OpenObserve

OpenObserve gathers logs, metrics, traces, analytics, real user monitoring and AI observability into one platform, offered as an alternative to Datadog, Splunk and Elasticsearch for teams that cannot carry their cost.

Storage is Parquet columnar files on an S3-native design, which the project credits for storage costs up to 140 times lower than Elasticsearch. It is written in Rust and ships as a single binary that is running in under two minutes, with partitioning, indexing and caching cutting the search space for most queries.

The platform is organized around signals rather than separate tools.

• Logs: full-text search, SQL queries, quick filters and a visual query builder over log data.
• Tracing: OpenTelemetry-powered waterfalls, flame graphs and Gantt charts across services.
• Metrics and dashboards: query metrics with SQL or PromQL and build dashboards on any signal.
• Alerts and incidents: alerting and incident tracking sit inside the same interface.
• Multi-tenancy: organizations and streams are first-class concepts with complete data isolation.

A stateless architecture backed by object storage keeps recovery objectives low, and a high availability mode clusters for petabyte workloads. The core is AGPL-3.0, with super cluster federation and federated search across regions reserved for the enterprise edition.