The company [0] I work for gave a talk on this [1]. We're going a bit beyond analyzing logs because we have more contextual information about running software so we can compare different application state over time and infer whether it appears the application is experiencing an "incident".
0. https://noop.dev
1. https://www.youtube.com/watch?v=PxZx71xfIl8