Merge branch 'master' into ROB-1032-llm-selection

Author: RoiGlinik

docs/configuration/holmesgpt/index.rst

@@ -18,7 +18,7 @@ Robusta can integrate with `Holmes GPT <https://github.com/robusta-dev/holmesgpt
 
 When available, AI based investigations can be launched in one of two ways:
 
-1. Click the ``Ask Holmes`` button in Slack. The AI investigation will be sent back as a new message.
+1. Click the ``Ask HolmesGPT`` button in Slack. The AI investigation will be sent back as a new message.
 
 .. image:: /images/robusta-holmes-investigation.png
     :width: 600px

docs/configuration/holmesgpt/toolsets/coralogix_logs.rst

@@ -41,10 +41,6 @@ Configuration
               api_key: <your coralogix API key>
               domain: eu2.coralogix.com # Your Coralogix domain
               team_hostname: my-team # Your team's hostname in coralogix, without the domain part
-              labels:
-                pod: "kubernetes.pod_name"
-                namespace: "kubernetes.namespace_name"
-                app: "kubernetes.labels.app"
 
           kubernetes/logs:
             enabled: false # Disable HolmesGPT's default logging mechanism
@@ -65,19 +61,61 @@ Configuration
             api_key: <your coralogix API key>
             domain: eu2.coralogix.com # Your Coralogix domain
             team_hostname: my-team # Your team's hostname in coralogix
-            labels:
-              pod: "kubernetes.pod_name"
-              namespace: "kubernetes.namespace_name"
-              app: "kubernetes.labels.app"
 
         kubernetes/logs:
           enabled: false # Disable HolmesGPT's default logging mechanism
 
+Advanced Configuration
+^^^^^^^^^^^^^^^^^^^^^^
+
+**Frequent logs and archive**
+
+By default, holmes fetched the logs from the `Frequent search <https://coralogix.com/docs/user-guides/account-management/tco-optimizer/logs/#frequent-search-data-high-priority>`_ 
+tier and only fetch logs from the `Archive` tier if the frequent search returned no result.
+
+This behaviour can be customised using the ``logs_retrieval_methodology`` configuration field:
+
+.. code-block:: yaml
+
+  toolsets:
+    coralogix/logs:
+      enabled: true
+      config:
+        # Possible values are:
+        #  - FREQUENT_SEARCH_ONLY
+        #  - ARCHIVE_ONLY
+        #  - ARCHIVE_FALLBACK  <- default value
+        #  - FREQUENT_SEARCH_FALLBACK
+        #  - BOTH_FREQUENT_SEARCH_AND_ARCHIVE
+        logs_retrieval_methodology: ARCHIVE_FALLBACK # default value
+        ...
+
+Here is a description of each possible log retrieval methodology:
+
+- **FREQUENT_SEARCH_ONLY** Always fetch logs using a frequent search.
+- **ARCHIVE_ONLY** Always fetch logs using the archive.
+- **ARCHIVE_FALLBACK** Use a frequent search first. If there are no results, fallback to searching archived logs. **This is the default behaviour.**
+- **FREQUENT_SEARCH_FALLBACK** Search logs in the archive first. If there are no results, fallback to searching the frequent logs.
+- **BOTH_FREQUENT_SEARCH_AND_ARCHIVE** Always use both the frequent search and the archive to fetch logs. The result contains merged data which is deduplicated and sorted by timestamp.
 
 **Search labels**
 
-You can tweak the labels used by the toolset to identify kubernetes resources. This is only needed if your
-logs settings for ``pod``, ``namespace``, and ``app`` differ from the defaults in the example above.
+You can tweak the labels used by the toolset to identify kubernetes resources. This is **optional** and only needed if your
+logs settings for ``pod``, ``namespace``, ``application`` and ``subsystem`` differ from the defaults in the example below.
+
+.. code-block:: yaml
+
+  toolsets:
+    coralogix/logs:
+      enabled: true
+      config:
+        labels: # OPTIONAL: tweak the filters used by HolmesGPT if your coralogix configuration is non standard
+          namespace: "kubernetes.namespace_name"
+          pod: "kubernetes.pod_name"
+          application: "coralogix.metadata.applicationName"
+          subsystem: "coralogix.metadata.subsystemName"
+        ...
+
 
 You can verify what labels to use by attempting to run a query in the coralogix ui:
 
@@ -111,5 +149,5 @@ Capabilities
 
    * - Tool Name
      - Description
-   * - coralogix_fetch_logs
-     - Retrieve logs from Coralogix
+   * - fetch_coralogix_logs_for_resource
+     - Retrieve logs using coralogix

docs/configuration/holmesgpt/toolsets/prometheus.rst

@@ -24,7 +24,7 @@ Configuration
                 prometheus/metrics:
                     enabled: true
                     config:
-                        prometheus_url: http://<prometheus host>:9090
+                        prometheus_url: http://<prometheus host>:9090 # e.g. http://robusta-kube-prometheus-st-prometheus.default.svc.cluster.local:9090
                         headers:
                             Authorization: "Basic <base_64_encoded_string>"
 
@@ -41,7 +41,7 @@ Configuration
             prometheus/metrics:
                 enabled: true
                 config:
-                    prometheus_url: http://<prometheus host>:9090
+                    prometheus_url: http://<prometheus host>:9090 # e.g. http://robusta-kube-prometheus-st-prometheus.default.svc.cluster.local:9090
                     headers:
                         Authorization: "Basic <base_64_encoded_string>"
 
@@ -78,13 +78,11 @@ Below is the full list of options for this toolset:
 
 The best way to find the prometheus URL is to use "ask holmes". This only works if your cluster is live and already connected to Robusta.
 
-If not, follow these steps:
+If not, you can often find the prometheus URL by running the following command (several results may be shown - pick the best match):
 
-1. Run ``kubectl get services -n <monitoring-namespace>`` to list all services. Replace ``<monitoring-namespace>`` with the namespace where Prometheus is deployed. This is often ``monitoring`` or ``prometheus``. You can also run ``kubectl get services -A`` which will list all services in all namespaces.
-2. Identify which are the namespace and name of your Prometheus service. You can set up port forwarding to test if the service is correct and if Prometheus is reachable.
-3. Run ``kubectl describe service <service-name> -n <namespace>`` to get details about the service, including the cluster IP and port.
-4. Set the DNS or the cluster IP as well as the port to the configuration field ``prometheus_url`` as mentioned above.
+.. code-block:: bash
 
+    kubectl get svc --all-namespaces -o jsonpath='{range .items[*]}{.metadata.name}{"."}{.metadata.namespace}{".svc.cluster.local:"}{.spec.ports[0].port}{"\n"}{end}' | grep prometheus | grep -Ev 'operat|alertmanager|node|coredns|kubelet|kube-scheduler|etcd|controller' | awk '{print "http://"$1}'
 
 Capabilities
 ------------

docs/configuration/holmesgpt/toolsets/robusta.rst

@@ -3,7 +3,7 @@ Robusta :checkmark:`_`
 .. include:: ./_toolset_enabled_by_default.inc.rst
 
 By enabling this toolset, HolmesGPT will be able to fetch alerts metadata. It allows HolmesGPT to fetch information
-about specific issues when chatting using "Ask Holmes". This toolset is not necessary for Root Cause Analysis.
+about specific issues when chatting using "Ask HolmesGPT". This toolset is not necessary for Root Cause Analysis.
 
 Configuration
 -------------

src/robusta/integrations/slack/sender.py

@@ -353,7 +353,7 @@ def __create_holmes_callback(self, finding: Finding) -> CallbackBlock:
 
         return CallbackBlock(
             {
-                "Ask Holmes": CallbackChoice(
+                "Ask HolmesGPT": CallbackChoice(
                     action=ask_holmes,
                     action_params=AIInvestigateParams(
                         resource=resource, investigation_type="issue", ask="Why is this alert firing?", context=context