OpenObserve (O2) is a cloud-native observability platform for logs, metrics, traces, analytics, Real User Monitoring (RUM), and AI/LLM observability. It's a cost-effective alternative to Datadog, Splunk, and Elasticsearch for teams that need full observability without the complexity or cost — with Parquet columnar storage and an S3-native design that cuts storage costs by up to 140x.
Table of Contents
Why OpenObserve?
A single platform for all of your observability signals. Here's why teams choose OpenObserve:
| Benefit | Description |
|---|
| 140x lower storage cost | Parquet columnar storage + S3-native architecture dramatically reduce costs vs Elasticsearch |
| Single binary deployment | Up and running in under 2 minutes — no complex cluster setup required |
| OpenTelemetry native | Built on the OpenTelemetry standard — no vendor lock-in |
| Unified platform | Logs, metrics, traces, RUM, dashboards, alerts, and incidents in one tool |
| High performance | Better query performance than Elasticsearch on a quarter of the hardware |
| SQL + PromQL | Query logs and traces with SQL, metrics with SQL or PromQL — no proprietary query language |
| Built in Rust | Memory-safe, high-performance, single binary |
Cost comparison: OpenObserve vs Elasticsearch
Quick Start
OpenObserve Cloud (fastest way)
Get started in minutes without managing infrastructure. The free tier includes up to 50 GB/day of ingestion.
Get Started Free →
🐳 Docker
docker run -d \
--name openobserve \
-v $PWD/data:/data \
-p 5080:5080 \
-e ZO_ROOT_USER_EMAIL="[email protected]" \
-e ZO_ROOT_USER_PASSWORD="Complexpass#123" \
public.ecr.aws/zinclabs/openobserve:latest
Then open http://localhost:5080 and log in with the credentials above.
For other installation methods, see the quickstart documentation. For clustered deployments, see the High Availability deployment guide.
Product Tour
OpenObserve ships with a powerful, unified web UI for every signal — logs, traces, metrics, dashboards, RUM, alerts, incidents, pipelines, and AI observability.
🏠 Unified Overview
A single home for your workspace — active incidents, service health (error rate, latency, requests), anomalies, and recent events at a glance.
📊 Logs
Centralized log management with full-text search, SQL queries, quick filters, and a visual query builder. Instantly search across all your logs, build dashboards from log data, and set up alerts — all on Parquet columnar storage for 140x lower storage cost than Elasticsearch. Read more →
🔍 Distributed Tracing
Powered by OpenTelemetry, tracing helps you follow requests across services and pinpoint performance bottlenecks. Explore the full request flow with waterfalls, flame graphs, and Gantt charts; click any span to drill into the trace. Read more →
🕸️ Service Graph
Visualize service-to-service dependencies and request flow across your system, with per-edge request counts and health-based coloring (healthy, degraded, warning, critical) to spot problem hotspots at a glance.
📈 Metrics
Explore metrics from your infrastructure and applications, then query them with SQL or PromQL. Browse thousands of metrics with faceted filters, preview them inline, combine multiple queries with formulae, and visualize the results with 19+ chart types. Read more →
📉 Dashboards
Build custom dashboards from any signal with 19+ built-in chart types and 200+ visualization variations, a drag-and-drop panel builder, template variables, and geo maps. Read more →
👀 Frontend Monitoring (RUM)
Real User Monitoring with Core Web Vitals, error tracking, performance analytics, and full session replay — so you can see exactly what your users experience. Read more →
🔔 Alerts
Get notified when something unusual happens on any signal — logs, metrics, or traces. Define thresholds, scheduled or real-time alerts, and notification channels, with alert history and anomaly detection to catch issues early. Read more →
🚨 Incidents
Correlate related alerts into incidents and track them through their lifecycle — open, acknowledged, and resolved — with severity and dimension context for faster response.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
