README.md
OpenObserve (O2) is a cloud-native observability tool built for logs, metrics, traces, analytics, and Real User Monitoring (RUM). It's designed as a cost-effective alternative to Datadog, Splunk, and Elasticsearch for teams that need full observability without the complexity or cost.
OpenObserve is a single observability tool for all your monitoring needs. Here's why teams choose OpenObserve:
| Benefit | Description |
|---|---|
| 140x Lower Storage Cost | Parquet columnar storage + S3-native architecture dramatically reduces costs vs Elasticsearch |
| Single Binary Deployment | Get running in under 2 minutes. No complex cluster setup required |
| OpenTelemetry Native | Built on OpenTelemetry standardβno vendor lock-in |
| Unified Platform | Logs, metrics, traces, RUM, dashboards, alerts in one tool |
| High Performance | Better query performance than Elasticsearch on 1/4 the hardware |
| SQL + PromQL | Query logs/traces with SQL, metrics with SQL or PromQLβno proprietary query language |
| Built in Rust | Memory-safe, high-performance, single binary |
Cost Comparison: OpenObserve Vs Elasticsearch
OpenObserve achieves 140x lower storage costs and high performance through its modern architecture:
This architecture delivers 140x cost savings while providing better performance than Elasticsearch.
Deploy in High Availability mode with clustering for mission-critical workloads requiring maximum uptime and performance.
Low RPO/RTO: OpenObserve's stateless architecture with S3-backed storage enables very low Recovery Point Objective (RPO) and Recovery Time Objective (RTO). Stateless nodes can be rapidly restarted, and data durability is guaranteed by S3's 99.999999999% (11 nines) durability. That's a lot of nines.
Read detailed architecture documentation β
Read enterprise deployment guide β
For a full list of features, check the documentation.
OpenObserve provides a centralized log management solution with full-text search, SQL queries, and powerful filtering. Built on Parquet columnar storage for 140x lower storage costs than Elasticsearch. Instantly search through all your logs using quick filters and a powerful query builder. Create dashboards from log data and set up alerts. Read more β
Distributed tracing is essential to troubleshoot issues in microservices applications. Powered by OpenTelemetry, tracing in OpenObserve helps you track user requests across services to identify performance bottlenecks. See user requests in a detailed breakdown with Flamegraphs and Gantt Charts. Click on any span to see the entire trace and understand where issues occurred. Read more β
Ingest metrics from your infrastructure or applications and create customized dashboards. 19+ built-in chart types plus custom charts for 200+ visualization variations. Query metrics with SQL or PromQL. Add multiple queries and combine them with formulae. Read more β
Real User Monitoring with performance tracking, error logging, and session replay. Understand exactly what your users experience. Read more β
Get notified when anything unusual happens in your application. Set alerts on any telemetry signal (logs, metrics, traces), create thresholds, and configure notification channels. Advanced features like alert history and anomaly detection help you identify issues before they reach your customers. Read more β
Enrich, redact, reduce, or normalize data on ingest. Stream processing for logs-to-metrics conversion and more. No external tools required. Read more β
Get started in minutes without managing infrastructure. Free tier includes up to 200 GB/day ingestion. Get Started Free β
docker run -d \
--name openobserve \
-v $PWD/data:/data \
-p 5080:5080 \
-e ZO_ROOT_USER_EMAIL="[email protected]" \
-e ZO_ROOT_USER_PASSWORD="Complexpass#123" \
public.ecr.aws/zinclabs/openobserve:latest
For other ways to quickly install OpenObserve or use OpenObserve cloud, check quickstart documentation.
For installing OpenObserve in High Availability mode, check High Availability deployment documentation.
OpenObserve is battle-tested in production environments worldwide:
| Aspect | OpenObserve | Datadog |
|---|---|---|
| Deployment | Self-hosted or Cloud | SaaS only |
| Pricing model | Per-GB (free up to 200GB/day) | Per-host + per-GB |
| Open source | Yes (AGPL-3.0) | No |
| OpenTelemetry | Native OTLP | Supported |
| Query language | SQL + PromQL | Proprietary |
| Vendor lock-in | None | High |
OpenObserve is a Datadog alternative that gives you full control over your data and costs.
| Aspect | OpenObserve | Elasticsearch |
|---|---|---|
| Storage cost | 140x lower | High (hot/warm/cold tiers) |
| Setup complexity | Single binary | Complex cluster management |
| Query language | SQL | Lucene/KQL |
| Hardware requirements | 1/4 the resources | High memory/CPU |
OpenObserve achieves 140x lower storage costs through Parquet columnar format and S3-native architecture.
| Aspect | OpenObserve | Splunk |
|---|---|---|
| Licensing | Open source | Expensive enterprise licensing |
| Deployment | Single binary or HA cluster | Complex |
| Query language | SQL + PromQL | SPL (proprietary) |
| Cost | Predictable, low | Unpredictable, high |
OpenObserve is an open-source Splunk alternative without the licensing complexity.
| Aspect | OpenObserve | Grafana Stack |
|---|---|---|
| Components | Single platform | Multiple tools (Grafana + Loki + Prometheus + Tempo) |
| Management | One binary | Multiple deployments |
| High cardinality | Full support | Loki struggles with high cardinality |
| Query performance | Fast on large volumes | Loki slow on large data |
OpenObserve consolidates logs, metrics, and traces in one platform instead of stitching together multiple tools.
OpenObserve includes a powerful web UI for logs, traces, dashboards, alerts, and more.
Trace details page with full request flow visualization:
Real user monitoring with session replay:
<details> <summary>See more screenshots</summary>
OpenObserve meets the stringent security and compliance requirements of regulated industries including finance, healthcare, and government.
Open Source Edition: Licensed under AGPL-3.0. We chose AGPL to ensure that improvements to OpenObserve remain open source and benefit the entire community. This license protects the commons while still allowing free commercial use.
Enterprise Edition: Licensed under a commercial Enterprise License Agreement, not AGPL. This provides additional flexibility for enterprise deployments and eliminates any concerns about AGPL requirements.
For more details:
OpenObserve is built as a true open source project, and we're committed to the community. The open source version is feature-complete and production-ready - it includes logs, metrics, traces, dashboards, alerts, pipelines, and everything you need to run observability at scale. It will always remain actively maintained and free to use without restrictions.
For organizations requiring enterprise-grade features and support, we offer an Enterprise edition with:
Enterprise Features:
Enterprise Support & SLAs:
Pricing:
For enterprise inquiries and custom deployments, contact our sales team.
We welcome contributions from the community! Whether you're fixing bugs, adding features, improving documentation, or sharing feedback, your help makes OpenObserve better for everyone.
To get started, please read our Contributing Guide which covers:
The best way to get help, share ideas, and connect with other OpenObserve users is through our community channels. We're a friendly group of developers, operators, and observability enthusiasts.
Our Slack community is the most active place for:
Through a combination of Parquet columnar storage format (efficient compression), S3-native architecture (leveraging inexpensive object storage). See the detailed comparison chart in the "Why OpenObserve?" section above.
All data in OpenObserve is immutable - once ingested, it cannot be modified or deleted (only entire retention periods can be dropped). This is by design and is actually a feature for logs and compliance requirements, ensuring data integrity and audit trails.
Yes. OpenObserve is running in production with thousands of deployments worldwide, including environments processing in excess of 2 PB/day. See our customer stories for real-world examples.
OpenObserve delivers better performance than Elasticsearch for most workloads. Users report faster search performance and significantly faster analytics queries, all while using 1/4th the hardware resources. The columnar storage format (Parquet) is particularly effective for complex aggregations and analytics workloads.
No. OpenObserve is designed to be intuitive from day one:
Most users are productive within hours, not weeks. Some even claim minutes, but we'll let you be the judge.
Software Bill of Materials for OpenObserve
SBOM can be found here. You can analyze it using dependency track.
In order to generate the SBOM, you can use the following commands:
Install cargo-cyclonedx:
cargo install cargo-cyclonedx
Generate the SBOM:
cargo-cyclonedx cyclonedx
SBOM can be found here. You can analyze it using dependency track.
In order to generate the SBOM, you can use the following commands:
Install cyclonedx-npm:
npm install --global @cyclonedx/cyclonedx-npm
Generate the SBOM:
cd web
cyclonedx-npm > sbom.json