Expedia's STAR platform uses LLMs for incident root-cause analysis; deterministic workflows reduce mean-time-to-recover

Expedia Group deployed Service Telemetry Analyzer (STAR), an internal AI-assisted observability platform designed to accelerate production incident investigation. Rather than autonomous agents, STAR uses deterministic workflows combining Datadog metrics with LLM-driven analysis: telemetry is collected, analyzed via domain-specific prompts, consolidated into intermediate findings, and summarized into a final report with root causes and next steps. The goal: reduce time-to-know (TTK) and time-to-recover (TTR) while keeping humans responsible for validation and decision-making.

STAR is built as a FastAPI application integrating Datadog for service metrics and Expedia's internal generative AI gateway managing LLM access. The system analyzes infrastructure metrics across Kubernetes-based services and JVM applications: request throughput, latency, error rates (HTTP/gRPC/GraphQL), CPU/memory utilization, container restarts, probe failures, Java heap state, and garbage collection. Expedia uses standardized infrastructure telemetry to maintain consistency across services built in different languages. The backend evolved from FastAPI background tasks to a Celery + Redis asynchronous architecture to handle concurrent analyses and respect rate limits from Datadog and the internal AI gateway.

STAR deliberately avoids function calling, RAG, autonomous tool use, and memory—relying instead on predefined workflows to ensure consistent, auditable analyses that engineers can quickly validate. The platform has supported production incident investigations, post-mortem analysis, Kubernetes troubleshooting, and JVM memory diagnostics. Expedia is expanding the platform to incorporate service dependency information, MCP-based tool integrations, and conversational interfaces. Prompt management and eval use Langfuse.

For SRE teams: STAR demonstrates a pragmatic middle ground between prompt-to-Datadog magic and fully autonomous observability agents. By keeping workflows deterministic and human-supervised, Expedia avoided hallucination risks while maintaining LLM reasoning over complex metric sets. The Celery + Redis async pattern is worth studying if your incident response pipeline processes multiple concurrent analyses. Watch for open-source derivatives as platforms like New Relic and Datadog integrate similar workflows.