Observability + product analytics — one box.
Oleus replaces Datadog (metrics, logs, traces, alerting, SIEM, mobile RUM, NPM) and PostHog (product analytics, feature flags, experiments, session replay, heatmaps) in a single binary. Pre-wired with shared auth, one schema, one query layer.
Metrics that scale to a billion samples on a $48 box.
PromQL- and MetricsQL-native. Drop-in replacement for Prometheus with 10× cardinality and 7× compression.
by (status_code, service)
- Query languagePromQL · MetricsQL · SQL via export
- Ingest formatsPrometheus remote-write · OTLP · InfluxDB · Graphite · CSV
- Cardinality10M+ active series on a single 4-core node
- RetentionHot tier: local SSD · cold tier: S3-compatible object store
- FederationCross-cluster
vmselectfor global views - Migration
oleus import prombackfills from a Prometheus 2.x snapshot
SQL-native logs. Year-of-data queries in under a second.
Columnar storage means you can GROUP BY across a billion rows without crying over a $30k bill.
quantile(0.99)(latency_ms) AS p99,
count() AS req
FROM logs
WHERE ts > now() - INTERVAL 1 DAY
GROUP BY service
ORDER BY p99 DESC;
- Compression10–30× vs. Splunk on equivalent data
- Ingest formatsOTLP · syslog · journald · Fluent-bit · vector · raw JSON
- SchemaAuto-inferred or declared. Add fields without migrations.
- SearchFull-text via
tokenbf_v1indexes · regex · structured - RetentionTTL per stream · hot/warm/cold tiering · S3 offload
- JoinsLogs ↔ metrics ↔ traces by trace_id and service.name
Distributed traces. End-to-end correlated.
OTel-native from the ground up. Every span is linked to logs, metrics, and security events sharing the same trace_id.
- ProtocolOTLP gRPC · OTLP HTTP · Zipkin · Jaeger thrift
- SamplingHead-based · tail-based · adaptive (rate-limited per service)
- RetentionDefault 14d · S3-backed for longer
- Storage~1KB / span average, indexed by service + operation
- CorrelationClick any span → tail logs, see metrics, view security events for that
trace_id - SDKsAuto-instrumentation for Node, Go, Python, Ruby, Java, .NET, Rust
PagerDuty-grade routing. Without the bill.
Define alert rules in PromQL. Route by severity, team, or label. Schedule on-call rotations. Open source.
histogram_quantile(0.99, rate(http_duration_bucket[5m])) > 0.5api-gateway rolled into one alert · severity = pageplatform · rotation = primary · escalates after 5m- Rule languagePromQL · MetricsQL · ClickHouse SQL (for log-based alerts)
- RoutingTree-based on labels · grouping · inhibition · silencing
- SchedulesRotations · overrides · holiday calendars · per-team escalation
- ChannelsSlack · Discord · email · SMS (Twilio) · webhook · PagerDuty
- ReliabilityActive-active HA · gossip protocol · zero notification loss across restarts
- RunbooksMarkdown links per rule · auto-attached to every page
Security in the same pane as performance.
Host-based intrusion detection, file integrity monitoring, and CIS-benchmark scanning — sharing infrastructure with your metrics and logs.
- Detection3,000+ built-in rules · MITRE ATT&CK mapping · custom rules in YARA
- FIMReal-time file integrity monitoring · diff capture · inotify-based
- ComplianceCIS · PCI-DSS · HIPAA · GDPR · NIST 800-53 templates
- Vulnerability scanningCVE database · OSV · per-host package scanning · daily refresh
- Active responseBlock IP via firewall · kill process · disable user · all scripted
- Agent footprint~35 MB RAM · <1% CPU · supports Linux, Windows, macOS, AIX, Solaris
oleus — your stack, in a pipe.
A 24MB Go binary that talks to the entire platform. Tail logs, run queries, manage alerts, push dashboards — without ever opening a browser.
Single binary · zero dependencies · auto-completion for bash/zsh/fish
jqiOS & Android SDKs with zero dependencies.
Drop-in Swift and Kotlin SDKs send RUM events to your own backend. Automatic view lifecycle tracking, network instrumentation, crash reporting, ANR detection, and wireframe session replay — all included.
swift-tools-version: 5.9 · iOS 14+ · Android minSdk 24
from: "1.0.0")
endpoint: "https://api.internal",
apiKey: "bsk_live_…")
- View trackingUIViewController swizzle — automatic, zero code changes
- Network tracingURLProtocol (iOS) · OkHttp interceptor (Android)
- Crash reportingNSException + POSIX signals (iOS) · UncaughtExceptionHandler (Android)
- ANR detectionAndroid watchdog thread — 5s main-thread hang threshold
- Session replayWireframe snapshots — privacy-safe, no pixel capture
- BatchingActor-based queue, gzip, retry — no events lost on crash
Observability Pipelines Worker — intercept before storage.
A standalone async Python worker that sits between your agents and Oleus. Receives OTLP/HTTP and syslog UDP/TCP, runs a processor chain, and fans out to multiple sinks. Configure via YAML or live remote config from the dashboard.
Runs as a sidecar or dedicated host · exposes Prometheus /metrics · pulls config from Oleus API
- type: otlp_http
- type: syslog_udp
processors:
- redact_pii
- type: sample
rate: 0.10
- type: add_field
env: production
sinks:
- type: oleus
- type: s3
bucket: my-archive
- SourcesOTLP/HTTP · syslog UDP/TCP (RFC 5424)
- Processors
sample·parse_json·grok·add_field·drop_field·redact_pii·filter - SinksOleus ingest · S3-compatible (gzip NDJSON) · webhook · stdout
- ConfigLocal YAML or live remote config polled from Oleus API
- ObservabilityPrometheus /metrics endpoint — events_in, events_out, errors
- DeployDocker image · bare metal · Kubernetes sidecar
Network Performance Monitoring — kernel-level, no agent code.
eBPF flow ingest captures per-connection TCP metrics (retransmits, RTT, packet loss) from the kernel. DNS telemetry tracks query latency and NXDOMAIN rates per resolver. Zero application changes. Zero sampling bias.
Stored in ClickHouse · npm_flows + npm_dns_events · retention configurable
- Flow metricsTCP retransmits · RTT · packet loss · bytes in/out per connection
- DNS telemetryQuery latency · NXDOMAIN rate · per-resolver breakdown
- IngesteBPF agent POSTs to
/v1/npm/flows/ingestand/v1/npm/dns/ingest - DashboardsOverview · Connections · Retransmits · DNS — all tabbed
- Zero-codeKernel eBPF — no library changes, no sidecars in app pods
- StorageClickHouse MergeTree · configurable retention · columnar compression
Product Analytics. Funnels, retention, paths — no warehouse.
Capture any event from browser, mobile, or server SDKs. Query as funnels, retention curves, user paths, or raw SQL. Groups support tracks company-level metrics alongside individual users.
Stored in ClickHouse · shared schema with logs · JS, Swift, Kotlin SDKs
- Event captureJS · Swift · Kotlin · Python SDK · HTTP API · auto-capture
- Analysis typesFunnels · retention · paths · lifecycle · trends · SQL
- CohortsDefine by property, event, or behaviour · sync to feature flags
- GroupsCompany-level analytics alongside user-level — same schema
- NotebooksEmbed charts in Markdown notebooks for shareable analysis
- Data pipelineForward events to S3, BigQuery, or webhooks via Destinations
Feature Flags & Experiments. Ship safely, measure impact.
Server-evaluated flags with boolean, multivariate, and percentage-rollout variants. A/B and multivariate experiments with Bayesian significance built in. Target by cohort, property, group, or release.
Evaluated server-side · SDK polling · Oleus API · linked to analytics events
variants:
control: 50%
treatment: 50%
targeting:
cohort: beta_users
experiment: checkout_v2
metric: conversion_rate
- Flag typesBoolean · string · number · JSON — all multivariate
- RolloutPercentage · user property · cohort · group · release stage
- ExperimentsA/B · multivariate · Bayesian significance · auto-stop
- SDKsJS · Swift · Kotlin · Python · Go · Ruby — all server-side evaluated
- Local evaluationFlags cached locally — zero-latency reads, no network hop
- Audit logEvery flag change logged with author, timestamp, and diff
Session Replay & Heatmaps. See what users actually did.
DOM-capture session replay with console errors and network events attached to every frame. Click, scroll, and rage-click heatmaps aggregated across sessions. In-app surveys for qualitative signal. All stored on your infrastructure.
DOM snapshots · rrweb-compatible · privacy masking built in · linked to analytics events
- CaptureFull DOM snapshots · mutations · scroll · clicks · network · console
- PrivacyInput masking · element blocklist · no pixel-level video — GDPR-safe
- HeatmapsClick · scroll depth · rage-click · per-page or aggregated
- SurveysIn-app popups · NPS · rating · open-text · cohort or event-triggered
- LinkingJump from funnel drop-off directly to a replaying session
- StorageClickHouse blobs · configurable retention · S3 offload for long-term