Telemetry intelligence

Ampbase reads a reduced summary of the telemetry your agents are already producing and tells you where it is costing you money — a label with 40,000 distinct values, a channel whose volume tripled, a service worth sampling harder.

The results are findings: durable, dismissible recommendations that carry the evidence behind them. They appear on the Intelligence page and can be delivered as webhooks.

What it looks at

Analyzer	Answers
Cardinality	Which metric labels have enough distinct values to be driving your bill?
Cost	Which channels account for your volume, split by logs / metrics / traces?
Sampling	Which services carry enough traffic — and few enough errors — to sample harder in your pipeline?
Anomaly	Which of those moved sharply yesterday, or has been drifting for a couple of weeks?

What leaves your host

This is the part worth reading even if you skip the rest. Ampbase does not receive a copy of your telemetry.

   your host                                  Ampbase
   ─────────                                  ───────

   agent ──full stream──▶ ampbase supervisor
                            │
                            │  reduces on the spot:
                            │
                            │   label values  ─▶ a sketch: how many
                            │                    distinct, never which
                            │   log bodies    ─▶ a masked template
                            │                    plus a count
                            │   span contents ─▶ rate / error /
                            │                    duration rollups
                            │
                            └───────────────────▶  only the summaries
                                                   cross the network

Label values, log message bodies, and span attributes never leave the machine. What ships is a set of mergeable summaries with no way back to the original values.

Two consequences worth knowing:

Distinct-value counts are estimates. They come from a sketch, so a finding will say a label has about 40,000 values, not exactly. The error is a small percentage, and the dashboard marks any approximate number as such.
There is no sampling in front of it. The supervisor reduces over your whole stream rather than a slice, because a high-cardinality label is high-cardinality precisely by having many rare values — a 1% sample would miss almost all of them.

Turning it on

Intelligence export is enabled per channel, from the channel's Intelligence page. Ampbase then offers the export to that channel's agents over OpAMP and the supervisor starts a loopback receiver on demand.

Your configuration is never edited. The export is injected as a system-owned entry when the config is delivered; your configs and bundles are untouched, and disabling removes it the same way.
No credential is involved. The agent duplicates its stream to 127.0.0.1 on the same host — nothing is sent anywhere new by the agent itself.
You can roll it out to everything at once, or stage it to a percentage of the fleet first.

Analysis then runs on a schedule; you can also trigger a run from the dashboard. How often a manual run is allowed depends on your plan.

What a finding is

A finding is a standing condition, not an event. The same high-cardinality label seen on Monday and Wednesday is one finding with a last seen date, not two.

   Open        a run found it and you haven't acted
     │
     ├─ you dismiss it ──────▶  Dismissed   never resurfaces, even
     │                                      if a later run finds it
     │
     └─ a later run no longer ─▶  Resolved   the condition is gone
        reproduces it                  │
                                       │  if it comes back…
                                       ▼
                                   Regressed   the same finding
                                               reopening, not a new one

Dismissing is permanent and personal to your org. It means "stop telling me about this" — a later analysis that finds the same thing again will not reopen it.

Resolved means we looked and it was gone. If a run could not evaluate something — the analysis was rate-limited, or the label fell outside the top results that run returned — the finding is left exactly as it was rather than being marked resolved. Absence of evidence isn't treated as evidence of absence.

The evidence behind a finding

Every finding carries an evidence packet, shown in the dashboard and included in the webhook payload. It exists so you can check the recommendation instead of trusting it.


Window	The date range measured — stated, never implied.
Method	How the number was produced, and whether it is exact or approximate.
Coverage	How much was examined, and whether you're seeing a partial view.
Counterchecks	The same subject compared against your own 4-week norm, so a finding isn't a number without a reference point. Each is marked elevated, typical, or reduced.
Known gaps	What the measurement could not establish, in plain words.

That last row is deliberate. If Ampbase cannot make a comparison — your org is too new to have a norm yet, or a subject falls outside what a run examined — the packet says so rather than quietly leaving it out.

Where to go next

Webhooks — deliver findings to your own systems, including the full evidence packet.
Structuring your channels — cost and volume findings are reported per channel, so how you split them decides how the numbers group.

Spotted a problem with these docs? Email support@ampbase.io.