OpenObserve — Rust-Based Petabyte-Scale Observability Platform

What it is

OpenObserve is an all-in-one observability platform written in Rust. It ingests logs, metrics, traces, and Real User Monitoring (RUM) data, storing everything as Parquet files on object storage (S3, MinIO, GCS). This architecture enables petabyte-scale retention at a fraction of the cost of Elasticsearch or Datadog.

OpenObserve is built for DevOps teams and platform engineers who need unified observability without the operational complexity and cost of traditional solutions. It provides a web UI for querying, dashboards, and alerting.

How it saves time or tokens

OpenObserve replaces multiple observability tools (Elasticsearch for logs, Prometheus for metrics, Jaeger for traces) with a single binary. The Parquet-on-object-storage architecture can reduce storage costs by up to 140x compared to Elasticsearch because object storage is cheap and Parquet compresses efficiently. The single binary deployment eliminates the operational overhead of managing separate clusters for each telemetry type.

How to use

1. Run the all-in-one Docker container: docker run -d --name openobserve -p 5080:5080 -e ZO_ROOT_USER_EMAIL=admin@example.com -e ZO_ROOT_USER_PASSWORD=Complexpass#123 public.ecr.aws/zinclabs/openobserve:latest.
2. Open the web UI at http://localhost:5080.
3. Ingest logs via HTTP API or configure log shippers (FluentBit, Vector, Filebeat).
4. Build dashboards and set up alerts from the web interface.

Example

# Start OpenObserve
docker run -d --name openobserve \
  -v $PWD/data:/data \
  -p 5080:5080 \
  -e ZO_ROOT_USER_EMAIL=admin@example.com \
  -e ZO_ROOT_USER_PASSWORD=Complexpass#123 \
  public.ecr.aws/zinclabs/openobserve:latest

# Ingest logs via HTTP
curl -u admin@example.com:Complexpass#123 \
  -H 'Content-Type: application/json' \
  -d '[{"level":"info","message":"hello","service":"demo"}]' \
  http://localhost:5080/api/default/default/_json

Related on TokRepo

• AI tools for monitoring -- explore observability and monitoring tools on TokRepo.
• AI tools for DevOps -- browse DevOps infrastructure tools.

Common pitfalls

• Object storage configuration is required for production. Local disk mode works for testing but does not provide the cost benefits or durability of S3/MinIO.
• Query performance depends on proper indexing and partitioning. Configure stream partitions based on your most common query patterns.
• Migration from Elasticsearch requires changing your ingest pipeline. OpenObserve supports the Elasticsearch bulk API for easier migration, but query syntax differs.