Telemetry in ClickHouse, incidents triaged by Claude
Superlog is an observability platform written in TypeScript. Traces, logs and metrics come in over OTLP and land in ClickHouse, while errors are grouped into incidents kept in Postgres. Claude, Anthropic's model, answers two questions about incidents: does a new error belong to one that is already open, and can a quiet one be closed? The repository holds the community edition under Apache-2.0, and the README describes the project as open-core.
The comparison of self-hosted observability platforms sets out what each one stores, on which database, and at what volume it starts to pay off.
Agent grouping, human sign-off before closing
- Agent-driven grouping: fixed rules come first, a shared trace ID among them. When they find nothing, Claude gets the list of open incidents, one line each, plus tools to inspect them. It attaches the error to one of them or leaves it on its own, within twelve tool rounds, and records its reasoning.
- Closing goes through a human: an hourly pass rereads incidents that have gone silent. When the model concludes the problem stopped thanks to an external fix, it suggests closing in the incident's Slack thread, with one button to confirm and one to dismiss.
- Built-in MCP server: an MCP client in your editor can query logs, traces and metrics, and adjust the issue filter, the project context and the agent's memories.
- Platform connectors: Vercel, Railway and Render send their logs and metrics without any OTLP wiring on your side. AWS and Cloudflare have connectors too.
Nothing merged since September 14, and no investigation agent
Anthropic is the only provider wired in. The worker depends on Anthropic's SDK and on no other model SDK. Grouping, closing, the periodic digest and the service map default to claude-sonnet-4-6; the ANTHROPIC_*_MODEL variables swap the model, not the vendor. Without ANTHROPIC_API_KEY, closing proposals never run, and an error the fixed rules can't place opens an incident of its own.
What gets sent to Anthropic. To classify an error, the worker sends the exception's title, type and message, the stack trace, resource and log attributes (file, function, route) and the trace IDs, along with the title and the first 140 characters of the error message of every open incident. Personal data that ends up in an exception message travels with it.
The investigation agent is not in the repository. The bundled community runner calls no model: it summarizes the incident's first error, proposes no fix and turns down chat. The runner behind real investigations is an external module loaded through AGENT_RUNNER_ANTHROPIC_MODULE, and the repo doesn't include it. The fix pull requests advertised on superlog.sh don't come out of this code.
Four apps and three containers. The Compose file starts Postgres 16, ClickHouse 26.1 and an OpenTelemetry Collector; the web UI, API, ingest proxy and worker run alongside on Node. The README only covers a development setup, and the shipped collector config sets no retention period. Traceway sits on the same ClickHouse and Postgres pair but also ships a SQLite image with no external database. OpenObserve runs as a single binary that keeps its data on S3.
Nothing merged since September 14, 2026. The repository has no release or tag, and one developer authored 468 of the 488 commits on its main branch. Sixty-nine pull requests are still open. On October 1, 2026 the docs at docs.superlog.sh were rewritten around "automations". They name a different repository from the same company, responder-oss, as Superlog's open-source application, with agents that investigate alerts from Sentry, Datadog or Slack, and state that the hosted service runs that code.