Features
Everything an incident-response tool needs, none of the license anxiety
A single platform for shipping, searching, visualizing, and alerting on logs — designed so no feature is held back for a paid tier.
One query language, two engines
Pipe syntax for the common case, raw SQL as an escape hatch — both compile to the same execution plan across ClickHouse and Tantivy. No performance tax for using one over the other.
Dashboards
Multi-panel dashboards built from saved queries — line charts, bar charts, single-stat, heatmaps, top-N — backed by the same query engine as the search bar, not a parallel path.
Alerting
Threshold and absence conditions, evaluated on an interval, delivered to Slack, a generic webhook, or PagerDuty — with delivery attempts logged, not fired-and-forgotten.
Cross-platform agent
A single statically-linked Rust binary. journald or plain files on Linux, Event Log and ETW on Windows — no glibc runtime dependency, ships as one file per host.
Multi-tenant RBAC
Per-tenant ClickHouse and Tantivy isolation enforced at the connection layer, not a row filter — including against the raw-SQL escape hatch. OIDC and SAML SSO, append-only audit logging.
AI-assisted queries
Translate a plain-English question into a structured query, get inline fix suggestions and autocomplete — self-hosted via Ollama by default, no cloud dependency required.
See how the pieces fit together
The architecture page walks through how a log line moves from an edge agent to something you can search.
View architecture →