Background: Why I Chose the Vector – DeepSeek – Telegram Trio
After running a microservices system for over six months, I faced a nightmare: more than 50GB of logs generated daily, but 99% of it was noise. My old troubleshooting process was manual: receive a notification, SSH into the server to grep logs, and finally copy-paste into ChatGPT. This was exhausting, especially when incidents happened at 2 AM.
When searching for alternatives, I considered the ELK Stack. However, ELK is too heavy for small to medium server clusters, consuming several GBs of RAM just to start. Eventually, I chose Vector. It’s a log collection tool written in Rust, ultra-lightweight, and only uses about 20-30MB of RAM. Combined with DeepSeek-R1 (the name currently taking the AI world by storm with its reasoning capabilities) and Telegram, I created a 24/7 on-call assistant.
The biggest selling point of DeepSeek-R1 is its ability to understand log context. It doesn’t just report a soulless Internal Server Error. It points out specifically: “The database connection pool is overflowing; increase max_connections or check for connection leaks.” Thanks to this, my team reduced Mean Time to Recovery (MTTR) by 70%.
Installing Core Components
1. Installing Vector
Vector acts as the data “transporter.” It gathers logs from files or Docker containers and pushes them to the AI. On Linux, you can install it in under 30 seconds:
curl --proto '=https' --tlsv1.2 -sSf https://sh.vector.dev | sh2. Running DeepSeek-R1 Locally via Ollama
To ensure data security and avoid leaking sensitive logs to the cloud, I run DeepSeek-R1 on my internal server. If your server lacks a GPU, use the 7B or 14B version for smooth performance locally via Ollama.
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh
# Pull the DeepSeek-R1 model
ollama run deepseek-r1:7b3. Setting up the Telegram Bot
Simply chat with @BotFather to get your Bot Token. Then, use @userinfobot to get your personal Chat ID. This will be the channel for receiving real-time error analysis reports.
Configuring the Analysis System
The heart of the system lies in the vector.yaml file. Instead of wasting resources by pushing all logs, I only filter for ERROR or CRITICAL levels.
Step 1: Filtering and Formatting Logs
The following configuration monitors log files and removes redundant information before sending it to the AI.
sources:
app_logs:
type: "file"
include:
- "/var/log/myapp/*.log"
read_from: "beginning"
transforms:
error_filter:
type: "filter"
inputs:
- "app_logs"
condition: |
includes(["ERROR", "CRITICAL", "EXCEPTION"], upcase!(string!(.message) ?? ""))
log_formatter:
type: "remap"
inputs:
- "error_filter"
source: |
.content = "The system encountered the following error: " + .message
del(.file)
del(.host)Step 2: Building the AI Bridge
Currently, Vector does not support direct conversational calls to Ollama. Therefore, I wrote a small Python script to act as a bridge. This script receives the log, queries DeepSeek-R1, and then sends the results to Telegram.
import requests
from flask import Flask, request
app = Flask(__name__)
OLLAMA_URL = "http://localhost:11434/api/generate"
TELEGRAM_TOKEN = "YOUR_BOT_TOKEN"
CHAT_ID = "YOUR_CHAT_ID"
def ask_deepseek(log_content):
prompt = f"You are a DevOps expert. Analyze the following error and provide the cause and a concise fix: {log_content}"
payload = {"model": "deepseek-r1:7b", "prompt": prompt, "stream": False}
response = requests.post(OLLAMA_URL, json=payload)
return response.json().get("response", "Unable to analyze the error.")
@app.route('/alert', methods=['POST'])
def handle_log():
log_data = request.json
analysis = ask_deepseek(log_data.get("content", ""))
msg = f"🚨 *SYSTEM ERROR ALERT*\n\n📝 *Log:* {log_data['content']}\n\n💡 *Analysis:*\n{analysis}"
requests.post(f"https://api.telegram.org/bot{TELEGRAM_TOKEN}/sendMessage",
data={"chat_id": CHAT_ID, "text": msg, "parse_mode": "Markdown"})
return "OK", 200
if __name__ == '__main__':
app.run(port=5000)Real-world Results
To verify, I simulated a database connection failure using the following command:
echo "2024-05-20 15:30:00 ERROR: Connection timeout to database 10.0.0.5:5432" >> /var/log/myapp/app.logLess than 5 seconds later, Telegram notified me of a new message. The content was incredibly detailed:
🚨 SYSTEM ERROR ALERT
📝 Log: Connection timeout to database 10.0.0.5:5432
💡 Analysis:
The cause might be a firewall blocking port 5432 or the database server hanging. You should check the command `nc -zv 10.0.0.5 5432` to verify network connectivity.
Practical experience shows that DeepSeek-R1 often returns a fairly long reasoning section (the <think> tag). You should fine-tune the prompt so the AI focuses only on the final result. Additionally, set a rate_limit in the Vector sink to avoid “spamming” messages when a cascading failure occurs.
This system has been running stably for six months and has truly been a lifesaver for small teams. Good luck with your implementation!
