Columnar Parquet storage, queried in SQL or PromQL
OpenObserve is a self-hosted observability platform whose server is written in Rust. It takes logs, metrics and traces over OpenTelemetry (OTLP), plus RUM data from browsers and mobile apps, and stores everything as columnar Parquet files. Logs and traces are queried in SQL, metrics in SQL or PromQL. Dashboards, alerts and incidents share one web UI.
The project pitches itself as an alternative to Datadog, Splunk and Elasticsearch, and as one platform in place of the Grafana, Loki, Prometheus and Tempo combination. What sets it apart is that it can write everything to an S3 bucket or a compatible store (GCS, MinIO, Azure Blob...), and cluster mode requires it. SigNoz and Superlog keep their telemetry in ClickHouse. Netdata starts from the other end: one agent per machine that stores its metrics locally and only centralizes them once you add parent nodes.
The open source observability comparison sets OpenObserve's object storage against the databases behind the other platforms.
Starts in one container, clusters with stateless nodes
- One command to start: the Docker image runs on its own on port 5080, with the admin account set through two environment variables. A single instance keeps its metadata in SQLite and needs no other service.
- Stateless nodes in a cluster: ingesters write incoming data to a local write-ahead log, convert it to Parquet and push it to object storage, where the compactor merges small files. Queriers hold nothing but cache. The project says nodes restart quickly as a result, and durability rests on the object store.
- Ingest pipelines: a visual editor enriches, redacts, reduces or normalizes data before it is stored (VRL functions) and can turn logs into metrics: whatever gets dropped at ingest never lands in the bucket.
No SSO in the AGPL edition, ten-year default retention
S3 is not the default. A single instance writes to its local disk; object storage is switched on with ZO_LOCAL_MODE_STORAGE. It becomes mandatory in high availability mode, which runs on Kubernetes with Helm and needs PostgreSQL (or MySQL) for metadata, NATS to coordinate nodes, and at least one node per role (router, ingester, compactor, querier, scheduler).
The "140x cheaper" figure is measured against Elasticsearch. It comes from a chart in the README, which credits Parquet compression and the price of object storage. Reads are paid for in cache: by default a querier gives half its memory to Parquet files, and the disk cache can take half the free disk space.
Data is immutable and kept for ten years by default. Once ingested, a record cannot be edited or deleted; only whole retention periods are dropped. Unless you set ZO_COMPACT_DATA_RETENTION_DAYS or a per-stream retention, nothing gets deleted for 3,650 days.
The open source edition has no SSO and no roles. Every user has unrestricted access to every feature. The code is under AGPL-3.0-or-later: anyone who serves a modified version over a network must publish its source.
The enterprise edition is a separate image under a commercial license. It adds SSO (OIDC, SAML 2.0, LDAP/AD), RBAC configured through OpenFGA, an audit trail, federated search across clusters and automatic redaction of sensitive data. The v1.0.0 release notes count 80 enterprise commits against 295 open source ones. Self-hosted, it is free up to 50 GB ingested per day, with pricing on request beyond that.
A 1.0 from September 2026, and 43 stable releases this year. The repository dates from February 2023. v1.0.0, the first generally available 1.x release, shipped on September 11, 2026, after a year of roughly one minor version a month. The latest stable release is v1.0.4 (September 24), followed by v1.1.0-rc1 on September 30.