Stage 7 · Master
LLM Foundations for Operators
Embeddings & Semantic Search
Vectors, similarity, and turning logs and docs into searchable meaning.
What Are Embeddings?
An embedding is a list of numbers (a vector) that represents the meaning of a piece of text. Similar meanings produce similar vectors. The model maps text from a high-dimensional space of words into a lower-dimensional space where semantic similarity is captured as geometric distance.
import openai
response = openai.Embedding.create(
model="text-embedding-3-small",
input="Redis connection timeout in production cluster"
)
vector = response["data"][0]["embedding"]
print(f"Dimensions: {len(vector)}") # 1536
print(f"First 5 values: {vector[:5]}")Each text input produces a fixed-size vector. The text-embedding-3-small model produces 1536-dimensional vectors. These vectors capture semantic meaning, not just word overlap.
Similarity & Distance
To find similar texts, you compute the distance between their embedding vectors. The most common metric is cosine similarity — how aligned two vectors are in direction. Values close to 1.0 mean very similar. Values close to 0 mean unrelated.
import numpy as np
def cosine_similarity(a, b):
return np.dot(a, b) / (np.linalg.norm(a) * np.linalg.norm(b))
# These should be semantically similar
doc1 = "Redis connection timeout"
doc2 = "Cannot reach Redis instance"
emb1 = get_embedding(doc1) # Your embedding function
emb2 = get_embedding(doc2)
similarity = cosine_similarity(emb1, emb2)
print(f"Similarity: {similarity:.4f}") # ~0.85High cosine similarity means the model considers these texts to be about similar concepts, even if they share no common words.
Embedding Models for Ops
Different embedding models have different strengths. General-purpose models like OpenAI text-embedding-3 work well for most use cases. For specialized domains like logs or code, consider fine-tuned models.
| Model | Dimensions | Best For |
|---|---|---|
| text-embedding-3-small | 1536 | General text, runbooks, docs |
| text-embedding-3-large | 3072 | High-precision retrieval |
| BGE-base | 768 | Self-hosted, fast inference |
| CodeBERT | 768 | Code snippets and error messages |
For getting started, use text-embedding-3-small. It is fast, cheap at $0.02 per million tokens, and performs well on most operational text. You can always switch to a more specialized model later.
Semantic Search in Practice
Semantic search uses embeddings to find documents that are meaningfully similar to a query, not just keyword-matching. This is the foundation of RAG — you embed your query, find the most similar chunks in your knowledge base, and feed them to the LLM as context.
import openai
import numpy as np
# Your knowledge base chunks
docs = [
"Runbook: Redis failover procedure for production cluster",
"Incident: DNS resolution failures in us-east-1",
"How to scale Kubernetes pods based on CPU metrics",
]
# Embed all documents
doc_embeddings = [get_embedding(doc) for doc in docs]
def search(query, top_k=2):
query_emb = get_embedding(query)
similarities = [
cosine_similarity(query_emb, emb) for emb in doc_embeddings
]
ranked = sorted(enumerate(similarities), key=lambda x: x[1], reverse=True)
return [(docs[i], score) for i, score in ranked[:top_k]]
results = search("Redis is down, how do I failover?")
for doc, score in results:
print(f"[{score:.4f}] {doc}")This is the core pattern for RAG retrieval. The query and documents are embedded into the same vector space, and cosine similarity ranks them by meaning.
Semantic vs Keyword Search
Keyword search finds exact word matches. Semantic search finds meaning matches. For operational text, you usually want both — a hybrid approach that combines the precision of keyword matching with the flexibility of semantic understanding.
| Aspect | Keyword Search | Semantic Search |
|---|---|---|
| Exact match | Excellent | Good |
| Synonyms | Poor | Excellent |
| Acronyms | Poor | Excellent |
| Speed | Very fast | Fast with vector DB |
| Cost | Low | Embedding API costs |
Combine BM25 keyword search with vector similarity search. A query like 'OOMKill pod restart' should match exact log messages (keyword) and also find runbooks about memory exhaustion (semantic).
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.