Answer any agent question on Parquet.

An agent asks a question

How manyA count. The agent wants a number, not a pile of log lines. SQL does this with COUNT. errors last nightFilters. Keep the error-level rows and the last 24 hours. mention disk fullKeyword search. Match those exact words in the log body. Today this is a call to a search engine. or look like a capacity incidentSemantic search. Match meaning even when the log never says disk full. Today this is a call to a vector database., and are tied to last week’s outageGraph search. Keep the errors linked to the outage’s record through a key they share, like a host or a service, even when they never mention it. Today this is a call to a graph database.? Which serviceA group on the same hits. SQL GROUP BY. Today a second warehouse query after the searches return. had them, and which team owns itA join. Match each service to its owner in a second table. Today the agent looks this up in another system and stitches the answers together.?

It hides seven jobs

• countHow many
• groupWhich service
• joinwhich team owns it
• filtererrors last night
• keyword searchdisk full
• semantic searchcapacity incident
• graph searchtied to last week’s outage

One SQL statement runs all seven

SELECT   o.team, h.service, count(*) AS hits
FROM     hybrid_search(
           'logs', 'body', 'disk full',
           'embedding', :q, 1000
         ) AS h
JOIN     graph_walk('logs', 'incidents', [4521], 2, 5000) AS g
           ON g._id = h._id
JOIN     owners o ON o.service = h.service
WHERE    h.level = 'error'
  AND    h.ts > now() - interval '24 hours'
GROUP BY o.team, h.service
ORDER BY hits DESC;