About Sumo Logic
Sumo Logic is a cloud-based analytics platform that unifies organizations by collecting, analyzing, and managing log data from applications and networks. It provides real-time insights into security, operations, and business intelligence, and can help to automate troubleshooting. Over 2,000 organizations worldwide save time and effort by relying on Sumo Logic to get powerful real-time analytics and insights to resolve the hardest questions facing their cloud-native applications.
The Challenge: Finding Root Causes Across Complex Log Data
Modern applications and infrastructure generate massive volumes of log data across servers, applications, services, and security systems. That data is often unstructured and fragmented across environments, making it difficult for engineering teams to quickly understand what happened when an incident occurs.
Traditionally, teams may need to sift through large volumes of logs, identify patterns, and connect events across multiple systems before determining the root cause. That process can take hours or even days, particularly when teams lack fully instrumented tracing or when critical information is buried in unstructured data.
Sumo Logic saw an opportunity to use generative AI to dramatically shorten that process and make sophisticated incident analysis accessible to a broader range of users.
“Customers have accepted AI as a real innovator, so the time is now for differentiating and disrupting the market.”
Tej Redkar
Chief Product Officer, Sumo Logic
Why Sumo Logic Chose Tribe AI
Sumo Logic was introduced to Tribe AI through Francisco Partners. After seeing Tribe’s work applying generative AI to observability and security, the Sumo Logic team selected Tribe to help explore how large language models could transform the way log data is analyzed.
Tribe AI worked alongside Sumo Logic to design, build, test, and ultimately productionize a Claude-powered solution for analyzing log data and accelerating root-cause analysis.
From Initial Validation to Production
The engagement began with an initial validation phase focused on whether large language models could automatically map structured log data to the Elastic Common Schema and improve observability workflows.
During that work, Tribe also explored whether Claude could interpret unstructured log data - not just convert its format, but understand what was happening within the logs themselves.
The team demonstrated that Claude could:
- Parse unstructured logs into a standardized format
- Identify different types of logs
- Explain what was occurring within the log data
- Identify incidents and analyze likely causes
The success of this initial work led Sumo Logic and Tribe to expand the engagement around a larger opportunity: using Claude to help engineering teams understand incidents and identify root causes directly from unstructured logs.
Building the Generative Context Engine with Claude
Tribe AI and Sumo Logic developed the Generative Context Engine, a Claude-powered capability designed to transform how engineering teams interpret and act on complex log data during an incident.
Traditional observability approaches can depend on predefined schemas, tracing, and instrumentation to understand relationships between services. The Generative Context Engine takes a more dynamic approach, using Claude to reason across unstructured log data, generate context, identify service relationships, and surface likely root causes.
Sumo Logic publicly demonstrated the solution using Claude to dynamically generate service maps, summarize log data, identify root causes, and recommend remediation steps.
How the Claude-powered solution works
Dynamic Analysis
The solution works across unstructured and changing log data without depending solely on rigid schemas or preconfigured tracing.
Log Summarization
Claude turns large volumes of logs into high-level and service-level summaries, helping teams quickly understand what is happening across an environment.
Service Mapping & Root-Cause Analysis
Claude identifies relationships between services, highlights relevant signals, and helps pinpoint likely root causes directly from log data.
Recommended Next Steps
The solution generates service-level recommendations to help teams move from identifying an incident toward remediation.
From Hours or Days to Less Than a Minute
The Generative Context Engine demonstrated a significant reduction in mean time-to-resolution, one of the most important measures of effectiveness in observability.
What previously required engineers to spend hours or even days investigating an incident could be reduced to less than one minute.
Beyond speed, the Claude-powered approach gives engineering teams more value from their existing log data by generating context, surfacing recommendations, and reducing the instrumentation overhead traditionally required to understand complex service relationships.
Sumo Logic has described the broader impact of this approach across four areas: resolving incidents faster, extracting more value from log data, simplifying the technology stack, and creating a stronger foundation for DevSecOps.
Sumo Logic’s Experience Working with Tribe AI
“Partnering with Tribe AI – and leveraging their complementary GenAI skill set – was critical to the success of this project.”
Tej Redkar
Chief Product Officer, Sumo Logic
Sumo Logic already had deep experience building and using traditional AI systems. Tribe complemented that expertise with hands-on experience building applications with large language models, helping Sumo Logic move quickly from exploration to a working solution.
“We had an ambitious scope and needed a really novel GenAI application to achieve our goal, which required a very high-level of expertise in LLMs and prompt engineering.”
Tej Redkar
Chief Product Officer, Sumo Logic
Claude in Production
Following the initial development and validation phases, Sumo Logic and Tribe AI brought the Claude-powered solution into production.
What began as an exploration of how generative AI could interpret complex log data evolved into a production capability that helps accelerate the path from raw logs to actionable insight.
By integrating Claude into the incident-analysis workflow, Sumo Logic can help engineering teams move more quickly from “something is wrong” to understanding what happened and why.