Use Better Stack with Sazabi: incidents, monitors and telemetry queries

Last verified on Nov 8, 2026.

Better Stack combines uptime monitoring, on-call, incident management and telemetry. Sazabi, the AI-native observability and security platform, connects its agent to Better Stack's hosted MCP server. The agent can then read the incident and the monitor next to your logs without you pasting links into a thread.

What the Sazabi agent can do with Better Stack

You connect with OAuth and dynamic client registration. After that the agent can:

• view incidents and on-call context
• inspect uptime monitors and heartbeats
• browse log sources and telemetry
• build custom queries with AI against Better Stack Telemetry

Writes follow the per-connection read-only toggle in Sazabi. Better Stack adds its own gate: to create, change or remove monitors and heartbeats, its docs say you choose Full access when you sign in with OAuth. Read-only sign-in stays read-only.

Better Stack's MCP reference describes how queries work. Instruction tools such as Get query instructions, Get metric query instructions and Get errors query instructions explain how to write a query for each data type. Execute query then runs a ClickHouse SQL query against your logs, spans, metrics, exceptions and replays. Better Stack can also narrow the tool list with X-MCP-Tools-Only and X-MCP-Tools-Except headers, which matters if you want an agent to see monitors but not dashboards.

Questions it answers

• Which incidents are open right now, and who is on call for them?
• Is this monitor down, or did only one check fail?
• Did a heartbeat go missing before the first error log?
• Which log sources does Better Stack have for this service?
• What query would count these errors by hour in Better Stack Telemetry?

A worked example: a missed heartbeat

Better Stack's heartbeat monitor expects regular requests to a unique URL. If the request does not arrive within the configured frequency and grace period, it raises an incident and notifies the on-call team. That is a useful trigger for batch jobs. Suppose the nightly export did not check in. In a thread you ask the Sazabi agent:

Which Better Stack heartbeats are in an incident? For the nightly export, show
who is on call, then check our logs for the export service around the time
the heartbeat was due.

The agent can list the incident and its heartbeat, read the on-call details, and then search Sazabi's logs for that service in the same window. Read the two results together. If the logs end abruptly before the due time, the job crashed, so the next step is the last error line. If the job logged success and the heartbeat still failed, the ping itself is broken: check that the final step calls the heartbeat URL, and that the grace period is long enough for a slow night. If the logs are empty for the whole window, the scheduler never started the job.

To go further, ask the agent to follow Better Stack's instruction tools and run a ClickHouse query over the same window in Better Stack Telemetry. That answers whether Better Stack holds data Sazabi does not. Keep the connection read-only for a first pass. You can always reconnect with wider access when you want the agent to change a monitor.

How it fits with other integrations

Better Stack is one of the stacks the Sazabi agent can read alongside Datadog, Honeycomb and Grafana. They are all grouped under observability tools. For telemetry from your own code, use OpenTelemetry, and see the integrations index for every method.