Auto-attach log evidence to new Linear bug tickets

Build me an agent workflow that automatically enriches new bug tickets in Linear with matching log evidence from Elasticsearch. This is the reactive twin to my existing scheduled spike-detection workflow: that one creates tickets from spikes, this one enriches tickets my team files by hand.

Trigger: a Linear webhook that fires when a new issue is created. The agent should only act when the issue carries a 'bug' label, OR when the words 'bug' or 'error' appear in the title or description. Anything else, exit early without commenting.

When the trigger fires, read the new issue and parse the body for signals it can search on: the error message text, any stack-trace fragments, the customer or tenant ID, the affected environment (prod, staging, etc.), and any time window the reporter mentioned. Hold onto whatever it finds, even partial signals are useful.

Next, run Elasticsearch's Search Documents (Query Index) operation against my engineering log indices, doing a few targeted searches: one for an exact error-message match, one filtered by the customer or tenant ID, one matching stack-trace n-grams, and one bounded by the time window the reporter gave. If no time window was mentioned, default to the last 24 hours. Combine the hits and dedupe by event signature so the evidence block isn't repetitive.

Synthesize a concise evidence block that includes: the matched error message, the total number of occurrences, the first-seen and last-seen timestamps, the services or environments involved, two or three truncated sample stack traces, and a couple of Kibana-style links built from my cluster's base URL so an engineer can jump straight into the logs. Format in Markdown and put the sample stack traces inside a Linear collapsible section ('+++ Sample stack traces' ... '+++') so the comment stays readable.

Post that evidence block back to the ticket using Linear's Add Comment to Issue operation.

If the occurrence count crosses a severe threshold (default: more than 100 hits in the last hour), also call Linear's Update Issue operation to set priority to Urgent (priority value 1). Make this threshold configurable.

If Elasticsearch returns zero hits across all queries, still post a short comment that says no matching logs were found in the window the agent searched, names the window explicitly, and suggests the reporter widen the time range or add more error context. Don't leave the ticket silent.

Let me configure: the Kibana base URL for the link builder, the engineering log index pattern (default to something like 'logs-*'), the severe-threshold count and lookback, and the default time window for searches with no reporter-provided time.