Search terabytes of logs
in under 500 ms.
Ingest structured and unstructured logs from any source. Full-text search, field extraction, live tail, and log-based alerting — all in one place, without managing Elasticsearch.
Real-time ingest visibility
Understand your log volume and error distribution at a glance.
Ingest volume (GB / hour)
Last 48 h2.4 GB/hr avg
Errors & warnings / hour
Last 24 hPowerful query language
Familiar Lucene-style syntax with added aggregate operators — no new language to learn.
Find all errors in the last hour
level:ERROR service:api-gateway @timestamp:[now-1h TO now]Slow DB queries (>2 s)
service:db-proxy duration:>2000 level:(WARN OR ERROR)Auth failures by region
message:"auth failed" | stats count() by regionP95 latency from access logs
type:access_log | percentile(latency_ms, 95)Everything you need. Nothing you don't.
Built for teams who want answers fast, not cluster tuning time.
Sub-second full-text search
Grep across terabytes of logs in under 500 ms. No index warm-up, no query queue.
Structured field extraction
Automatic JSON parsing. Query any field with type-aware operators — numbers, booleans, IPs.
Live tail & streaming
Watch logs flow in real time. Apply filters and see results update without page reload.
Log-based alerting
Trigger alerts from log patterns, error rates, or anomaly detection — no separate rules engine.
Retention & compliance
Configurable retention from 7 days to 2 years. SOC 2 Type II compliant storage with AES-256.
Export & archive
Export to S3, GCS, or Azure Blob on a schedule. NDJSON, CSV, or Parquet — your choice.
CLI & API access
Stream, search, and tail logs from your terminal. Full REST + gRPC API included.
S3-backed cold storage
Logs older than your hot window are transparently tiered to object storage. Query still works.
Alert on log patterns, not just metrics.
Define alert conditions directly on your log stream — error rate spikes, specific message patterns, or any aggregate over a sliding window. No separate alerting stack required.
- Pattern matching with regex or KQL syntax
- Sliding window aggregations (1 min – 24 h)
- Alert on absence (no heartbeat in X min)
- PagerDuty, Slack, OpsGenie, webhook
Alert rule editor
level:ERROR service:db-proxy
| count() > 50 over 1mmessage:"auth failed"
| rate() > 3× baseline over 5mservice:payments message:"ping"
| absent() over 2m → alertSimple ingest-based pricing
Pay for what you ingest. No per-seat fees, no query charges.
Starter
Free
Up to 10 GB/day
7 days retention
Full-text search
Live tail
Growth
$149/mo
Up to 100 GB/day
30 days retention
Full-text search
Live tail
Log-based alerting
Scale
$599/mo
Up to 1 TB/day
90 days retention
Full-text search
Live tail
Log-based alerting
Cold storage tier
Enterprise
Custom
Unlimited
Custom retention
Full-text search
Live tail
Log-based alerting
Cold storage tier
CMEK encryption
Common questions
How does obseria.io ingest logs?
Via the OpenTelemetry Collector, our Fluent Bit plugin, a syslog endpoint, or direct HTTP/gRPC. We support structured (JSON) and unstructured (plain text) formats automatically.
What happens when I exceed my daily ingest limit?
We buffer up to 200% of your plan limit for up to 15 minutes and notify you. If you stay over, ingest throttles gracefully — no data is dropped without warning.
Can I search logs from 6 months ago?
Yes. Logs beyond your hot retention window are tiered to cold storage automatically. Queries run across both tiers transparently — cold queries are slightly slower (5–30 s vs <500 ms).
Is log data encrypted?
All data is encrypted at rest with AES-256 and in transit with TLS 1.3. Customer-managed encryption keys (CMEK) are available on the Enterprise plan.
Stop managing Elasticsearch clusters.
obseria.io Log Management is production-ready in under 15 minutes. No infrastructure to provision, no index templates to configure.