Simple Log Service:AI Chat Assistant

1. Log on to the Simple Log Service console.

2. Choose Log Applications > AI Chat Assistant, then click Digital Employees.

3. On the digital employees list page, click Create Digital Employee in the upper-right corner.

4. In the Create Digital Employee dialog box, configure the following parameters:

   Parameter	Required	Description
   ID	Yes	A unique identifier for the digital employee. You cannot change it after creation. Use letters and numbers only. For example, order-system-expert.
   Display name	Yes	The name shown for the digital employee in the console. Use a business-specific name. For example, Order System Monitoring Expert or Big Data Cluster Inspector.
   RAM role type	Yes	Select the RAM role type for the digital employee: • Service role: Uses a system-provided service role (no setup needed). The digital employee gets read-only access to Simple Log Service and ARMS automatically. • Custom role: Choose this option if you need access to a specific Model Studio knowledge base or want to limit access scope. Enter the ARN of an authorized RAM role. For details, see Create a RAM role and grant permissions.
   RAM role ARN	Yes	The service role uses ServiceRoleForCloudMonitor by default. This role has read-only access to Cloud Monitor 2.0 data, including Simple Log Service and ARMS.
   Built-in SLS knowledge base	No	Enable this option to let the digital employee answer SLS-related questions. Enabled by default.
   Description	No	Describe the employee’s responsibilities and strengths. For example: Performs daily inspections of core applications in the Order Hub, analyzes anomaly alerts, identifies root causes, and supports MySQL slow-query analysis.
   Default rule	No	A default rule that guides the digital employee’s work. Use Markdown syntax. Define the employee’s role, scope of capabilities, and code of conduct.

5. After configuration, click OK.

SOP knowledge base structure

SOP knowledge bases use a progressive folder structure. The core entry file is SOP.md. Organize files by module so the agent can retrieve the necessary knowledge from the structure.

We recommend this folder structure:

Root directory of the knowledge base/
├── SOP.md                  # Core entry file. Summarizes knowledge across domains.
├── accesslog/              # Access log domain
│   ├── overview.md         # Domain overview
│   └── troubleshooting.md  # Troubleshooting guide
├── monitoring/             # Monitoring domain
│   ├── overview.md
│   └── alert-handling.md
└── ...

You can describe the knowledge summary for each domain in SOP.md. Then add detailed content in the corresponding files under each subfolder.

Associate the built-in SLS knowledge base

The built-in SLS knowledge base includes standard operating procedures and best practices for Simple Log Service. It helps answer SLS-related questions.

Method 1: Enable during creation

Keep the Built-in SLS knowledge base toggle enabled when you create the digital employee.

Method 2: Add after creation

1. In the digital employees list, click the target employee to open its details page.

2. Click the Knowledge Bases tab.

3. Click Add Knowledge Base and select Built-in Knowledge Base.

4. In Knowledge Base ID, enter sls, then click OK.

Associate an OSS knowledge base

If your SOP documents are stored in OSS, follow these steps to associate an OSS knowledge base.

Prerequisites

• You created an OSS bucket and uploaded your SOP documents.

• You created and configured a custom RAM role. For more information, see Create a RAM role and grant permissions.

Procedure

1. You can change the digital employee’s RAM role type to Custom role and enter the ARN of the authorized RAM role.

2. In the digital employee’s details page, click the Knowledge Bases tab.

3. Click Add Knowledge Base and select OSS Knowledge Base.

4. Configure the following parameters:

   Parameter	Description
   OSS Region	The region where your OSS bucket resides.
   OSS Bucket	The name of your OSS bucket.
   Root path of the knowledge base	The directory path containing the SOP.md file. If SOP.md is in the bucket root, enter /. If it is in a subdirectory, enter the full path. For example, /docs/sop/.

5. Click OK.

Associate an Apsara Devops knowledge base

If you manage SOP documents in Apsara Devops (Codeup), follow these steps to associate an Apsara Devops knowledge base.

Prerequisites

• You created a code repository and uploaded SOP documents in the Apsara Devops console.

• Your Personal Access Token (PAT) has been created.

Obtain configuration information

1. Organization ID: In the Apsara Devops console, click your code repository. You can copy the organization ID from the URL. The URL format is https://codeup.aliyun.com/organization-ID/repository-name.

2. Repository ID: On the repository page, go to Settings > Basic Information.

3. Personal access token:

   • In the Apsara Devops console, click your profile picture in the upper-right corner and choose Personal Settings.

   • Choose Personal Access Tokens, then click Create Access Token.

   • Enter a token name, set an expiration time and permissions, then click Create.

   • Copy and save the generated token. You can view it only once.

Procedure

1. In the digital employee’s details page, click the Knowledge Bases tab.

2. Click Add Knowledge Base and select Apsara Devops Knowledge Base.

3. Configure the following parameters:

   Parameter	Description
   Organization ID	Apsara DevOps organization ID
   Repository ID	Your code repository ID.
   Branch name	The branch to associate. For example, master or main.
   Personal access token	Your Apsara Devops personal access token.
   Root path of the knowledge base	The directory path containing the SOP.md file.

4. Click OK.

Grant permissions to RAM users

If you use a RAM user to operate the AI Chat Assistant, your administrator must grant the required permissions.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "cloudmonitor.aliyuncs.com"
        }
      }
    }
  ]
}

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads"
      ],
      "Resource": "acs:cms:*:*:digitalEmployee/*"
    }
  ]
}

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:CreateDigitalEmployee",
        "cms:UpdateDigitalEmployee",
        "cms:DeleteDigitalEmployee",
        "cms:CreateThread",
        "cms:UpdateThread",
        "cms:DeleteThread"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    }
  ]
}

Create a RAM role and grant permissions

If you need a custom role—for example, to access an OSS knowledge base—follow these steps to create and authorize a RAM role.

Step 1: Create a RAM role

1. Log on to the Resource Access Management (RAM) console.

2. In the navigation pane on the left, choose Identity Management > Roles.

3. Click Create Role and select Alibaba Cloud Service as the trusted entity type.

4. Configure the following:

   • Role name: Enter a custom role name.

   • Trusted service: Select Cloud Monitor/Cms.

5. Click Complete.

Step 2: Grant permissions to the RAM role

1. You can create a custom policy. The following policy grants read-only access to OSS and Simple Log Service:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetObject",
        "oss:GetObjectAcl",
        "oss:ListObjects",
        "oss:ListObjectVersions"
      ],
      "Resource": [
        "acs:oss:*:*:<OSS_BUCKET_NAME>",
        "acs:oss:*:*:<OSS_BUCKET_NAME>/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "log:Get*",
        "log:List*"
      ],
      "Resource": "*"
    }
  ]
}

Note: Replace <OSS_BUCKET_NAME> with your actual OSS bucket name.

2. You can attach the custom policy to the RAM role.