Performance alerts and AI on traces

Dashboards do not page people. Rules do. Investigation does not start from a blank chat — it starts from the issue, the replay, or the trace already in the project. Talaria keeps those two jobs separate: evaluation that can notify you, and an assistant that can read what you stored.

The problem

Issue inboxes go quiet at 2am. p95 does not. If the only alert is “new exception,” a checkout that got three times slower without throwing will wait for a customer. If the only investigation tool is a general LLM with no tools, it will invent a stack. Permissioned tools over your data are the difference.

What it is

Talaria evaluates three alert kinds:

• Issue — fire on new_issue or reopened at ingest. No numeric threshold.
• Metric — event count matching a query in a time window, compared to a threshold.
• Performance — RED from spans: error_rate, p95, or throughput against a threshold you set.

Delivery: in-app notification rows, email to org admins, and on paid plans Slack (project webhook URL) plus a generic HTTPS webhook with HMAC. Cooldown equals the alert’s time window so a noisy rule does not mail every minute.

AI is a streaming assistant with explicit modes (chat, investigate issue, analyze replay, and related). Tools include searchTraces, getTrace, searchMetrics (RED), plus the error/replay tools (searchIssues, getEvent, getSourceContext, and others). Bring your own provider keys. Usage is metered separately from events and replays.

What it gives a team

• Coverage for silent latency: p95 on POST /checkout without waiting for an exception.
• The same issue workflow for “this fingerprint came back” versus “this is new.”
• An investigator that can open traces, not only stacks — once spans exist.

How Talaria does it

Alert CRUD and evaluation live on the project. Performance rules require ClickHouse span data; they will not fire on an empty Performance overview. Slack and webhook URLs are project settings. There is no live notification bell in the dashboard shell — history is the list of notification rows.

AI requires Capability.useAi and an org provider config. Entry points: org chat, Explain with AI on an event, issue investigator (including cached investigations), replay analyst. It is not auto-paging a human with an incident report unless you wire an alert to Slack yourself.

How to read it

• Start with issue alerts. Add a p95 or error-rate rule on the one route that makes money.
• When a performance alert fires, open RED for the window, then a waterfall — do not start in the AI composer.
• Use AI to summarize an issue or replay after you have the IDs, and distrust answers that do not cite tools.

Turn it on

Tracing must be on for performance alerts to have data. Create a rule under project Alerts. Configure Slack or webhook URLs in project settings on a paid plan. For AI, add a provider under AI settings, then open an issue and run Investigate.

What this is not

No anomaly detection, no PagerDuty integration as a first-class channel, no PromQL. AI is not autonomous incident response, not an agent that pages Slack on every new issue by default, and not a substitute for a fingerprint. It cannot query a log product or host metrics because those stores are not the product.