> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/feature-guides/pipeline-intelligence/pipeline-intelligence.md).

# Overview

Pipeline Intelligence is a suite of recommendations and AI-powered features that help you understand your telemetry data and automate your pipeline configuration.

## Pipeline Intelligence

Pipeline Intelligence allows you to avoid manual configuration and complex OTTL syntax, and instead use natural language descriptions and intelligent data analysis to quickly build and optimize your pipelines.

With Pipeline Intelligence, you can:

* [Automatically identify and categorize log types from your telemetry data](/feature-guides/pipeline-intelligence/inspect-telemetry.md#get-log-types)
* [Standardize log types for Google SecOps ingestion](/feature-guides/pipeline-intelligence/inspect-telemetry.md#standardize-log-type-for-secops)
* [Validate that your logs will parse correctly in Google SecOps](/feature-guides/pipeline-intelligence/inspect-telemetry.md#validate-secops-parser)
* [Generate components using natural language](/feature-guides/pipeline-intelligence/generate-components.md#generate-with-natural-language)
* [Parse complex telemetry into structured data](/feature-guides/pipeline-intelligence/generate-components.md#generate-parsers)
* [Get intelligent recommendations for pipeline improvements](/feature-guides/pipeline-intelligence/generate-components.md#recommendations)
* [Migrate existing configurations from OpenTelemetry, Chronicle Forwarder, and Splunk Universal Forwarder](/feature-guides/pipeline-intelligence/migrate-configurations.md)
* [Get recommendations based on continuous monitoring across all your pipeline data with Global Pipeline Intelligence](#global-pipeline-intelligence)

## Global Pipeline Intelligence

Global Pipeline Intelligence applies the same intelligence across all your pipeline data, continuously. Recommendations surface as notifications based on what's actually flowing through your pipelines, without you having to open a snapshot. Learn more about Global Pipeline Intelligence here.

## AI Features

{% hint style="info" %}
Pipeline Intelligence AI features are only available for Enterprise, Bindplane Enterprise (Google Edition), and Honeycomb licenses.
{% endhint %}

Some Pipeline Intelligence features use generative AI to analyze your data and produce configurations. Others, like the Chronicle Forwarder and Splunk Universal Forwarder migrator, use deterministic logic with no AI involved. The table below shows which features use AI.

<table><thead><tr><th width="166.5">Feature</th><th width="147.25">Capability</th><th>Provider(s)</th><th width="170">Model</th><th width="117.5">Data Used for Model Training?</th><th width="121">Uses Generative AI?</th></tr></thead><tbody><tr><td><a href="/integrations/processors/ocsf-standardization.md#generate-event-mappings-with-ai">Automatic OCSF Event Mapping</a></td><td>OCSF event mapping generation</td><td><a href="https://docs.cloud.google.com/gemini/docs/discover/data-governance">Google Gemini</a></td><td><code>gemini-3.7-flash</code></td><td>No</td><td>Yes</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/bindplane-agent.md">Bindplane Agent</a></td><td>Agentic chat assistant</td><td><a href="https://docs.cloud.google.com/gemini/docs/discover/data-governance">Google Gemini</a></td><td><code>gemini-3.7-flash</code></td><td>No</td><td>Yes</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/generate-components.md#generate-processors">Generate Processors</a></td><td>Processor generation</td><td><a href="https://docs.cloud.google.com/gemini/docs/discover/data-governance">Google Gemini</a></td><td><code>gemini-3.7-flash</code></td><td>No</td><td>Yes</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/generate-components.md#generate-windows-events-xml-query">Generate Windows Events XML Query</a></td><td>Query generation</td><td><a href="https://docs.cloud.google.com/gemini/docs/discover/data-governance">Google Gemini</a></td><td><code>gemini-3.7-flash</code></td><td>No</td><td>Yes</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/inspect-telemetry.md#get-log-types">Get Log Types</a></td><td>Log classification</td><td><a href="https://docs.cloud.google.com/gemini/docs/discover/data-governance">Google Gemini</a></td><td><code>gemini-3.5-flash-lite</code></td><td>No</td><td>Yes</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/inspect-telemetry.md">Get Log Type and Body Format</a></td><td>Log classification</td><td><a href="https://docs.cloud.google.com/gemini/docs/discover/data-governance">Google Gemini</a></td><td><code>gemini-3.5-flash-lite</code></td><td>No</td><td>Yes</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/migrate-configurations.md#chronicle-forwarder">Migrate Configurations (Chronicle Forwarder)</a></td><td>Config conversion</td><td>—</td><td>—</td><td>No</td><td>No</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/migrate-configurations.md#opentelemetry">Migrate Configurations (OTel)</a></td><td>Config conversion</td><td><a href="https://docs.cloud.google.com/gemini/docs/discover/data-governance">Google Gemini</a></td><td><code>gemini-3.7-flash</code></td><td>No</td><td>Yes</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/migrate-configurations.md#splunk-universal-forwarder">Migrate Configurations (Splunk Universal Forwarder)</a></td><td>Config conversion</td><td>—</td><td>—</td><td>No</td><td>No</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/generate-components.md#parse-field">Parse Field</a></td><td>Field parsing</td><td><a href="https://docs.cloud.google.com/gemini/docs/discover/data-governance">Google Gemini</a></td><td><code>gemini-3.7-flash</code></td><td>No</td><td>Yes</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/generate-components.md#parse-with-regex">Parse with Regex</a></td><td>Regex generation</td><td><a href="https://docs.cloud.google.com/gemini/docs/discover/data-governance">Google Gemini</a></td><td><code>gemini-3.7-flash</code></td><td>No</td><td>Yes</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/generate-components.md#recommendations">Pipeline Intelligence Recommendations</a></td><td>Processor recommendations</td><td><a href="https://docs.cloud.google.com/gemini/docs/discover/data-governance">Google Gemini</a></td><td><code>gemini-3.7-flash</code></td><td>No</td><td>Yes</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/inspect-telemetry.md#standardize-log-type-for-secops">Standardize Log Type for SecOps</a></td><td>Processor generation</td><td><a href="https://docs.cloud.google.com/gemini/docs/discover/data-governance">Google Gemini</a></td><td><code>gemini-3.7-flash</code></td><td>No</td><td>Yes</td></tr><tr><td><a href="/feature-guides/pipeline-intelligence/inspect-telemetry.md#validate-secops-parser">Validate SecOps Parser</a></td><td>Parser validation</td><td>—</td><td>—</td><td>No</td><td>No</td></tr></tbody></table>

## How your data is used

When AI features are enabled, only the minimal input data needed to generate a response (such as log structure and content snippets) is sent for processing. We do not store AI inputs after processing. Data is used solely during transmission to generate a response and is not retained. Two features keep data for a limited time: the [Bindplane Agent (beta)](/feature-guides/pipeline-intelligence/bindplane-agent.md) saves your chat history for up to 14 days, and Global Pipeline Intelligence retains data snapshots for up to 10 days.

Bindplane uses an internal AI observability tool to evaluate whether AI features are performing correctly. Only metadata such as token counts and timing is transmitted, never the content of your data.

Pipeline Intelligence AI features are off by default. Nothing changes in your environment until an org admin explicitly enables them.

For full details, please review the [Data privacy and security](/feature-guides/pipeline-intelligence/data-privacy-and-security.md) page, our [Privacy Policy](https://bindplane.com/legal/privacy-policy), and our [EULA](https://bindplane.com/legal/eula).

## Best Practices

* Always review AI-generated processors before deploying to production. While AI is designed to create correct configurations, it may make mistakes.
* Things to verify:
  * Field paths match your actual data structure
  * Conditions and filters work as expected
  * Processor order is correct for your use case
* Begin with simple requests and gradually add complexity.
* Use multiple Pipeline Intelligence features together:
  * Use "Get Log Types" to identify log types
  * Use "Standardize Log Types for SecOps" on those log types if needed
  * Use "Parse Field" to parse fields if needed
  * Use "Generate Processors" to add any transformations


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.bindplane.com/feature-guides/pipeline-intelligence/pipeline-intelligence.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.