openobserve/openobserve

Open source Datadog alternative for logs, metrics, traces, and frontend monitoring. Modern observability platform: 10x easier, 140x lower storage cost, high performance, petabyte scale. Cloud · Documentation · Slack · Quickstart OpenObserve (O2) is a cloud-native observability platform for logs, metrics, traces, analytics, Real User Monitoring (RUM), and AI/LLM observability. It's a cost-effective alternative to Datadog, Splunk, and Elasticsearch for teams that need full observability without the complexity or cost — with Parquet columnar storage and an S3-native design that cuts storage costs by up to 140x . Table of Contents Why OpenObserve? Quick Start Product Tour Architecture Comparisons Production Ready Security & Compliance Enterprise Edition Community & Support Contributing FAQ License SBOM Why OpenObserve? A single platform for all of your observability signals. Here's why teams choose OpenObserve: Benefit Description 140x lower storage cost Parquet columnar storage + S3-native architecture dramatically reduce costs vs Elasticsearch Single binary deployment Up and running in under 2 minutes — no complex cluster setup required OpenTelemetry native Built on the OpenTelemetry standard — no vendor lock-in Unified platform Logs, metrics, traces, RUM, dashboards, alerts, and incidents in one tool High performance Better query performance than Elasticsearch on a quarter of the hardware SQL + PromQL Query logs and traces with SQL, metrics with SQL or PromQL — no proprietary query language Built in Rust Memory-safe, high-performance, single binary Cost comparison: OpenObserve vs Elasticsearch Quick Start OpenObserve Cloud (fastest way) Get started in minutes without managing infrastructure. The free tier includes up to 50 GB/day of ingestion. Get Started Free → 🐳 Docker docker run -d \ --name openobserve \ -v $PWD /data:/data \ -p 5080:5080 \ -e ZO_ROOT_USER_EMAIL= " root@example.com " \ -e ZO_ROOT_USER_PASSWORD= " Complexpass#123 " \ public.ecr.aws/zinclabs/openobserve:latest Then open http://localhost:5080 and log in with the credentials above. For other installation methods, see the quickstart documentation . For clustered deployments, see the High Availability deployment guide . Product Tour OpenObserve ships with a powerful, unified web UI for every signal — logs, traces, metrics, dashboards, RUM, alerts, incidents, pipelines, and AI observability. 🏠 Unified Overview A single home for your workspace — active incidents, service health (error rate, latency, requests), anomalies, and recent events at a glance. 📊 Logs Centralized log management with full-text search, SQL queries, quick filters, and a visual query builder. Instantly search across all your logs, build dashboards from log data, and set up alerts — all on Parquet columnar storage for 140x lower storage cost than Elasticsearch. Read more → 🔍 Distributed Tracing Powered by OpenTelemetry, tracing helps you follow requests across services and pinpoint performance bottlenecks. Explore the full request flow with waterfalls, flame graphs, and Gantt charts; click any span to drill into the trace. Read more → 🕸️ Service Graph Visualize service-to-service dependencies and request flow across your system, with per-edge request counts and health-based coloring (healthy, degraded, warning, critical) to spot problem hotspots at a glance. 📈 Metrics Explore metrics from your infrastructure and applications, then query them with SQL or PromQL. Browse thousands of metrics with faceted filters, preview them inline, combine multiple queries with formulae, and visualize the results with 19+ chart types. Read more → 📉 Dashboards Build custom dashboards from any signal with 19+ built-in chart types and 200+ visualization variations, a drag-and-drop panel builder, template variables, and geo maps. Read more → 👀 Frontend Monitoring (RUM) Real User Monitoring with Core Web Vitals, error tracking, performance analytics, and full session replay — so you can see exactly what your users experience. Read more → 🔔 Alerts Get notified when something unusual happens on any signal — logs, metrics, or traces. Define thresholds, scheduled or real-time alerts, and notification channels, with alert history and anomaly detection to catch issues early. Read more → 🚨 Incidents Correlate related alerts into incidents and track them through their lifecycle — open, acknowledged, and resolved — with severity and dimension context for faster response. 🔀 Pipelines Enrich, redact, reduce, or normalize data at ingest time with a visual editor. Build stream-processing flows — including logs-to-metrics conversion — from source, transform (VRL functions and conditions), and destination nodes. No external tools required. Read more → 🤖 AI Observability Monitor your GenAI and LLM applications: track cost, tokens, latency percentiles, and error rates across models, with agent graphs, session traces, and evaluation/quality scoring. ✨ O2 AI Assistant An in-product assistant that writes your SQL, VRL, and PromQL and walks you through logs, traces, metrics, and incidents — turning natural-language questions into queries, dashboards, and alerts. For the full feature list, see the documentation . Architecture OpenObserve achieves 140x lower storage costs and high performance through a modern, cloud-native architecture: Parquet columnar storage — efficient compression and fast analytical queries S3-native design — inexpensive object storage with intelligent caching Built in Rust — memory-safe, high-performance, single binary Partitioning, indexing, and smart caching — reduces search space by up to 99% for most queries Native multi-tenancy — organizations and streams as first-class concepts with complete data isolation Stateless architecture — rapid scaling and low RPO/RTO for disaster recovery Scale & Deployment Thousands of concurrent users can query a single cluster simultaneously Single binary scales to terabytes — unique in the observability space High Availability mode scales to petabytes for the most demanding workloads Multi-region deployments with cluster federation via Super Cluster architecture (Enterprise) Federated search across regions and clusters (Enterprise) High Availability & Disaster Recovery Deploy in High Availability mode with clustering for mission-critical workloads requiring maximum uptime. OpenObserve's stateless architecture with S3-backed storage enables very low Recovery Point Objective (RPO) and Recovery Time Objective (RTO): stateless nodes restart rapidly, and durability is guaranteed by S3's 99.999999999% (11 nines). Read the architecture documentation → · Read the enterprise deployment guide → Comparisons OpenObserve vs Datadog Aspect OpenObserve Datadog Deployment Self-hosted or Cloud SaaS only Pricing model Per-GB (free up to 50 GB/day) Per-host + per-GB Open source Yes (AGPL-3.