It gets an excerpt. Never the file.

Copilot reads the context around the thing you asked about and explains what broke, when, and why. Everything else — parsing, clustering, the timeline, every finding — is computed locally whether or not it is configured at all.

Lives in Copilot — the drawer on the right

context shown before the answer
Fig. 01Copilot drawer · context indicator
Search OpenSSH_2k.log…
LLogier
OpenSSH_2k.log
Search log messages, tags, or processes…
Filters
2000 / 2000
TimeStatusHostMessage
06:55:46FATALLabSZ/sshdreverse mapping checking getaddrinfo failed
06:55:46WARNLabSZ/sshdInvalid user webmaster from 173.234.31.186
06:55:46WARNLabSZ/sshdinput_userauth_request: invalid user webmaster
06:55:46ERRORLabSZ/sshdpam_unix(sshd:auth): authentication failure
06:55:48ERRORLabSZ/sshdFailed password for invalid user webmaster
06:55:48INFOLabSZ/sshdConnection closed by 173.234.31.186 [preauth]
06:55:51INFOLabSZ/sshdConnection from 212.47.254.145 port 51022
06:55:53ERRORLabSZ/sshdFailed password for invalid user admin
06:55:53INFOLabSZ/sshdReceived disconnect from 212.47.254.145: 11: Bye
06:56:02WARNLabSZ/sshdpam_unix(sshd:auth): check pass; user unknown
06:56:04ERRORLabSZ/sshdFailed password for invalid user support
Copilot
Why did this spike start at 07:07?
sshd stopped logging for four minutes beforehand, then resumed at roughly nine times its earlier rate. Every entry since shares one signature — a failed password for an invalid user — from 41 distinct addresses.

Context sent

412 lines around the finding

Cluster summary · 312 shapes

Never: the full file

The indicator is the point: the app tells you what it sent before you read what came back, so the answer's blind spots are visible rather than implied.

What crosses the line, exactly.

The excerpt is scaled to your token budget — roughly half of it, clamped between 1k and 120k characters — and can be scoped to a time window you pick. Anomaly excerpts are pulled with a sliding window around the finding.

The full file is never sent, under any configuration.

Format detection and parsingLocal — never sent
Clustering, timeline, findingsLocal — never sent
Search and filteringLocal — never sent
The full log fileNever sent, under any configuration
The excerpt around the entry you asked aboutSent to the provider you configured

Your key. Your account.

There is no Logier inference service and no proxy in the middle. Keys are stored locally and are never included in settings sync — the payload names the fields it sends, and API keys are not among them.

  • OpenAIYour key, your account
  • AnthropicClaude models
  • GoogleGemini
  • Ollama / LM StudioRuns on your machineoffline
  • Any OpenAI-compatible endpointSelf-hosted or internaloffline
what it answerswhat it won't

The answers that matter most are the ones it declines.

Any model will produce a confident paragraph about a log file. The useful behaviour is knowing when the file doesn’t contain the answer and saying so — then naming the log context that would. Three real shapes of that:

Q.

What deployed at 14:01?

A.

Nothing in this file records a deploy. The first timeout is at 14:02:07 — if your deploy tooling writes to a separate log, opening it alongside this one would let me line them up.

Q.

Is the database down?

A.

I can't tell from these entries. Every failing line here is the web tier reporting an upstream timeout; there are no database logs in this file to confirm or rule that out.

Q.

How many users were affected?

A.

This log has no user or session identifiers on the failing lines, so any number I gave you would be invented. The request IDs are present, if a count of failed requests is useful instead.

Illustrative exchanges — the shape of the behaviour, not transcripts. The same principle governs generated reports: the prose may be written by the model, but every figure renders from a deterministic payload computed locally.

faq

Common questions

keep reading

Where this fits

  1. 01

    Secure by default

    The full accounting of what leaves your machine — Copilot's excerpt is the only thing on the list, and only if you configure it.

  2. 02

    Anomaly detection

    The findings Copilot reasons over are computed locally first, with no model involved.

Bring your own key. Or no key at all.

Point Copilot at a hosted provider, or at a model running on your own machine. Everything else in Logier works either way.