OpenObserve Reference¶
Scope
Look-up facts for OpenObserve (O2): releases, editions, pricing, node roles, ports, configuration defaults, API endpoints, SQL functions, index types, and a hardening checklist. Configuration defaults come from the v1.0.4 source (src/config/src/config.rs) unless noted. The official docs still quote some older defaults; where they differ, both values are given. For how the pieces fit together, see Explanation. For tasks, see How-to Guides.
Release History¶
| Version | Date | Highlights |
|---|---|---|
| v1.0.4 | 2026-09-24 | Latest patch on the 1.0 line |
| v1.0.3 | 2026-09-18 | Patch |
| v1.0.2 | 2026-09-17 | Patch |
| v1.0.0 | GA announced 2026-09-22 (RC1 2026-09-03) | First 1.x GA, 375 commits (295 OSS + 80 enterprise) since v0.92.2. AI observability (agent/session tracing, evaluations, eval scheduler, annotation queues, Playground), SLOs with burn-rate alerts, composite alerts, an alert library of 1,200+ curated alerts, Terraform/OpenTofu export for alerts and SLOs, database monitoring, and Synthetic Monitoring moved into open source |
| v0.92.2 | 2026-08-17 | Last 0.x stable release |
| v0.92.1 | 2026-08-14 | Patch |
| v0.92.0 | 2026-08-07 | 836 commits across the OSS and enterprise repos. Synthetic Monitoring (browser and HTTP checks, private locations), AI observability expansion (trace/session evaluations, org AI credits, agent/service graph) |
| v0.91.0 | 2026-06-22 | Super Org multi-tenancy model, org-level ingestion tokens, org-level storage configuration, Tantivy search performance work |
| v0.90.0 | 2026-05-19 | Minor release (v0.90.1 patch followed) |
- Cadence: a minor release roughly every 4-7 weeks, with patch releases in between. There is no published LTS line or support window.
- Version in
Cargo.toml: thepackage.versionfield does not track release tags. It reads0.93.0at tagsv0.92.2throughv1.0.4. Use the Git tag or image tag, notCargo.toml. - Helm chart:
openobservechart1.0.2shipsappVersion: v1.0.1. The chart lags the application, so pinimage.oss.tag(or the enterprise tag) when you need the latest patch.
Sources: GitHub Releases, v1.0.4 release, v0.91.0 What's New, v1.0 GA press release (Business Wire, 2026-09-22), helm Chart.yaml.
Licensing and Editions¶
| Edition | License | Cost | Notes |
|---|---|---|---|
| Open Source | AGPL-3.0 (changed from Apache-2.0 in November 2023) | Free | Logs, metrics, traces, RUM, dashboards, alerts, pipelines, synthetic monitoring (from v1.0). No RBAC or SSO |
| Self-Hosted Enterprise | Commercial Enterprise License Agreement (not AGPL) | Free up to 50 GB/day ingestion (registration required); above that, contact sales | Adds the enterprise features listed below |
| OpenObserve Cloud | SaaS | Usage-based (see Pricing) | RBAC preconfigured; service accounts not supported |
Enterprise-only features (per the upstream README):
| Feature | Detail |
|---|---|
| SSO | OIDC, OAuth, SAML 2.0, LDAP/AD, via Dex (Okta, Azure Entra, Google, GitHub, GitLab, Keycloak) |
| Advanced RBAC | Custom roles, user groups, fine-grained permissions (OpenFGA). Requires HA mode |
| Audit trail | Immutable audit logs with configurable retention |
| Federated search | Query across clusters and regions (Super Cluster) |
| Sensitive Data Redaction (SDR) | Redact PII at ingest and query time |
| Advanced encryption | AES-256 SIV cipher keys, Google Tink KeySet, Akeyless integration |
| Query and workload management (QoS) | Resource limits and priorities in multi-tenant clusters |
The Helm chart repository is labelled Apache-2.0 on Artifact Hub (artifacthub.io/license). That label covers the chart, not the server.
Pricing¶
| Offering | Price | Included |
|---|---|---|
| Open Source (self-hosted) | $0 | You run and pay for your own infrastructure |
| Self-Hosted Enterprise | $0 up to 50 GB/day; custom above | Enterprise features; volume and multi-year discounts |
| Cloud, pay as you go | $0.50 per GB ingested, $0.01 per GB queried | 30-day retention for logs, traces, and RUM; 15-month retention for metrics; unlimited users; no per-host or per-seat fees; 14-day trial |
| Enterprise support | Custom | SLA, technical account management, migration help |
Cloud free tier: sources disagree
The pricing page and 2026 third-party reviews say the old Cloud free tier was discontinued (see the June 2025 pricing policy post) and replaced by a 14-day trial. The upstream README (2026-09) still says the Cloud free tier "includes up to 50 GB/day". Confirm on the pricing page before you rely on a free Cloud plan. The 50 GB/day free allowance for Self-Hosted Enterprise is consistent across sources.
Sources: Pricing, June '25 pricing policy updates, README: Enterprise Edition, CubeAPM pricing review.
Node Roles¶
Set with ZO_NODE_ROLE (comma-separated values are allowed). Values are from src/config/src/meta/cluster.rs at v1.0.4.
| Role value | Component | State | Purpose |
|---|---|---|---|
all |
Every component in one process | Local disk + SQLite | Default; single-node mode |
router |
Router | Stateless | Proxies ingest requests to ingesters and search requests to queriers; serves the UI |
ingester |
Ingester | WAL, Memtable, local Parquet | Parses, transforms, and writes data; uploads Parquet to object storage |
querier |
Querier | Stateless (caches only) | Runs SQL and PromQL searches over object storage and ingester buffers |
compactor |
Compactor | Stateless | Merges small files, enforces retention, runs stream deletions, updates the file list |
scheduler |
Scheduler | Stateless | Runs scheduled alerts, reports, and derived streams; sends notifications |
flatten_compactor |
Flatten compactor | Stateless | Separate compactor role present in source; not described on the architecture page |
alertmanagerandalert_managerare still accepted as aliases ofscheduler. Older docs and Helm values use the old name.ZO_NODE_ROLE_GROUPaccepts empty (default),interactive, orbackground. Alerts, reports, derived streams, and search jobs map tobackground; other searches map tointeractive.
Deployment Modes¶
| Mode | Metadata | Coordination | Data storage | Use |
|---|---|---|---|---|
| Single node, local disk | SQLite | In-process | Local disk | Default; dev, test, light production |
| Single node, object storage | SQLite | In-process | S3, GCS, Azure Blob, MinIO, RustFS | One node with durable, unbounded storage |
| HA (cluster) | PostgreSQL only | NATS | Object storage only | Production; every role scaled independently |
HA requirements: Kubernetes with Helm (the only officially packaged HA install), an object storage bucket created in advance, PostgreSQL (the chart provisions one primary and one replica through the CloudNativePG operator), NATS (three pods in the chart), and at least one node of each role. Enterprise RBAC adds OpenFGA; SSO adds Dex. The chart enables the Enterprise image and OpenFGA by default; Dex is off by default.
Ports¶
| Port | Setting | Protocol | Used for |
|---|---|---|---|
| 5080 | ZO_HTTP_PORT |
HTTP | UI, REST API, HTTP ingestion, OTLP/HTTP, /healthz |
| 5081 | ZO_GRPC_PORT |
gRPC (HTTP/2) | OTLP/gRPC ingestion and internal node-to-node gRPC (querier fan-out, super cluster) |
| 5082 | ZO_REPORT_SERVER_HTTP_PORT |
HTTP | Report server (dashboard PDF reports) |
| 6699 | ZO_TOKIO_CONSOLE_SERVER_PORT |
gRPC | Tokio console for debugging, when enabled |
Built-in TLS is available for both listeners: ZO_HTTP_TLS_ENABLED, ZO_HTTP_TLS_CERT_PATH, ZO_HTTP_TLS_KEY_PATH, ZO_HTTP_TLS_MIN_VERSION, and ZO_GRPC_TLS_ENABLED, ZO_GRPC_TLS_CERT_PATH, ZO_GRPC_TLS_KEY_PATH, ZO_GRPC_TLS_CERT_DOMAIN. Both are off by default.
Configuration Defaults¶
Key ZO_* environment variables with their defaults at v1.0.4. The full list is in the environment variables reference.
| Variable | Default | Meaning |
|---|---|---|
ZO_ROOT_USER_EMAIL / ZO_ROOT_USER_PASSWORD |
none | Root user, required on first start only |
ZO_ROOT_USER_TOKEN |
empty | Optional root API token |
ZO_LOCAL_MODE |
true |
Single-node mode; set false for HA |
ZO_LOCAL_MODE_STORAGE |
disk |
disk or s3 in local mode (ignored when ZO_LOCAL_MODE=false) |
ZO_NODE_ROLE |
all |
See Node Roles |
ZO_META_STORE |
empty | Resolves to sqlite in local mode; cluster mode accepts only postgres |
ZO_META_POSTGRES_DSN |
empty | Or set ZO_META_POSTGRES_HOST, _USER, _PASSWORD, _DBNAME |
ZO_CLUSTER_COORDINATOR |
nats |
Cluster coordinator |
ZO_QUEUE_STORE |
empty | Resolves to memory in local mode and nats in cluster mode |
ZO_DATA_DIR |
./data/ |
Local data root (WAL, cache, SQLite) |
ZO_S3_BUCKET_NAME, ZO_S3_REGION_NAME, ZO_S3_SERVER_URL, ZO_S3_PROVIDER |
empty | Object storage target; ZO_S3_PROVIDER values include s3, minio, gcs, oss, and azure, and it is auto-detected from ZO_S3_SERVER_URL when empty |
ZO_FILE_FORMAT |
parquet |
Storage format, with per-stream-type overrides, for example parquet,metrics=vortex |
ZO_PARQUET_COMPRESSION |
zstd |
Parquet codec |
ZO_INGEST_FLATTEN_LEVEL |
3 |
JSON nesting depth that is flattened |
ZO_COLS_PER_RECORD_LIMIT |
1000 |
Max fields per record (the Helm chart sets 200) |
ZO_PAYLOAD_LIMIT |
209715200 (200 MiB) |
Max HTTP request body |
ZO_INGEST_ALLOWED_UPTO |
5 hours |
How far in the past an event timestamp may be |
ZO_MAX_FILE_SIZE_IN_MEMORY |
512 MB |
Memtable size that triggers a switch to Immutable (docs quote 256) |
ZO_MAX_FILE_SIZE_ON_DISK |
512 MB |
WAL file and partition size threshold (docs quote 128) |
ZO_MEM_TABLE_MAX_SIZE |
0 (auto) |
Total Memtable budget: 25% of RAM in local mode, 50% in cluster mode |
ZO_MEM_PERSIST_INTERVAL |
2 s |
Immutable to local Parquet interval (docs quote 5) |
ZO_FILE_PUSH_INTERVAL |
2 s |
Local Parquet to object storage check interval (docs quote 10) |
ZO_MAX_FILE_RETENTION_TIME |
600 s |
Max age of a local Parquet file before upload |
ZO_WAL_FSYNC_DISABLED |
true |
WAL writes are not fsynced by default |
ZO_COMPACT_ENABLED |
true |
Background compaction |
ZO_COMPACT_INTERVAL |
10 s |
Compaction loop interval |
ZO_COMPACT_MAX_FILE_SIZE |
2048 MB |
Max merged file size |
ZO_COMPACT_DATA_RETENTION_DAYS |
3650 |
Default retention, overridable per stream |
ZO_DISK_CACHE_ENABLED |
true |
Querier disk cache; ZO_DISK_CACHE_MAX_SIZE=0 means 50% of free volume, capped at 500 GB |
ZO_MEMORY_CACHE_ENABLED |
false |
Querier memory cache; when enabled, ZO_MEMORY_CACHE_MAX_SIZE=0 means 50% of RAM |
ZO_RESULT_CACHE_ENABLED |
true (Helm value) |
Caches query results |
ZO_BLOOM_FILTER_ENABLED |
true |
Bloom filters for configured fields |
ZO_ENABLE_INVERTED_INDEX |
true |
Tantivy inverted index for full-text fields |
ZO_ROUTE_STRATEGY |
workload |
Router dispatch strategy |
ZO_TELEMETRY |
true |
Anonymous usage telemetry to the vendor; set false to opt out |
Ingestion and Query Endpoints¶
| Purpose | Endpoint | Notes |
|---|---|---|
| JSON logs | POST /api/{org}/{stream}/_json |
Body is a JSON array of objects |
| Elasticsearch bulk | POST /api/{org}/_bulk |
NDJSON; the index in the action line becomes the stream. Filebeat and Vector use /api/{org}/ as the ES base path |
| OTLP/HTTP | POST /api/{org}/v1/logs, /v1/metrics, /v1/traces |
stream-name header selects the stream |
| OTLP/gRPC | host:5081 |
Headers organization, stream-name, Authorization |
| OTLP profiles | OTLP Profiles signal | Documented for async-profiler, Go and Rust pprof, and the OTel eBPF profiler |
| Prometheus remote write | POST /api/{org}/prometheus/api/v1/write |
Basic auth |
| Search | POST /api/{org}/_search |
Body {"query":{"sql":"...","start_time":<µs>,"end_time":<µs>,"from":0,"size":100}}; start and end time are mandatory |
| Health | GET /healthz |
Used by the Helm liveness, readiness, and startup probes |
All HTTP APIs use HTTP Basic auth: email:password for users, email:token for service accounts. Other documented sources include Fluent Bit, Vector, Filebeat, Kinesis Firehose, and GCP Pub/Sub.
SQL Functions¶
OpenObserve SQL is the Apache DataFusion dialect plus these search functions. The stream name is the table name.
| Function | Purpose |
|---|---|
match_all('term') |
Case-insensitive full-text search across full-text-indexed fields; supports ab*, *ab, *ab*, and phrase prefix |
str_match(field, 'v') / str_match_ignore_case(field, 'v') |
Substring match on one field |
re_match(field, 'pattern') / re_not_match(...) |
Regex match on one field |
histogram(_timestamp, '1 minute') |
Time bucketing for aggregations |
approx_topk(field, k) / approx_topk_distinct(f1, f2, k) |
Approximate top-K (Space-Saving algorithm) |
arrcount, arrindex, arrjoin, arrsort, arrzip, arr_descending, cast_to_arr, to_array_string |
Array helpers |
spath(field, path) |
Extract a value from JSON |
Metrics can be queried with SQL or PromQL. VRL (Vector Remap Language) is the language for ingest and query functions and pipeline transforms.
Index and Partition Types¶
| Type | Best for | Cost | Since |
|---|---|---|---|
Time partition (org/stream/year/month/day/hour) |
Every query | None; always on | Always |
| KeyValue partition | Low-cardinality fields (namespace, host) | Many small files if misused; immutable once set | — |
| Hash partition (8, 16, 32, 64, 128 buckets) | Skewed low-cardinality fields | As above | — |
| Bloom filter | High-cardinality equality (trace_id, request_id) |
Negligible | v0.8.0 |
| Full-text search fields | match_all targets (body, log, message) |
Scan cost | — |
| Inverted index (Tantivy) | Full-text search at scale | About 25% extra storage; vendor reports up to 1000x faster search | v0.10.0 |
| Secondary index | Equality lookups on chosen fields | Index files | TBD — release not confirmed |
Tantivy indexes are stored as one .ttv file per data file, holding a single Tantivy segment in an Apache Iceberg Puffin container.
Dependency Versions (v1.0.4)¶
| Dependency | Version |
|---|---|
| Rust toolchain | nightly-2026-05-20, edition 2024 |
| Apache DataFusion | 54 (patched OpenObserve fork) |
| Apache Arrow and Parquet crates | 58 |
| Tantivy | 0.26 (OpenObserve fork, perf/openobserve branch) |
| Vortex | OpenObserve fork (pinned Git revision) |
| VRL | 0.31 |
| async-nats | 0.47 |
Images, Charts, and Tools¶
| Artifact | Location |
|---|---|
| OSS image | public.ecr.aws/zinclabs/openobserve (README) and o2cr.ai/openobserve/openobserve (Helm image.oss, used when enterprise.enabled: false) |
| Enterprise image | o2cr.ai/openobserve/openobserve-enterprise (the Helm chart default, enterprise.enabled: true), also on public.ecr.aws/zinclabs/openobserve-enterprise |
| Image tags | latest, latest-simd (AVX-512 or NEON builds), and version tags such as v1.0.4 |
| Binaries | Linux (glibc and musl), macOS, Windows; amd64 and arm64 |
| Helm charts | openobserve (HA), openobserve-standalone, openobserve-collector at https://charts.openobserve.ai |
| O2 CLI | o2 v1.1.3, Enterprise only; manages dashboards, alerts, templates, destinations, pipelines, functions |
| Kubernetes operator | o2-k8s-operator, Enterprise only; CRDs in openobserve.ai/v1alpha1 (Alert, AlertTemplate, Destination, Pipeline, Function, Dashboard, plus a connection config). It manages configuration objects, not the OpenObserve deployment |
Roles and Access (Enterprise and Cloud)¶
| Principal or role | Access |
|---|---|
| Root user | One per installation, set by environment variables; full access to every organization |
| Admin | Full access to the organization, including user management |
| Editor | List, get, create, update, and delete on resources; no user management |
| Viewer | Read only |
| User | No access; sees an "Unauthorized Access" warning until granted a role |
| Custom roles | Per-resource permissions (list, get, create, update, delete), including LLM evaluation resources |
| Service accounts | Non-human identity; Basic auth with email and token. Enterprise: no permissions until a role is assigned. Open source: full access. Cloud: not supported |
In the open-source edition there is no RBAC: organization roles are root, admin, and member, and every user can access everything in their organizations.
Security Hardening Checklist¶
| Area | Recommendation |
|---|---|
| Root credentials | Set a strong ZO_ROOT_USER_PASSWORD (8-128 characters with lower, upper, digit, and special characters) and keep it in a Kubernetes Secret |
| TLS | Enable ZO_HTTP_TLS_ENABLED and ZO_GRPC_TLS_ENABLED, or terminate TLS at an ingress or load balancer |
| Internal gRPC | Set ZO_INTERNAL_GRPC_TOKEN and keep port 5081 internal unless you accept OTLP/gRPC from outside |
| Object storage credentials | Use IAM roles (EKS IRSA) instead of static keys |
| Object storage encryption | Enforce bucket-level encryption (SSE-S3 by default, SSE-KMS for key control and CloudTrail audit) |
| PostgreSQL | sslmode=require, a dedicated database user, DSN in a Secret (auth.ZO_META_POSTGRES_DSN) |
| Access control | Enterprise: enable OpenFGA RBAC and SSO; give each collector its own service account |
| Tenancy | One organization per team or tenant; set per-stream retention |
| Telemetry | Set ZO_TELEMETRY=false if outbound usage telemetry is not allowed |
| Example credentials | Replace chart defaults such as [email protected] / Complexpass#123 and the sample SMTP values |
Performance and Sizing Figures¶
| Figure | Value | Source |
|---|---|---|
| Single node ingest (Apple M2, defaults) | About 31 MB/s, about 2.6 TB/day | Architecture docs |
| Per-core ingest | 7-30 MB/s per vCPU | Performance docs |
| Ingester sizing example | 4 vCPU to 16 GB RAM; about 3,000 IOPS on WAL disks | Performance docs |
| OTLP/gRPC versus HTTP JSON | 60-100% more ingest throughput | Performance docs |
| Largest deployment | 2+ PB/day ingestion | Vendor claim (README) |
| Storage cost versus Elasticsearch | Up to 140x lower | Vendor claim (README) |
| Hardware versus Elasticsearch | About a quarter of the hardware for better query performance | Vendor claim (README) |
Illustrative HA starting point (unverified)
Earlier versions of this page listed an HA baseline of 3 ingesters (2 vCPU, 4 GB, 100 GB WAL disk), 2 queriers (4 vCPU, 8 GB, 50 GB cache), 1 compactor (2 vCPU, 4 GB), 2 routers (1 vCPU, 1 GB), 1 scheduler (1 vCPU, 1 GB), and PostgreSQL (1 vCPU, 2 GB). No official source gives these numbers. Note that the ingester memory is below the vendor's 1:4 CPU-to-RAM example. For real sizing, use the official capacity planning sheet.
Compliance¶
SOC 2 Type II and ISO 27001 certified, GDPR compliant, and HIPAA ready (a BAA is available with Enterprise contracts), per the upstream README. These cover the vendor and its Cloud service, not a self-hosted install.
Deprecations and Removals¶
| Change | Status at v1.0.4 |
|---|---|
alertmanager role renamed scheduler |
Old name still accepted as an alias |
| etcd cluster coordinator | Removed; NATS is the only coordinator (issue #8277) |
| MySQL metadata store | Rejected at startup ("We don't support MySQL anymore"); the HA docs page still describes it |
| Cluster mode with SQLite | Not allowed; cluster mode requires PostgreSQL |
ZO_FEATURE_PER_THREAD_LOCK |
Not present in v1.0.4 source; the performance docs still recommend it |
ZO_UDSCHEMA_MAX_FIELDS |
Deprecated since v0.14.1; use ZO_SCHEMA_MAX_FIELDS_TO_ENABLE_UDS |
Sources¶
- openobserve/openobserve README (editions, pricing, compliance, vendor claims)
- config.rs at v1.0.4 and cluster.rs (defaults, roles)
- Architecture, HA deployment, Environment variables
- SQL reference, Search API
- Tantivy indexing
- openobserve-helm-chart, o2-cli, o2-k8s-operator
- Why OpenObserve moved from Apache to AGPL