Observe v2.3 Release Notes: NL2Query, Metrics Explorer and Alert Silencing

New: NL2Query natural-language search

The biggest change this release: log search now understands natural language. Type "ERROR logs from order-service in the last hour" and the engine translates it into a structured query:

SELECT * FROM logs WHERE service = 'order-service' AND level = 'ERROR' AND ts > now() - 1h

The translated SQL is shown in the UI, so you can edit it before running — no black box. It handles time ranges ("last hour", "since this morning"), field filters ("service = pay", "level in (ERROR, WARN)") and simple aggregations ("count of errors per service"). Anything too complex gets a clear "I couldn't translate this" instead of a wrong query — better to refuse than to guess. Newcomers skip learning the query syntax, and veterans use it as a shortcut for common lookups.

New: Metrics Explorer

Previously you could only view preset charts. Metrics Explorer lets you pick any metric, group by label, choose an aggregation and a time range, and build ad-hoc charts without creating a dashboard first. For example: "p99 latency of order-service, grouped by pod, over the last 6 hours" becomes a chart in a few clicks. It's built for spot troubleshooting and hypothesis testing — answer a one-off question in seconds, then throw the chart away.

Improved: alert silencing and convergence

• Alert rules gain silence windows for one-click muting during releases and maintenance. You can schedule them in advance so a planned deploy doesn't wake anyone.
• Storm convergence: when one failure hits many instances, alerts merge into a single summary that lists the affected instances, instead of one alert each.

Improved: trace hydration performance

Expanding large traces is noticeably faster. A 100,000-span trace now goes from expanded to fully interactive in roughly 1.5 seconds, down from about 6 seconds. Long-span traces — common in asynchronous and batch-heavy systems — feel far more responsive to scroll and inspect.

Fixes

• Fixed pagination cursors failing on very large log query result sets.
• Fixed timezone settings being ignored, which skewed timestamps for cross-timezone teams.
• Fixed a compile failure caused by a naming collision between the SMS module and a utility function (affected some private deployments).

NL2Query under the hood

NL2Query is a two-step translation: the model turns your sentence into an intermediate query plan, then a deterministic layer validates that plan against the real schema before anything runs. That validation is what keeps the feature safe — the model can propose, but only a well-formed query against actual fields gets executed. If a field doesn't exist or the aggregation isn't supported, you get your sentence back with a hint instead of a silent wrong answer.

We also capped cost. Natural-language queries hit a small, fast model by default; the larger model is only used when the request is genuinely complex. Most lookups stay fast and cheap, and nothing you type is used to train any external model.

What's next

On the roadmap for v2.4: saved NL2Query searches shared across a team, importable alert-rule templates, and a guided onboarding flow for the OpenTelemetry Collector. If you want any of these early — or have a different itch — the feedback button in the console goes straight to the product team.

Upgrade notes

• Private deployments: back up the database first, swap the binary, then run observe --migrate. The migration is idempotent, so re-running it is safe.
• Alert rules gained a for (duration) field; old rules default to 1 minute — adjust as needed.
• NL2Query depends on an LLM service; private deployments must configure the model endpoint and key separately. No queries are sent outside your network.