Docs
Get running in minutes
Install the CLI, connect one alert source and one log source, and run your first incident. Most teams have a ranked root cause and a drafted rollback inside ten minutes.
1. Install the CLI and log in
The @ember/cli package runs on Node.js 18 or later. Install it globally with npm or your preferred package manager:
npm i -g @ember/cli
Then authenticate. ember login opens a browser window and stores a short-lived token in ~/.ember/credentials.json. If you are on a headless machine, append --token $EMBER_API_KEY instead.
ember login # -> Opens browser. Complete sign-in, then return here. # Logged in as you@company.com (team: acme)
Confirm the CLI is installed and the token is live:
ember --version # @ember/cli 0.9.2 ember whoami # you@company.com plan=team incidents-remaining=unlimited
2. Connect an alert source and a log source
Ember reads from alert sources (PagerDuty, Opsgenie, Grafana, CloudWatch) and log or trace sources (Datadog, Loki, Honeycomb, local files). You need at least one of each to run a full incident. Start with the ones your team already uses.
PagerDuty (alert source)
Generate a read-scoped API token in PagerDuty under API Access Keys, then pass it to the connector:
ember connect pagerduty --token $PD_TOKEN # Verifying token... # Connected source=pagerduty services=checkout-api,payments-svc,auth-svc # Ember will receive PagerDuty alerts for those services automatically.
Datadog Logs (log source)
The Datadog connector pulls log lines for the service and time window Ember determines from the alert. Supply your API key and application key, and scope it to the service index you want Ember to read:
ember connect datadog-logs \ --api-key $DD_API_KEY \ --app-key $DD_APP_KEY \ --index main \ --query "service:checkout-api" # Verifying credentials... # Connected source=datadog-logs index=main query=service:checkout-api # Ember will pull relevant log windows when an incident fires.
To list everything connected so far:
ember sources list # ALERT SOURCES # pagerduty connected services=checkout-api,payments-svc,auth-svc # # LOG SOURCES # datadog-logs connected index=main query=service:checkout-api
See all integrations for Opsgenie, Grafana, Loki, Honeycomb, Sentry, GitHub, and more. You can add multiple sources and Ember will correlate across them automatically.
3. Run your first incident
Once sources are connected, Ember picks up alerts automatically when they fire. You can also trigger an analysis manually with ember incident run, which is useful for replaying a past alarm or testing against a local log file.
Pass the alarm text (copied from PagerDuty, Slack, or wherever it landed) and point --logs at a local file or a connected log source query:
ember incident run \ --alarm "checkout-api 5xx rate 8.4% (threshold 1%) for 4m, p95 latency 2.9s" \ --logs ./checkout.log # Reading alarm... # Fetching deploy history for checkout-api (last 6h)... # Reading 847 log lines from ./checkout.log
What comes back
Ember streams four pieces of output to your terminal as it works. Typical wall time is 30-90 seconds depending on log volume and the model in use.
Ember incident INC-2026-0712 ─── Root cause ──────────────────────────────────────────────────────── cause Redis connection pool exhausted after deploy v2025.7.3 confidence 78% evidence 15:02:11 pool timeout acquiring connection after 5000ms (redis) 15:02:12 redis connected_clients=200 blocked_clients=147 maxclients=200 14:58 deploy v2025.7.3 raised pool size to 200, landed 4m before alarm ─── Rollback ────────────────────────────────────────────────────────── step 1 kubectl rollout undo deploy/checkout-api step 2 kubectl rollout status deploy/checkout-api --watch step 3 curl -s https://api.checkout.example.com/health | jq .status Note: a human runs these. Ember does not touch production. ─── Timeline ────────────────────────────────────────────────────────── 14:58:00 deploy v2025.7.3 rolls out (pool size 100 -> 200) 14:58:01 deploy reports healthy 15:02:09 error budget burn begins 15:02:11 first pool timeout logged 15:02:14 PagerDuty alarm fires (SEV2) ─── Postmortem (first draft) ────────────────────────────────────────── Written to ./INC-2026-0712-postmortem.md Review and share: ember incident show INC-2026-0712
Understanding the confidence
Confidence reflects how well the available telemetry supports the ranked cause. 78% means the evidence is reasonably strong but not airtight. If Ember returns a confidence below 50%, it will also list what it would check next, such as a second log source or a trace.
Exporting and sharing
The postmortem is written as Markdown to the current directory. You can re-open any past incident, edit the draft, and export it:
# List recent incidents ember incident list # Open a specific incident (cause, timeline, postmortem) ember incident show INC-2026-0712 # Export postmortem as Markdown ember incident export INC-2026-0712 --format md
4. Do the same in the dashboard
Everything above is available in the browser dashboard without installing anything. Go to emberoncall.com/signup to create a free account, then:
- Open Sources in the left nav. Connect your PagerDuty token and Datadog credentials through the guided form. The dashboard stores them encrypted and uses them only when an incident runs.
- Click New incident. Paste the alarm text into the alarm field and either paste log lines directly or select a connected log source and a time window.
- Click Analyze. Ember streams the ranked cause, rollback steps, timeline and postmortem into the incident view in real time.
- From the incident view you can share a read-only link with your team, edit and export the postmortem, and attach a Slack thread or Jira ticket.
The free tier includes ten incident analyses per month with one connected alert source. No card required.
5. Next steps
Put Ember on your next incident.
Start free and run a real incident analysis in a minute, or talk to us about Team and Scale.