I still think you're going to be in manual threshold tuning for quite a while. The cost of feeding a continuous log to an LLM would be insane. Even if you batched until you filled a context window.