Skip to content

OpenObserve Reference

Scope

Look-up facts for OpenObserve (O2): releases, editions, pricing, node roles, ports, configuration defaults, API endpoints, SQL functions, index types, and a hardening checklist. Configuration defaults come from the v1.0.4 source (src/config/src/config.rs) unless noted. The official docs still quote some older defaults; where they differ, both values are given. For how the pieces fit together, see Explanation. For tasks, see How-to Guides.

Release History

Version Date Highlights
v1.0.4 2026-09-24 Latest patch on the 1.0 line
v1.0.3 2026-09-18 Patch
v1.0.2 2026-09-17 Patch
v1.0.0 GA announced 2026-09-22 (RC1 2026-09-03) First 1.x GA, 375 commits (295 OSS + 80 enterprise) since v0.92.2. AI observability (agent/session tracing, evaluations, eval scheduler, annotation queues, Playground), SLOs with burn-rate alerts, composite alerts, an alert library of 1,200+ curated alerts, Terraform/OpenTofu export for alerts and SLOs, database monitoring, and Synthetic Monitoring moved into open source
v0.92.2 2026-08-17 Last 0.x stable release
v0.92.1 2026-08-14 Patch
v0.92.0 2026-08-07 836 commits across the OSS and enterprise repos. Synthetic Monitoring (browser and HTTP checks, private locations), AI observability expansion (trace/session evaluations, org AI credits, agent/service graph)
v0.91.0 2026-06-22 Super Org multi-tenancy model, org-level ingestion tokens, org-level storage configuration, Tantivy search performance work
v0.90.0 2026-05-19 Minor release (v0.90.1 patch followed)
  • Cadence: a minor release roughly every 4-7 weeks, with patch releases in between. There is no published LTS line or support window.
  • Version in Cargo.toml: the package.version field does not track release tags. It reads 0.93.0 at tags v0.92.2 through v1.0.4. Use the Git tag or image tag, not Cargo.toml.
  • Helm chart: openobserve chart 1.0.2 ships appVersion: v1.0.1. The chart lags the application, so pin image.oss.tag (or the enterprise tag) when you need the latest patch.

Sources: GitHub Releases, v1.0.4 release, v0.91.0 What's New, v1.0 GA press release (Business Wire, 2026-09-22), helm Chart.yaml.

Licensing and Editions

Edition License Cost Notes
Open Source AGPL-3.0 (changed from Apache-2.0 in November 2023) Free Logs, metrics, traces, RUM, dashboards, alerts, pipelines, synthetic monitoring (from v1.0). No RBAC or SSO
Self-Hosted Enterprise Commercial Enterprise License Agreement (not AGPL) Free up to 50 GB/day ingestion (registration required); above that, contact sales Adds the enterprise features listed below
OpenObserve Cloud SaaS Usage-based (see Pricing) RBAC preconfigured; service accounts not supported

Enterprise-only features (per the upstream README):

Feature Detail
SSO OIDC, OAuth, SAML 2.0, LDAP/AD, via Dex (Okta, Azure Entra, Google, GitHub, GitLab, Keycloak)
Advanced RBAC Custom roles, user groups, fine-grained permissions (OpenFGA). Requires HA mode
Audit trail Immutable audit logs with configurable retention
Federated search Query across clusters and regions (Super Cluster)
Sensitive Data Redaction (SDR) Redact PII at ingest and query time
Advanced encryption AES-256 SIV cipher keys, Google Tink KeySet, Akeyless integration
Query and workload management (QoS) Resource limits and priorities in multi-tenant clusters

The Helm chart repository is labelled Apache-2.0 on Artifact Hub (artifacthub.io/license). That label covers the chart, not the server.

Pricing

Offering Price Included
Open Source (self-hosted) $0 You run and pay for your own infrastructure
Self-Hosted Enterprise $0 up to 50 GB/day; custom above Enterprise features; volume and multi-year discounts
Cloud, pay as you go $0.50 per GB ingested, $0.01 per GB queried 30-day retention for logs, traces, and RUM; 15-month retention for metrics; unlimited users; no per-host or per-seat fees; 14-day trial
Enterprise support Custom SLA, technical account management, migration help

Cloud free tier: sources disagree

The pricing page and 2026 third-party reviews say the old Cloud free tier was discontinued (see the June 2025 pricing policy post) and replaced by a 14-day trial. The upstream README (2026-09) still says the Cloud free tier "includes up to 50 GB/day". Confirm on the pricing page before you rely on a free Cloud plan. The 50 GB/day free allowance for Self-Hosted Enterprise is consistent across sources.

Sources: Pricing, June '25 pricing policy updates, README: Enterprise Edition, CubeAPM pricing review.

Node Roles

Set with ZO_NODE_ROLE (comma-separated values are allowed). Values are from src/config/src/meta/cluster.rs at v1.0.4.

Role value Component State Purpose
all Every component in one process Local disk + SQLite Default; single-node mode
router Router Stateless Proxies ingest requests to ingesters and search requests to queriers; serves the UI
ingester Ingester WAL, Memtable, local Parquet Parses, transforms, and writes data; uploads Parquet to object storage
querier Querier Stateless (caches only) Runs SQL and PromQL searches over object storage and ingester buffers
compactor Compactor Stateless Merges small files, enforces retention, runs stream deletions, updates the file list
scheduler Scheduler Stateless Runs scheduled alerts, reports, and derived streams; sends notifications
flatten_compactor Flatten compactor Stateless Separate compactor role present in source; not described on the architecture page
  • alertmanager and alert_manager are still accepted as aliases of scheduler. Older docs and Helm values use the old name.
  • ZO_NODE_ROLE_GROUP accepts empty (default), interactive, or background. Alerts, reports, derived streams, and search jobs map to background; other searches map to interactive.

Deployment Modes

Mode Metadata Coordination Data storage Use
Single node, local disk SQLite In-process Local disk Default; dev, test, light production
Single node, object storage SQLite In-process S3, GCS, Azure Blob, MinIO, RustFS One node with durable, unbounded storage
HA (cluster) PostgreSQL only NATS Object storage only Production; every role scaled independently

HA requirements: Kubernetes with Helm (the only officially packaged HA install), an object storage bucket created in advance, PostgreSQL (the chart provisions one primary and one replica through the CloudNativePG operator), NATS (three pods in the chart), and at least one node of each role. Enterprise RBAC adds OpenFGA; SSO adds Dex. The chart enables the Enterprise image and OpenFGA by default; Dex is off by default.

Ports

Port Setting Protocol Used for
5080 ZO_HTTP_PORT HTTP UI, REST API, HTTP ingestion, OTLP/HTTP, /healthz
5081 ZO_GRPC_PORT gRPC (HTTP/2) OTLP/gRPC ingestion and internal node-to-node gRPC (querier fan-out, super cluster)
5082 ZO_REPORT_SERVER_HTTP_PORT HTTP Report server (dashboard PDF reports)
6699 ZO_TOKIO_CONSOLE_SERVER_PORT gRPC Tokio console for debugging, when enabled

Built-in TLS is available for both listeners: ZO_HTTP_TLS_ENABLED, ZO_HTTP_TLS_CERT_PATH, ZO_HTTP_TLS_KEY_PATH, ZO_HTTP_TLS_MIN_VERSION, and ZO_GRPC_TLS_ENABLED, ZO_GRPC_TLS_CERT_PATH, ZO_GRPC_TLS_KEY_PATH, ZO_GRPC_TLS_CERT_DOMAIN. Both are off by default.

Configuration Defaults

Key ZO_* environment variables with their defaults at v1.0.4. The full list is in the environment variables reference.

Variable Default Meaning
ZO_ROOT_USER_EMAIL / ZO_ROOT_USER_PASSWORD none Root user, required on first start only
ZO_ROOT_USER_TOKEN empty Optional root API token
ZO_LOCAL_MODE true Single-node mode; set false for HA
ZO_LOCAL_MODE_STORAGE disk disk or s3 in local mode (ignored when ZO_LOCAL_MODE=false)
ZO_NODE_ROLE all See Node Roles
ZO_META_STORE empty Resolves to sqlite in local mode; cluster mode accepts only postgres
ZO_META_POSTGRES_DSN empty Or set ZO_META_POSTGRES_HOST, _USER, _PASSWORD, _DBNAME
ZO_CLUSTER_COORDINATOR nats Cluster coordinator
ZO_QUEUE_STORE empty Resolves to memory in local mode and nats in cluster mode
ZO_DATA_DIR ./data/ Local data root (WAL, cache, SQLite)
ZO_S3_BUCKET_NAME, ZO_S3_REGION_NAME, ZO_S3_SERVER_URL, ZO_S3_PROVIDER empty Object storage target; ZO_S3_PROVIDER values include s3, minio, gcs, oss, and azure, and it is auto-detected from ZO_S3_SERVER_URL when empty
ZO_FILE_FORMAT parquet Storage format, with per-stream-type overrides, for example parquet,metrics=vortex
ZO_PARQUET_COMPRESSION zstd Parquet codec
ZO_INGEST_FLATTEN_LEVEL 3 JSON nesting depth that is flattened
ZO_COLS_PER_RECORD_LIMIT 1000 Max fields per record (the Helm chart sets 200)
ZO_PAYLOAD_LIMIT 209715200 (200 MiB) Max HTTP request body
ZO_INGEST_ALLOWED_UPTO 5 hours How far in the past an event timestamp may be
ZO_MAX_FILE_SIZE_IN_MEMORY 512 MB Memtable size that triggers a switch to Immutable (docs quote 256)
ZO_MAX_FILE_SIZE_ON_DISK 512 MB WAL file and partition size threshold (docs quote 128)
ZO_MEM_TABLE_MAX_SIZE 0 (auto) Total Memtable budget: 25% of RAM in local mode, 50% in cluster mode
ZO_MEM_PERSIST_INTERVAL 2 s Immutable to local Parquet interval (docs quote 5)
ZO_FILE_PUSH_INTERVAL 2 s Local Parquet to object storage check interval (docs quote 10)
ZO_MAX_FILE_RETENTION_TIME 600 s Max age of a local Parquet file before upload
ZO_WAL_FSYNC_DISABLED true WAL writes are not fsynced by default
ZO_COMPACT_ENABLED true Background compaction
ZO_COMPACT_INTERVAL 10 s Compaction loop interval
ZO_COMPACT_MAX_FILE_SIZE 2048 MB Max merged file size
ZO_COMPACT_DATA_RETENTION_DAYS 3650 Default retention, overridable per stream
ZO_DISK_CACHE_ENABLED true Querier disk cache; ZO_DISK_CACHE_MAX_SIZE=0 means 50% of free volume, capped at 500 GB
ZO_MEMORY_CACHE_ENABLED false Querier memory cache; when enabled, ZO_MEMORY_CACHE_MAX_SIZE=0 means 50% of RAM
ZO_RESULT_CACHE_ENABLED true (Helm value) Caches query results
ZO_BLOOM_FILTER_ENABLED true Bloom filters for configured fields
ZO_ENABLE_INVERTED_INDEX true Tantivy inverted index for full-text fields
ZO_ROUTE_STRATEGY workload Router dispatch strategy
ZO_TELEMETRY true Anonymous usage telemetry to the vendor; set false to opt out

Ingestion and Query Endpoints

Purpose Endpoint Notes
JSON logs POST /api/{org}/{stream}/_json Body is a JSON array of objects
Elasticsearch bulk POST /api/{org}/_bulk NDJSON; the index in the action line becomes the stream. Filebeat and Vector use /api/{org}/ as the ES base path
OTLP/HTTP POST /api/{org}/v1/logs, /v1/metrics, /v1/traces stream-name header selects the stream
OTLP/gRPC host:5081 Headers organization, stream-name, Authorization
OTLP profiles OTLP Profiles signal Documented for async-profiler, Go and Rust pprof, and the OTel eBPF profiler
Prometheus remote write POST /api/{org}/prometheus/api/v1/write Basic auth
Search POST /api/{org}/_search Body {"query":{"sql":"...","start_time":<µs>,"end_time":<µs>,"from":0,"size":100}}; start and end time are mandatory
Health GET /healthz Used by the Helm liveness, readiness, and startup probes

All HTTP APIs use HTTP Basic auth: email:password for users, email:token for service accounts. Other documented sources include Fluent Bit, Vector, Filebeat, Kinesis Firehose, and GCP Pub/Sub.

SQL Functions

OpenObserve SQL is the Apache DataFusion dialect plus these search functions. The stream name is the table name.

Function Purpose
match_all('term') Case-insensitive full-text search across full-text-indexed fields; supports ab*, *ab, *ab*, and phrase prefix
str_match(field, 'v') / str_match_ignore_case(field, 'v') Substring match on one field
re_match(field, 'pattern') / re_not_match(...) Regex match on one field
histogram(_timestamp, '1 minute') Time bucketing for aggregations
approx_topk(field, k) / approx_topk_distinct(f1, f2, k) Approximate top-K (Space-Saving algorithm)
arrcount, arrindex, arrjoin, arrsort, arrzip, arr_descending, cast_to_arr, to_array_string Array helpers
spath(field, path) Extract a value from JSON

Metrics can be queried with SQL or PromQL. VRL (Vector Remap Language) is the language for ingest and query functions and pipeline transforms.

Index and Partition Types

Type Best for Cost Since
Time partition (org/stream/year/month/day/hour) Every query None; always on Always
KeyValue partition Low-cardinality fields (namespace, host) Many small files if misused; immutable once set —
Hash partition (8, 16, 32, 64, 128 buckets) Skewed low-cardinality fields As above —
Bloom filter High-cardinality equality (trace_id, request_id) Negligible v0.8.0
Full-text search fields match_all targets (body, log, message) Scan cost —
Inverted index (Tantivy) Full-text search at scale About 25% extra storage; vendor reports up to 1000x faster search v0.10.0
Secondary index Equality lookups on chosen fields Index files TBD — release not confirmed

Tantivy indexes are stored as one .ttv file per data file, holding a single Tantivy segment in an Apache Iceberg Puffin container.

Dependency Versions (v1.0.4)

Dependency Version
Rust toolchain nightly-2026-05-20, edition 2024
Apache DataFusion 54 (patched OpenObserve fork)
Apache Arrow and Parquet crates 58
Tantivy 0.26 (OpenObserve fork, perf/openobserve branch)
Vortex OpenObserve fork (pinned Git revision)
VRL 0.31
async-nats 0.47

Images, Charts, and Tools

Artifact Location
OSS image public.ecr.aws/zinclabs/openobserve (README) and o2cr.ai/openobserve/openobserve (Helm image.oss, used when enterprise.enabled: false)
Enterprise image o2cr.ai/openobserve/openobserve-enterprise (the Helm chart default, enterprise.enabled: true), also on public.ecr.aws/zinclabs/openobserve-enterprise
Image tags latest, latest-simd (AVX-512 or NEON builds), and version tags such as v1.0.4
Binaries Linux (glibc and musl), macOS, Windows; amd64 and arm64
Helm charts openobserve (HA), openobserve-standalone, openobserve-collector at https://charts.openobserve.ai
O2 CLI o2 v1.1.3, Enterprise only; manages dashboards, alerts, templates, destinations, pipelines, functions
Kubernetes operator o2-k8s-operator, Enterprise only; CRDs in openobserve.ai/v1alpha1 (Alert, AlertTemplate, Destination, Pipeline, Function, Dashboard, plus a connection config). It manages configuration objects, not the OpenObserve deployment

Roles and Access (Enterprise and Cloud)

Principal or role Access
Root user One per installation, set by environment variables; full access to every organization
Admin Full access to the organization, including user management
Editor List, get, create, update, and delete on resources; no user management
Viewer Read only
User No access; sees an "Unauthorized Access" warning until granted a role
Custom roles Per-resource permissions (list, get, create, update, delete), including LLM evaluation resources
Service accounts Non-human identity; Basic auth with email and token. Enterprise: no permissions until a role is assigned. Open source: full access. Cloud: not supported

In the open-source edition there is no RBAC: organization roles are root, admin, and member, and every user can access everything in their organizations.

Security Hardening Checklist

Area Recommendation
Root credentials Set a strong ZO_ROOT_USER_PASSWORD (8-128 characters with lower, upper, digit, and special characters) and keep it in a Kubernetes Secret
TLS Enable ZO_HTTP_TLS_ENABLED and ZO_GRPC_TLS_ENABLED, or terminate TLS at an ingress or load balancer
Internal gRPC Set ZO_INTERNAL_GRPC_TOKEN and keep port 5081 internal unless you accept OTLP/gRPC from outside
Object storage credentials Use IAM roles (EKS IRSA) instead of static keys
Object storage encryption Enforce bucket-level encryption (SSE-S3 by default, SSE-KMS for key control and CloudTrail audit)
PostgreSQL sslmode=require, a dedicated database user, DSN in a Secret (auth.ZO_META_POSTGRES_DSN)
Access control Enterprise: enable OpenFGA RBAC and SSO; give each collector its own service account
Tenancy One organization per team or tenant; set per-stream retention
Telemetry Set ZO_TELEMETRY=false if outbound usage telemetry is not allowed
Example credentials Replace chart defaults such as [email protected] / Complexpass#123 and the sample SMTP values

Performance and Sizing Figures

Figure Value Source
Single node ingest (Apple M2, defaults) About 31 MB/s, about 2.6 TB/day Architecture docs
Per-core ingest 7-30 MB/s per vCPU Performance docs
Ingester sizing example 4 vCPU to 16 GB RAM; about 3,000 IOPS on WAL disks Performance docs
OTLP/gRPC versus HTTP JSON 60-100% more ingest throughput Performance docs
Largest deployment 2+ PB/day ingestion Vendor claim (README)
Storage cost versus Elasticsearch Up to 140x lower Vendor claim (README)
Hardware versus Elasticsearch About a quarter of the hardware for better query performance Vendor claim (README)

Illustrative HA starting point (unverified)

Earlier versions of this page listed an HA baseline of 3 ingesters (2 vCPU, 4 GB, 100 GB WAL disk), 2 queriers (4 vCPU, 8 GB, 50 GB cache), 1 compactor (2 vCPU, 4 GB), 2 routers (1 vCPU, 1 GB), 1 scheduler (1 vCPU, 1 GB), and PostgreSQL (1 vCPU, 2 GB). No official source gives these numbers. Note that the ingester memory is below the vendor's 1:4 CPU-to-RAM example. For real sizing, use the official capacity planning sheet.

Compliance

SOC 2 Type II and ISO 27001 certified, GDPR compliant, and HIPAA ready (a BAA is available with Enterprise contracts), per the upstream README. These cover the vendor and its Cloud service, not a self-hosted install.

Deprecations and Removals

Change Status at v1.0.4
alertmanager role renamed scheduler Old name still accepted as an alias
etcd cluster coordinator Removed; NATS is the only coordinator (issue #8277)
MySQL metadata store Rejected at startup ("We don't support MySQL anymore"); the HA docs page still describes it
Cluster mode with SQLite Not allowed; cluster mode requires PostgreSQL
ZO_FEATURE_PER_THREAD_LOCK Not present in v1.0.4 source; the performance docs still recommend it
ZO_UDSCHEMA_MAX_FIELDS Deprecated since v0.14.1; use ZO_SCHEMA_MAX_FIELDS_TO_ENABLE_UDS

Sources