OpenObserve

What OpenObserve does

OpenObserve, often shortened to O2, is a storage and analysis engine for telemetry with its own web interface. It accepts logs, metrics, traces and browser data, keeps them in compressed Parquet columnar files, and lets you search, chart and alert on all of them in one place. The project presents it as an open source alternative to Datadog, Splunk and Elasticsearch, and its design goal is cheap long-term storage: files can sit on local disk or on S3-compatible object storage, which the project says cuts storage costs sharply compared with Elasticsearch.

Logs are searched with full text, SQL or a visual builder, and traces open as waterfalls or flame graphs with a service graph that colors service-to-service calls by health. Metrics can be queried with SQL or PromQL. Dashboards offer 19+ chart types with template variables, and the real user monitoring module records Core Web Vitals, front-end errors and full session replays. Alerts run on a schedule or in real time on any signal, related alerts can be grouped into incidents, and newer modules cover LLM application monitoring and an in-product AI assistant.

Ingestion and querying

Data arrives through OpenTelemetry (OTLP), Prometheus remote write, Telegraf, Fluent Bit, Fluentd, Vector, Filebeat, syslog, Amazon Kinesis Firehose or plain JSON over HTTP. A Splunk HEC-compatible endpoint is aimed at teams leaving Splunk. Pipelines can transform data as it arrives, for example to drop or redact fields, add context or derive metrics from log lines, using the VRL language.

The design brings a trade-off the README states openly: ingested data is immutable. You cannot delete or edit individual records, only drop whole retention periods. That suits audit logs, but plan for it if you may need to remove personal data selectively.

Self-hosting OpenObserve

The default deployment is a single binary or Docker container using SQLite for metadata and local disk for data, optionally with object storage instead of disk. The architecture documentation describes this mode as suitable when you do not need high availability. For production clusters, high-availability mode runs on Kubernetes with Helm and needs object storage (local disk is not supported), PostgreSQL for metadata, NATS for coordination, and separate router, ingester, compactor, querier and scheduler nodes that scale independently. Ingesters keep recent data in a write-ahead log and memory before flushing it to object storage, a deliberate single-copy design that the documentation explains.

Open source and Enterprise editions

The repository is AGPL-3.0, which the project adopted after starting under Apache-2.0. The Enterprise edition is compiled with private code under a commercial license; the public repository contains only placeholders for those modules. Enterprise adds single sign-on (OIDC, SAML, LDAP/AD), granular role-based access control, immutable audit trails, federated search across clusters, sensitive data redaction, advanced encryption and query workload controls. The README says the Enterprise edition is free up to 50 GB of ingestion per day, including commercial use, after registration.

Hosted version

OpenObserve Cloud is the managed service, with a free tier and usage-based paid plans. The company states it holds SOC 2 Type II and ISO 27001 certifications.

Limitations

Without the Enterprise edition there is no single sign-on or fine-grained access control, which many companies need once more than one team shares the system. The performance and storage-cost comparisons in the README are the vendor’s own. HA mode has several moving parts, and OpenObserve does not run synthetic uptime checks, so pair it with a tool such as Gatus or Uptime Kuma.

Who it suits

OpenObserve suits teams with large log volumes who want Datadog-style search, dashboards and alerts across all signals without paying for an indexed search cluster, and who are comfortable with SQL. If you want a more opinionated APM view built on OpenTelemetry, compare it with SigNoz.