Day 85: Time-Series and Anomaly Copilots

Pastling a CloudWatch screenshot into chat is not observability. Anomaly copilots should call metrics/logs APIs as tools, reason over structured series, and propose hypotheses with links back to graphs.

⚡ TL;DR: Tools for GetMetricData / PromQL, not pixels. Baseline vs deploy markers. Never auto-remediate from a single spike without policy. Cite query + time range in every answer.

Tool-shaped signals

# ✅ Metrics as tools
TOOLS = [
  {
    "name": "get_metric",
    "input_schema": {
      "type": "object",
      "properties": {
        "namespace": {"type": "string"},
        "metric": {"type": "string"},
        "stat": {"type": "string"},
        "period_s": {"type": "integer"},
        "start": {"type": "string"},
        "end": {"type": "string"},
      },
      "required": ["namespace", "metric", "start", "end"],
    },
  }
]

Correlate with deploy events (EventBridge/CI) before blaming “the database.”

def annotate_deploys(series, deploys):
    return {
        "points": series,
        "deploys": [d for d in deploys if series.start <= d.ts <= series.end],
    }

❌ Autonomous scale_out from one noisy datapoint.

Failure modes

Seasonality and deploy noise create false incidents. Require at least two independent signals (metric + log signature) before suggesting remediation. Weekend baselines differ — segment by day-of-week in tools.

Closing checklist

• [ ] Metrics/logs tools with IAM least privilege
• [ ] Deploy markers in context
• [ ] Answers must include query + window
• [ ] Suggest-only remediations by default
• [ ] Eval on historical incidents, not synthetic sine waves only

Series navigation

Day 84: SQL and Warehouse Copilots · Day 86: Search and Ranking Copilots

Last updated September 11, 2026