2gFkYP2XvmxKkPE,27343
 holmes/core/models.py,sha256=xFHFutZWoIaQWSeuq1PiYPw9SGkDrQsQ9qYXuk60EEU,9096
-holmes/core/openai_formatting.py,sha256=wL0Fq6lDePIKR5viitQz9ZWCQZZkHZHmEUqPIsOoFns,4077
+holmes/core/openai_formatting.py,sha256=31MwVvu0v0JiXot4Y0AwDJlFYe9vx8IB6mZiyC1y_lo,4684
 holmes/core/performance_timing.py,sha256=MTbTiiX2jjPmW7PuNA2eYON40eWsHPryR1ap_KlwZ_E,2217
 holmes/core/prompt.py,sha256=YkztY4gsobXys0fHxcwgngZBR2xDtBSYryY7HRnTxCQ,3025
 holmes/core/resource_instruction.py,sha256=rduue_t8iQi1jbWc3-k3jX867W1Fvc6Tah5uOJk35Mc,483
@@ -21,11 +21,11 @@ holmes/core/runbooks.py,sha256=Oj5ICmiGgaq57t4erPzQDvHQ0rMGj1nhiiYhl8peH3Q,939
 holmes/core/safeguards.py,sha256=XrKgmMoJxSROfoSOW6t6QEG2MFppzC20Nyn1HA5G4Go,4935
 holmes/core/supabase_dal.py,sha256=KSNwGz1v5dZAk_sDme1JCrPTJKc2fwApKQQu_U_r3cM,22433
 holmes/core/todo_tasks_formatter.py,sha256=USyJZcoX6zoxID1UV-abAKdaWFYLO6QJd-UKryJAurI,1487
-holmes/core/tool_calling_llm.py,sha256=YUUFmoTDw11ERC78gg2jTRZ6t9Dy_ba8wQiyJeJWL0k,50206
-holmes/core/tools.py,sha256=IOBmRdwTKeHvbvxlcT8xYJmBLcNI9CGP_iwrI-WhVio,31786
+holmes/core/tool_calling_llm.py,sha256=89yMIisEb9zTZzlpTlSqCWc08GRUvNLClihGkv_YrWE,51690
+holmes/core/tools.py,sha256=V0YZogQUzGUVg79mTaS0cfSh6nR_NS1zhOr0h6sNpZU,32730
 holmes/core/tools_utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-holmes/core/tools_utils/token_counting.py,sha256=3WTAgi19uK1IbtwivtSibiZWwqdtZeOOgZCVFRxUJG8,406
-holmes/core/tools_utils/tool_context_window_limiter.py,sha256=LoehZXp2C2ptoxbfZzzCe_t02iQOdhz-eM0k159ZIb8,2605
+holmes/core/tools_utils/token_counting.py,sha256=7ZXbPqEIb8ClVvG_t9z2wlujDtX7m_pTVi242-2ZmQE,427
+holmes/core/tools_utils/tool_context_window_limiter.py,sha256=LqyToJsDK-QgWmddHjDlQdb0SMMPx1iZE6soM_md6CI,2773
 holmes/core/tools_utils/tool_executor.py,sha256=pUkddbm_kgYdfhR1w5IbnSmwG56kvA4VadzBV8OqG8g,2632
 holmes/core/tools_utils/toolset_utils.py,sha256=SvWzen8Fg_TB_6Idw1hK0nCPrJL40ueWVMfsv8Kh2RY,2363
 holmes/core/toolset_manager.py,sha256=UqAUfjY09SAGirOHzyQwpOu2wxQUzU0F1STw8w-1abw,25878
@@ -36,7 +36,7 @@ holmes/core/transformers/llm_summarize.py,sha256=ZEJn3DElzMZLCCHNIzlCozllM2CmQ-J
 holmes/core/transformers/registry.py,sha256=x8kKRXJvc_tJO2RvNGyoVXt6rFgG4S_ZcTG8p_OXYH0,3771
 holmes/core/transformers/transformer.py,sha256=rfT84Oq6qJyryevZGFKEbo1VSxinK4FBWUw_HpJ72xE,1028
 holmes/core/truncation/dal_truncation_utils.py,sha256=I69I7Jac1kTtpxDRMe8O3IPN8Au0bZJqI8gXwW-GMaI,776
-holmes/interactive.py,sha256=bXP9qRsClwW0AlxNDWHJfJTeEwGByAoNUfL4cypJjtg,46767
+holmes/interactive.py,sha256=MGo5b6PKfQWrCmwMKMiISjNY02KWDxgoKdUAfcwmjTE,47102
 holmes/main.py,sha256=cz3i9YZkvXWTK8pk5O-LfAM5AsYcOcTEKYnbvpVY5ns,35001
 holmes/plugins/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 holmes/plugins/destinations/__init__.py,sha256=vMYwTfA5nQ05us5Rzbaoe0R5C8Navo6ENVZhojtACTk,98
@@ -48,7 +48,7 @@ holmes/plugins/prompts/_ai_safety.jinja2,sha256=IoVdOXHnkGwLaiuUzMczEdoahyrKhkdY
 holmes/plugins/prompts/_current_date_time.jinja2,sha256=KynAvkQFqf_SXjqVY77nB8z4RgN7gti4SBSq1H7moHs,354
 holmes/plugins/prompts/_default_log_prompt.jinja2,sha256=Tqw8CD2ZMStXIfMdYaoZT_d-FvQ_PMg6-knqag-YEgc,1478
 holmes/plugins/prompts/_fetch_logs.jinja2,sha256=penrJcRCfr8geKWNSQc-jdJ52dV-bEb1kxO6QB90dzw,5088
-holmes/plugins/prompts/_general_instructions.jinja2,sha256=0RB5TFGqhbQ-xNt2_oHXJjvMIBLThuRDusBbbEruy2w,5777
+holmes/plugins/prompts/_general_instructions.jinja2,sha256=IvGkmKaIrG7wXJlVcNqtYrst1Z-vRZYRMENzf_nDoz4,5774
 holmes/plugins/prompts/_global_instructions.jinja2,sha256=d_c-BtDhU_Rmx637TPAyzlIIim8ZAxy7JK3V4GV8IWI,1359
 holmes/plugins/prompts/_permission_errors.jinja2,sha256=gIMQx-zaTnuEv7SkQVC_GvxsR5R85fLuDZnJIKWcm5A,480
 holmes/plugins/prompts/_runbook_instructions.jinja2,sha256=ngm3rmPPvgPG-9fjtR3yVb84YQNdNWfWShDGIag1JnY,1121
@@ -78,12 +78,12 @@ holmes/plugins/sources/pagerduty/__init__.py,sha256=LYoN1dkUg7NCx7g-gdSomTTJhHyB
 holmes/plugins/sources/prometheus/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 holmes/plugins/sources/prometheus/models.py,sha256=9TcDIRLWZQhwjYGfRZFP_2fGweCn4G5xvYrLoXiQZTc,2904
 holmes/plugins/sources/prometheus/plugin.py,sha256=oBmuOwNM67suy6HmasUnyVOlBq9-mAxLZLlUzRHIggg,5941
-holmes/plugins/toolsets/__init__.py,sha256=ydF9jawE6cn8lDpyYhqSCxlvj6eAywLyUoo1bI9wDrE,7589
+holmes/plugins/toolsets/__init__.py,sha256=j0gZgSU5CTSWLE87I5f0zUsHw6vh0uZl0BALEMy-wXU,7738
 holmes/plugins/toolsets/aks-node-health.yaml,sha256=37Dvk4D0ez1GQlt91MQkI0pZ5RLtUEFAOxDXDCVzb-g,5995
 holmes/plugins/toolsets/aks.yaml,sha256=_XwrMSsghFnCqlbsZvVfwF3qgQFnxi47AC5Oavi2YC0,9532
 holmes/plugins/toolsets/argocd.yaml,sha256=lbRIooJIkpumNdRgoDRHTjNb9PvFTfjQcT0iWU2x8mg,3932
 holmes/plugins/toolsets/atlas_mongodb/instructions.jinja2,sha256=iyft4EwvYcImI_YrMte8_BTJZXGV6i0k84g3oKXR23k,988
-holmes/plugins/toolsets/atlas_mongodb/mongodb_atlas.py,sha256=1FlArSlvS6XobEr5A-4J_VNwCIbmB4ZwFA9O0l4XRK8,15678
+holmes/plugins/toolsets/atlas_mongodb/mongodb_atlas.py,sha256=8AdGtsox8huiR5UhKnQRN0cz8uPwNr1AGrtsUzvg7bY,15647
 holmes/plugins/toolsets/aws.yaml,sha256=AM5MizvfHeGFoCRr6kf3Wcd6y_EAhSDqtZajTFrLVfE,4475
 holmes/plugins/toolsets/azure_sql/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 holmes/plugins/toolsets/azure_sql/apis/alert_monitoring_api.py,sha256=DSrKzzE6lofynViYr0SGaQrWjePpzbfdt3DcplbFGek,26397
@@ -93,7 +93,7 @@ holmes/plugins/toolsets/azure_sql/apis/connection_monitoring_api.py,sha256=10k5K
 holmes/plugins/toolsets/azure_sql/apis/storage_analysis_api.py,sha256=sbz8b2IeGqwosA34ddbqnXbD_iPYKuAMyZrV0-__O9g,13835
 holmes/plugins/toolsets/azure_sql/azure_base_toolset.py,sha256=8eQPsFBPTCf_GMpbjfzzN3u-rGUXiElTD06RWCe7uso,2163
 holmes/plugins/toolsets/azure_sql/azure_sql_instructions.jinja2,sha256=GvuxActaoJXA__4k72en7I44jEv_ye0MevSmlHfnzxA,6557
-holmes/plugins/toolsets/azure_sql/azure_sql_toolset.py,sha256=l87m6mieP8-uTpj_NDRXbom43YP4b6TzOhnGyvn4r8c,8069
+holmes/plugins/toolsets/azure_sql/azure_sql_toolset.py,sha256=QqMiV7ZY-Dh3jgRyKeON5ha5H-wbvmAVHYA9GF-2UVI,8038
 holmes/plugins/toolsets/azure_sql/install.md,sha256=eBhdG-OG9HhbrEGvI31aAHRPWwBQne6H95mvBROqZ_s,1585
 holmes/plugins/toolsets/azure_sql/tools/__init__.py,sha256=lEYFZ5X0mHdqwmi6XXTlM1qA7sBYsuQwVCXmluo-L34,25
 holmes/plugins/toolsets/azure_sql/tools/analyze_connection_failures.py,sha256=f_3TPbAjMDNAjqUr6BkoNzbMn4wvG_gQS-6HH3bC4AY,13385
@@ -169,7 +169,7 @@ holmes/plugins/toolsets/git.py,sha256=eUpQRolp6CEqUS9nMqCJcL-th0m1c8F4oYdhMv_qcG
 holmes/plugins/toolsets/grafana/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 holmes/plugins/toolsets/grafana/base_grafana_toolset.py,sha256=AjvbS4txSo97YqeeFlXUnu95oPFt8rB-CD1Ccf92a04,1760
 holmes/plugins/toolsets/grafana/common.py,sha256=yYy6knRNUYQmZvgII-Cte9RQJNY8Sj7QlbHB0aCNFYU,2459
-holmes/plugins/toolsets/grafana/grafana_api.py,sha256=nq7KWoUAfFxp1-3VqKadPNKbTifLTgKUAZOFUH5QWUY,1665
+holmes/plugins/toolsets/grafana/grafana_api.py,sha256=Hw6yTRyPC4pGIzV4paXYblY93iDrLjsHGxsONaq9gPU,1665
 holmes/plugins/toolsets/grafana/grafana_tempo_api.py,sha256=C8XEZzIKzeh9pG-DBQoMW4Qi2Kh3ZoI4TXVGUx2CxUc,14688
 holmes/plugins/toolsets/grafana/loki_api.py,sha256=f7oTzfhJ1LojsPoAfsKt32ADWffLEywBJQWG9eyfb7I,2529
 holmes/plugins/toolsets/grafana/toolset_grafana.py,sha256=M10S7CeOsLaSCZqQysjT4vviG7nUPc95QzWCTtPBXXE,4930
@@ -181,7 +181,7 @@ holmes/plugins/toolsets/helm.yaml,sha256=-IPDChKMHcxGbzA0z9GKczRshL-mD24cHpBizfN
 holmes/plugins/toolsets/internet/internet.py,sha256=qeV6M9302QWacFcr7bOfsZUc84v9MnlTEF_76oUOSNA,7787
 holmes/plugins/toolsets/internet/notion.py,sha256=ELDtsP8kxdU8rExEL8hq1yV5DEeWDNOljHZEwjnumJc,4795
 holmes/plugins/toolsets/investigator/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-holmes/plugins/toolsets/investigator/core_investigation.py,sha256=NqNlPjWGyb3A_bw5JV-ePhWOdJUmAIO4IYwa_WsygJM,5213
+holmes/plugins/toolsets/investigator/core_investigation.py,sha256=kdH3kNwepSfPt7JB3IKYDbeHJAb_p3J9TWK8dAO8TcI,5292
 holmes/plugins/toolsets/investigator/investigator_instructions.jinja2,sha256=C6y6OaJI2dQSLSw7Zq9-D-sWmL5K_40zRItvkzVAdH4,13967
 holmes/plugins/toolsets/investigator/model.py,sha256=6AE9Iy05GaX3gC9ChTtZQOFGjSUsas_pB9_YyDaJXP0,342
 holmes/plugins/toolsets/kafka.py,sha256=kO_CKzdXG__6QmiwaGumZgPkdZbft0f1DpqhNV8ogs8,24774
@@ -199,10 +199,13 @@ holmes/plugins/toolsets/newrelic/newrelic.py,sha256=PCV-rN2w8gxYvo3Nq5Fauoq967ds
 holmes/plugins/toolsets/opensearch/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 holmes/plugins/toolsets/opensearch/opensearch.py,sha256=VVyEJnECRfhwNUQqilugi9t0tPymyp7hRFwYQSFDg2E,8629
 holmes/plugins/toolsets/opensearch/opensearch_logs.py,sha256=_j-JAhLWtxhBPafCveympxtxQ2EalsqKW6jLfaXHG94,5929
+holmes/plugins/toolsets/opensearch/opensearch_ppl_query_docs.jinja2,sha256=D1Xl_tFfZ91XvzRqdUjsrH0vQjs95Ddn_EPwMcwlzcs,56327
+holmes/plugins/toolsets/opensearch/opensearch_query_assist.py,sha256=lt27E6Ey7EQ34YejSOrUWYlHnWTnqdgm7wHMGVVjZUo,2721
+holmes/plugins/toolsets/opensearch/opensearch_query_assist_instructions.jinja2,sha256=Qoqb8wFqj0WBukA_uhA6l-2bFs06PqYFDESQCN_uWZQ,6699
 holmes/plugins/toolsets/opensearch/opensearch_traces.py,sha256=Xd_toAzZikdUrInZG8_oBQ0gI-QCvYrf0w2ZciFC1kU,8869
 holmes/plugins/toolsets/opensearch/opensearch_traces_instructions.jinja2,sha256=Xn8AW4XCMYV1VkBbF8nNB9fUpKQ1Vbm88iFczj-LQXo,1035
 holmes/plugins/toolsets/opensearch/opensearch_utils.py,sha256=mh9Wp22tOdJYmA9IaFS7tD3aEENljyeuPOsF-lEe5C0,5097
-holmes/plugins/toolsets/prometheus/prometheus.py,sha256=As2WYpJNtFSxshv5OhLTsaoprJI_PBaUYfigPkrYlps,67609
+holmes/plugins/toolsets/prometheus/prometheus.py,sha256=Ip18XzSxqT0lPCQ2jnZ5MXUQoodOZdCak6KZI_IyqnM,67743
 holmes/plugins/toolsets/prometheus/prometheus_instructions.jinja2,sha256=taf5C-N9rdp1A7S__hETefcm2OaYHJLjs1ZbuqIsGtE,6383
 holmes/plugins/toolsets/prometheus/utils.py,sha256=ZenD354dP0sRmm0R-QBuAq1jyn40GjYf4wx15bXIYRc,775
 holmes/plugins/toolsets/rabbitmq/api.py,sha256=-BtqF7hQWtl_OamnQ521vYHhR8E2n2wcPNYxfI9r4kQ,14307
@@ -213,10 +216,10 @@ holmes/plugins/toolsets/robusta/robusta.py,sha256=jRNxoIUoJkvCTZZnKpFFhLA3ip0l1c
 holmes/plugins/toolsets/robusta/robusta_instructions.jinja2,sha256=E3UxlbyoNx96Fsk6d1laBTrnca1nLreWGMWnGPD2KbI,2060
 holmes/plugins/toolsets/runbook/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 holmes/plugins/toolsets/runbook/runbook_fetcher.py,sha256=0WN_-T55M5CASGGf9uyUclhALazF8m7xYLk5-kKcHf0,10271
-holmes/plugins/toolsets/service_discovery.py,sha256=QVrCCVcTE7APqyr0C44MGmJyCW9Ft-Ac-Wr4XfFBfjA,3268
+holmes/plugins/toolsets/service_discovery.py,sha256=HqENA92SyN7Z_Kd8OZVfw-S9PwdYhn6HDFUAo1-fosw,3268
 holmes/plugins/toolsets/servicenow/install.md,sha256=UeL069Qd2e4wC3kmc54wk62AoSpyeizKWV6NB1jUYVM,1217
 holmes/plugins/toolsets/servicenow/instructions.jinja2,sha256=koA2vJ1tOkGi2T5aGjmk9oTZPrt7WdoMSuVyxfO5-k4,491
-holmes/plugins/toolsets/servicenow/servicenow.py,sha256=Cb3gcrnaj-GEjoTPQJd4Tb18KwJ8hyLvHekjgs8POs8,8560
+holmes/plugins/toolsets/servicenow/servicenow.py,sha256=Y95lWJugbBmz6eCjwBibMTkYMvHYc9OP_uAp1YwqYYA,8529
 holmes/plugins/toolsets/slab.yaml,sha256=1Pz0Rzs0B6-TnJiiN2w8qJ9E_bh2haQn0mfhTszaZE0,677
 holmes/plugins/toolsets/utils.py,sha256=EZqPEBJcnMZliWMiN82XOQstr_NwanEqnzsd6incEFk,6891
 holmes/plugins/utils.py,sha256=Wn_UxZMB4V2_UiJDNy0pifGnIGS_zUwRhUlmttCywnY,372
@@ -240,11 +243,11 @@ holmes/utils/llms.py,sha256=YLqq54I84wW7Kp7Z7CPVTxAFPb-Sq6xkdmVGzVf60jI,629
 holmes/utils/markdown_utils.py,sha256=_yDc_IRB5zkj9THUlZ6nzir44VfirTjPccC_DrFrBkc,1507
 holmes/utils/pydantic_utils.py,sha256=g0e0jLTa8Je8JKrhEP4N5sMxj0_hhPOqFZr0Vpd67sg,1649
 holmes/utils/sentry_helper.py,sha256=BPkyMs7Yo_0b7QLMmAQ3mKZyXTmxkgVRjr3kikr5ZX8,1328
-holmes/utils/stream.py,sha256=B0PigMm2_KBwFKeVu0IxxR07gR65Eq3mJ5FntdVTNTo,3894
+holmes/utils/stream.py,sha256=W3qk6XLjMMtm6tMrQ_QB9lWPbtHcaGGZmKSTlSk6QQ8,4803
 holmes/utils/tags.py,sha256=SU4EZMBtLlIb7OlHsSpguFaypczRzOcuHYxDSanV3sQ,3364
 holmes/version.py,sha256=5-3__IY_2hcIC4WQyTqcdyX1QF-e2VfkYKrI4BIrq0Q,5992
-holmesgpt-0.14.3a0.dist-info/LICENSE.txt,sha256=RdZMj8VXRQdVslr6PMYMbAEu5pOjOdjDqt3yAmWb9Ds,1072
-holmesgpt-0.14.3a0.dist-info/METADATA,sha256=-Rtt-ctWPC6O2Iv-ijv_zTkobo4dZj_Iu-Giktm5D8o,16078
-holmesgpt-0.14.3a0.dist-info/WHEEL,sha256=kLuE8m1WYU0Ig0_YEGrXyTtiJvKPpLpDEiChiNyei5Y,88
-holmesgpt-0.14.3a0.dist-info/entry_points.txt,sha256=JdzEyZhpaYr7Boo4uy4UZgzY1VsAEbzMgGmHZtx9KFY,42
-holmesgpt-0.14.3a0.dist-info/RECORD,,
+holmesgpt-0.15.0.dist-info/LICENSE.txt,sha256=RdZMj8VXRQdVslr6PMYMbAEu5pOjOdjDqt3yAmWb9Ds,1072
+holmesgpt-0.15.0.dist-info/METADATA,sha256=uS5b8hrYZ0d0WMzrameeXcIRulIXfrlBuGROP0fNlrI,16171
+holmesgpt-0.15.0.dist-info/WHEEL,sha256=kLuE8m1WYU0Ig0_YEGrXyTtiJvKPpLpDEiChiNyei5Y,88
+holmesgpt-0.15.0.dist-info/entry_points.txt,sha256=JdzEyZhpaYr7Boo4uy4UZgzY1VsAEbzMgGmHZtx9KFY,42
+holmesgpt-0.15.0.dist-info/RECORD,,