Pillar Embeddings

:::tip Pillar Embeddings is one kind of pillar A pillar is a data domain. See Custom Pillars for the general model, where any data (SMS delivery, transactions, call records) becomes a first-class monitored domain.

This page covers the embedding pillars specifically: anomaly detection over groups of services. :::

Pillar embeddings take InfraSage's anomaly detection beyond the single service. Instead of asking "is this service behaving unusually?", they ask "is this tenant, this product, or any other grouping you define behaving unusually, taken together?"

A single service can look fine on its own while the fifty services belonging to one customer together show a rising error rate and slowing responses. That only becomes visible when you look at them as a group.

How it works

Every minute, InfraSage takes the services in each group, combines their behavior into one picture for the group (errors, volume, latency, fatal and warning logs, and more) and compares it with how that group normally behaves at that time of day and day of week. Each group gets a weirdness score from 0 to 1:

Score	Interpretation
0.0-0.4	Normal, within the group's usual range
0.4-0.7	Elevated, worth a look
0.7-1.0	Anomalous, likely an incident affecting this tenant or product

Time of day matters: elevated volume on a Monday morning is normal, the same volume at 3 AM on a Saturday is not.

Built-in pillars

Two pillars ship with the platform. You can switch them on or off, but not delete them.

• Tenant: groups all services belonging to the same tenant_id, judged on errors, volume, latency, fatal and warning logs, and how many services are active.
• Product: groups services by product_id, judged on the same signals plus queue depth, which suits asynchronous, message-driven products.

Custom groupings

You can group services by anything else that matters to you: region, availability zone, team, environment, cost center.

1. Tag the services. Add the key to each service's entry in the service map:

   curl -X PUT https://api.infrasage.dev/api/v1/pillars/service-map \
     -H "Authorization: Bearer $TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
       "entries": [
         {
           "service_id":  "payment-service",
           "tenant_id":   "acme-corp",
           "product_id":  "checkout",
           "custom_keys": { "region": "ap-south-1" }
         },
         {
           "service_id":  "auth-service",
           "tenant_id":   "acme-corp",
           "product_id":  "platform",
           "custom_keys": { "region": "us-east-1" }
         }
       ]
     }'

2. Create the pillar. In the console, open Pillar Embeddings → Manage Pillars → New custom pillar, choose the key (region above) and the signals to judge each group on. Storage for the new pillar is set up for you. Only admins can create or change pillars.

Changes take effect within a minute.

API reference

Method	Path	Description
GET	/api/v1/pillars/registry	List every registered embedding pillar, enabled or not
GET	/api/v1/pillars/{name}/config	Get a pillar's configuration
DELETE	/api/v1/pillars/{name}	Delete a custom pillar (its history is kept)
GET	/api/v1/pillars/{name}/anomalies	Query weirdness scores
GET	/api/v1/pillars/service-map	List service → pillar-key mappings
PUT	/api/v1/pillars/service-map	Bulk upsert service mappings
GET	/api/v1/pillars/hub	Card-grid rollup: ticks, errors, alerts, records and cost per pillar, last hour

Writes require an admin role.

:::caution /api/v1/pillars is a different surface The bare path serves the Pillars Hub status view, not this registry. Use /api/v1/pillars/registry to list embedding pillars. :::

Query anomaly scores

# Last 24 hours for the tenant pillar, filtered to one tenant
GET /api/v1/pillars/tenant/anomalies?hours=24&key=acme-corp&limit=100

Response:

{
  "pillar": "tenant",
  "anomalies": [
    { "key": "acme-corp", "window": "2026-05-13T10:00:00Z", "score": 0.82 },
    { "key": "beta-inc",  "window": "2026-05-13T10:00:00Z", "score": 0.23 }
  ],
  "count": 2,
  "lookback_hours": 24
}

The Pillar Embeddings page

Open Pillar Embeddings in the sidebar (operator role required).

Anomaly Scores tab. Pick a pillar, a look-back window (1 h to 7 d) and optionally one key. Score bars run from green (low) through yellow to red (high).

Service Map tab. See every service's tenant, product and custom keys, and bulk-import them from CSV, one line per service: service_id, tenant_id, product_id.

Manage Pillars tab. Switch built-in pillars on or off, create custom pillars, and delete them (built-ins are protected).

Service map

Services must be mapped before they count toward a pillar: an unmapped service is left out without an error. See the Service Pillar Map guide for bulk import and automation.

Troubleshooting

No scores appear for a pillar.

1. Check that the pillar is enabled: GET /api/v1/pillars/{name}/config → "enabled": true.
2. Check that services are mapped: GET /api/v1/pillars/service-map must return at least one entry.
3. Check that the mapped services actually carry the key the pillar groups by. A tenant pillar produces nothing if the map rows have an empty tenant_id, and a region pillar nothing if no service has a region custom key.
4. Check the aiops-engine logs for errors mentioning the pillar name:

   kubectl logs -n infrasage -l app.kubernetes.io/component=aiops-engine | grep -i pillar