Building an LLM-Powered Log Triage Pipeline with Python and DeepSeek-R1

Short summary

A developer automated infrastructure log monitoring with a two-stage pipeline: keyword patterns classify Docker logs by severity, then DeepSeek-R1 1.5B model running on Oracle Cloud via Ollama summarizes critical entries in plain English and posts them to Discord. The Python script runs every 15 minutes via cron, bridging the gap between Prometheus metrics and actual health signals—handling internal errors, retries, and deprecations that metrics alone miss. Rules-based filtering prevents pointless LLM calls on routine logs.

• •Two-stage pipeline: keyword severity classification + LLM summarization
• •DeepSeek-R1 1.5B via Ollama produces plain-English log summaries
• •Runs every 15 minutes, posts actionable alerts to Discord via Tailscale

Generated with AI, which can make mistakes.