Alibaba Cloud's cloud-native community published a walkthrough on 29 October of two pieces it says fix a common support problem: a semantic layer over SLS log stores, and a DataAgent that carries that layer.
The worked example is a game support ticket. A player paid 648 CNY for an in-game top-up and received nothing. The order shows payment succeeded, the payment callback shows a valid signature, the delivery log holds one line, deliver_status = failed, and the system log adds the error code BAG_FULL: the inventory was full, delivery retried, and every retry failed.
The authors' point is that logs record facts, not conclusions. Neither a person nor a model can infer from deliver_status = delivered, or from item_id = WPN_LEG_001 alone, that these mean "delivered" and a named weapon. The semantic layer collects fields, enum values, business metrics, glossary terms and samples into a business dictionary. The DataAgent is bound to at least one context model, maps a natural-language question onto an explicit metric definition and data source, then builds queries and drafts a conclusion.
The demo spans three log stores - business transactions, audit, and system runtime - joined through business identifiers such as order_id, battle_id and item_uuid. The authors state that the logs and the sample game are synthetic.
Our takeThe design choice worth copying is the ordering: define the metric, then query. Most agent-over-logs demos let the model guess what a field means and hope the answer sounds right; here the enum values and definitions are written once, so two agents answering the same question cannot quietly mean different things. The bill comes due in maintenance - a dictionary that drifts from the pipeline is worse than none. And on synthetic logs, the claim that this replaces three to six sequential queries is not yet evidence.