Skip to main content
Beta: LLM Observability is now GA
aiAxonIQ
Try Playground
DocsUse cases
Get Started Free
Log Management

Petabyte-Scale Log Analytics.
Sub-Second BM25 Precision.

Ingest millions of records per second via OTLP, syslog, and FluentBit into ClickHouse columnar storage with 12.4x zstd compression. Execute BM25 full-text queries and instant trace correlations across high-cardinality cloud workloads without runaway storage bills.

Start free Try the Playground
Full-text searchlog pattern clusteringLive tailJSON parsingLog-to-trace correlationClickHouse powered
telemetry.aiaxoniq.net/logs
STREAM LIVE
ClickHouse Real-Time Log Pipeline
Indexed: 14.8M records/min
12:20:41.104INFOingress-controllerHTTP 200 GET /healthz duration=1.2ms client_ip=10.0.4.12
12:20:41.218INFOauth-validatorSession token verified claims=["read","write"] tenant_id=tenant_048
12:20:41.442WARNcache-redisSlow query warning: key="order:pending:8842" latency=14.8ms threshold=10ms
12:20:41.691INFOkafka-consumerPartition 3 committed offset=9812450 lag=0 records_in_batch=64

Deep Dive

Core Capabilities & Architecture

Explore how Log Management instruments, processes, and correlates high-cardinality telemetry at scale.

Ingestion

Stream, Tokenize, and Compress at High Velocity

Direct OTLP 1.3, syslog, Vector, Fluentd, and Logstash ingestion buffered via Kafka with dead-letter queue isolation. ClickHouse stores high-cardinality event attributes in columnar format with 12.4x zstd compression, making petabyte retention affordable.

  • Direct OTLP 1.3 (HTTP/gRPC), syslog RFC 5424, FluentBit, Vector, and Logstash
  • ClickHouse 24.8 columnar storage engine delivering 12.4:1 zstd compression ratios
  • Zero-allocation SIMD JSON parser with schema-on-read attribute extraction
  • Per-tenant partitioning, multi-region residency, and immutable retention lifecycles
Interactive Engine
OTLP 1.3 Streaming Pipeline
148,200 events/sec
INFOapi-gatewayPOST /v1/checkout status=200 dur=18.4ms trace_id=tr_91a0c
342B
WARNbilling-svcpayment_retry_attempt=1 gateway=stripe code=RATE_LIMIT_SLOWDOWN
488B
INFOinventory-svcsku_reserved item=ax_8891 count=2 warehouse=us-east-1
280B
Compression
12.4x zstd
Commit Lag
0.0 ms
Storage Backend
ClickHouse 24.8
ClickHouse 24.8 · OTLP 1.3 Native100% Ingestion Parity
Search

Sub-Second Inverted Index & Query Execution

BM25 full-text relevance search backed by OpenSearch combined with sub-second analytical aggregations powered by ClickHouse materialized views. Filter across services, trace IDs, severity levels, and arbitrary JSON payloads in milliseconds.

  • BM25 relevance scoring with dynamic term highlighting across multi-terabyte datasets
  • MinMax index skipping and primary key partitioning for sub-10ms query execution
  • Single-click jump from any log event directly into its correlated distributed trace span
  • Continuous query streaming with live tail and regex pattern matching
Interactive Engine
service:payment-service level:ERROR "connection pool timeout"
3.2ms
Matched: 14 rows·Scanned: 8.2M rows (99.8% pruned via MinMax index)
BM25 Ranked
2026-09-27T13:28:44.812Z · host-cluster-node-04trace_id=tr_8019ab7
[ERROR] db_pool.go:142: pool exhausted while acquiring connection: timeout after 5000ms (max_conns=100 active=100)
Stack: checkout.ExecutePayment → pgx.AcquireJump to Trace →
ClickHouse 24.8 · OTLP 1.3 Native100% Ingestion Parity
Intelligence

Drain Heuristic Pattern Clustering & Anomaly Alerts

Automated log clustering continuously aggregates millions of raw messages into distinct structural regex templates. Instantly surfaces novel error signatures and alerts on frequency drift before user impact.

  • Automated log pattern clustering via online Drain heuristics without manual regex authoring
  • Novel pattern detection alerting on the very first occurrence of unseen error signatures
  • Statistical anomaly detection on entropy shifts, volume spikes, and error ratios
  • Runtime dynamic parameter masking for sensitive tokens and personal data
Interactive Engine
Drain Heuristic Log Clustering
420k raw lines → 3 templates
74% of all volume (310.8k hits)Normal Baseline
HTTP <*> GET /api/v1/orders/<*> status=200 duration=<*>ms
24% of all volume (100.8k hits)Normal Baseline
Session authenticated token=<*> tenant_id=<*>
2% of all volume (8.4k hits)NOVEL SPIKE ALERT (+420%)
ERROR connection reset by peer remote_addr=<*>
ClickHouse 24.8 · OTLP 1.3 Native100% Ingestion Parity

Built for every team that cares about reliability

One platform, tailored to how your team actually works.

SRE & On-call

Sub-minute MTTR during severe outages

Instantly pinpoint the exact log line and correlated distributed trace that triggered a canary failure without opening dozens of terminal tabs.

Security teams

Immutable Audit Trail & Compliance

Meet SOC 2 Type II and ISO 27001 compliance with cryptographically verified tamper-evident log partitions and configurable cold-tier retention.

Developer teams

Zero-Guessing Microservice Debugging

Watch real-time live tail streams synchronized across all microservices during canary rollouts, catching memory leaks and uncaught exceptions immediately.

Under the hood

Dual-Engine Analytical Speed & Full-Text Precision

Every incoming log record is dual-processed: ClickHouse manages blazing-fast analytical aggregations, percentile rollups, and compression over high-volume telemetry, while OpenSearch provides BM25 inverted index token matching and relevance ranking. You get sub-10ms analytics and forensic search without trade-offs.

140,000+ logs/sec ingestion per nodeClickHouse 24.8 + OpenSearch dual-engineSub-8ms p99 query latency across billions of rows

Also in the platform

APM & Tracing Security Metrics

Guides

Why We Chose ClickHouse for Observability Data

Start log management in 5 minutes

Your existing OpenTelemetry instrumentation works unchanged, so there is nothing to rewrite and nothing to migrate.

Get started free Read the docs