Skip to content

Priority System

LogSys classifies every event into one of four operational priorities (P1–P4). Priority is the primary signal for triage, dashboards, and incident correlation.

Priority Semantics

Priority Meaning Target Response Example
P1 Critical — service down, data loss, security Immediate (< 15 min) Payment gateway unavailable
P2 High — degraded service, user impact Same day (< 4 h) High latency, partial failures
P3 Medium — non-blocking issue Next business day Warnings, retries
P4 Low — informational Backlog Debug, info, cosmetic

How Priority Is Set

flowchart TB
  A[Event with template_id] --> B{In template cache?}
  B -->|Yes| C[Return cached priority]
  B -->|No| D{RoBERTa loaded?}
  D -->|Yes| E[Predict priority + confidence]
  D -->|No| F[severity → priority rule]
  E --> G[Persist template_priority]
  G --> C

Provenance

Every priority is stamped with where it came from so dashboards and operators can trust it:

priority_source Producer Confidence
ml RoBERTa classifier Softmax probability
rule Severity fallback 1.0
manual Human correction via API 1.0

The same provenance lives on events.priority_source, events.model_version, and the template_priority table.

Human Correction

Operators can override a prediction:

PATCH /api/logs/{event_id}/priority
{ "priority": "P1", "reason": "Impacted production payments" }

Effects: 1. Event priority overridden, model_version = "manual" 2. tags.correction_reason recorded 3. Propagates to the template → all future events reuse the corrected priority 4. Redis cache for that template invalidated

This creates the feedback loop that improves the Labeling Pipeline.

Severity vs Priority

Signal Source Granularity
Severity Source-reported (DEBUG…CRITICAL) Per event
Priority ML / rules / manual Per template (mostly)

Severity is a fact about the message; priority is an operational judgment. The two are correlated but not identical — e.g. an ERROR from a low-traffic batch job may be P3.

Dashboards & Filtering

  • KPIs aggregate by priority (P1_events, P2_events, …)
  • Time-series buckets break counts down by P1–P4
  • Calendar view filters by priority
  • Alerts and incidents reference priority for escalation