OpenObserve
Audited from github.com/openobserve/openobserve
OpenObserve is an open-source, AGPL-3.0 Rust observability platform that stores logs, metrics, traces and RUM data as Parquet files on S3-compatible storage, queried with SQL and PromQL from a single binary.
- Language
- TypeScript
- Hosting
- Docker
- License
- AGPL-3.0
- Running for
- 2 years
- Team
- 6-20 People
Why this architecture
Storing telemetry as Parquet on object storage instead of a traditional database, paired with DataFusion for SQL and dedicated PromQL crates, is what the project credits for its lower storage cost, while Cargo feature flags keep enterprise-only code optional inside the same open-core binary.
Tech stack by layer
15 technologies · audited Sep 17, 2026- VueVue 3 single-page app for logs, traces, metrics, dashboards, alerts and pipelines.
- TypeScriptPrimary language for the web UI, type-checked with vue-tsc across several tsconfig targets.
- ViteBuilds and serves the UI, mounted under the /web/ base path (npm run dev runs "vite --base /web/").
- Monaco EditorPowers SQL/VRL/PromQL editing surfaces in the query builder and pipeline editor.
- RustThe entire server is one Rust binary; the workspace root Cargo.toml lists 40+ internal crates under src/.
- AxumHTTP framework for the ingest, search and management APIs (axum, axum-extra, axum-server workspace deps).
- TokioAsync runtime underlying the server and all workspace crates.
- gRPCtonic/tonic-prost provide inter-node RPC for the clustered/HA deployment mode.
- OpenTelemetryNative OTLP ingestion (opentelemetry, opentelemetry-otlp, opentelemetry-proto workspace deps) as the primary ingest protocol.
- ParquetLogs, metrics and traces are stored as Parquet files; the parquet crate is a direct workspace dependency.
- ArrowColumnar in-memory format used across ingestion, search and compaction (arrow, arrow-flight, arrow-json workspace deps).
- DataFusionSQL query engine executed over the Parquet/Arrow data for logs and trace search.
- TantivyFull-text search index used to accelerate log search (tantivy, tantivy-fst workspace deps).
- Dockerdeploy/build/Dockerfile is a multi-stage build: Node builds the web UI, then Rust compiles the release binary into a Debian runtime image.
- Kubernetesdeploy/k8s holds Kubernetes manifests for clustered/HA deployment.
- GitHub Actionsdb-testing.yml, api-testing.yml, cargo-deny.yml and dozens more workflows gate every PR before merge.
- Model Context Protocolsrc/mcp is a workspace crate; the main binary depends on openobserve-mcp to serve an MCP endpoint for AI agents.
OpenObserve architecture diagram
Open SVGDiagram as text
- Telemetry sources (OTLP · logs · metrics) → Ingest API (Axum · OTLP): OTLP / HTTP
- Web UI (Vue 3 · Monaco) → Search API (DataFusion SQL · PromQL): queries
- AI agents (MCP) → MCP endpoint (openobserve-mcp): tools
- Ingest API (Axum · OTLP) → Ingester + WAL (Arrow): write
- Ingester + WAL (Arrow) → Object storage (Parquet files (S3)): flush Parquet
- Ingester + WAL (Arrow) → Full-text index (Tantivy): index logs
- Compactor (Parquet merge) → Object storage (Parquet files (S3)): merge files
- Search API (DataFusion SQL · PromQL) → Object storage (Parquet files (S3)): scan
- Search API (DataFusion SQL · PromQL) → Full-text index (Tantivy): lookup
- Search API (DataFusion SQL · PromQL) → Metadata DB (sea-orm): schemas
Key architectural decisions
6 decisions- 01
Enterprise features are optional Cargo feature flags, not a separate repo
Cargo.toml declares an "enterprise" feature that pulls in an optional o2_enterprise dependency across most crates (audit, common, core, db, jobs, search_service), plus "cloud" and "vectorscan" features layered on top, so the same open-core binary can be built with or without proprietary code.
- 02
Telemetry data lands as Parquet on S3-compatible storage, not a database
The root Cargo.toml depends directly on parquet, arrow and object_store, and the README attributes the "140x lower storage cost" claim to this Parquet-on-S3 design rather than a row-oriented database, with DataFusion executing SQL queries over the resulting files.
- 03
Logs and traces query with SQL; metrics query with SQL or PromQL
Dedicated promql and promql-service workspace crates sit alongside the DataFusion-based search and search_service crates in Cargo.toml, matching the README’s claim of supporting both query languages instead of a proprietary one.
- 04
Full-text search runs on a Tantivy index layered over Parquet
tantivy and tantivy-fst are direct workspace dependencies used by the tantivy_utils crate (a workspace member in Cargo.toml) alongside the DataFusion/Parquet search path, giving log search an inverted index without a separate search cluster.
- 05
The web UI is one Vue SPA served under a fixed /web/ base path
web/package.json’s dev and build scripts pass --base /web/ to Vite, and postbuild copies the compiled assets into dist/src/assets, so the UI is designed to be served by the same Rust binary rather than a separate static host.
- 06
An MCP server ships as a first-party workspace crate
src/mcp appears as a workspace member in Cargo.toml, and the top-level openobserve binary depends on openobserve-mcp.workspace = true, making Model Context Protocol access to OpenObserve data part of the shipped binary rather than an external add-on.
How OpenObserve is built
How OpenObserve is structured
OpenObserve is a Rust Cargo workspace with over 40 crates listed under [workspace] members in the root Cargo.toml (src/api/http, src/search, src/db, src/ingester, src/wal, src/mcp, and more), all compiled into the single openobserve binary defined at the workspace root. A separate web/ directory holds an independent npm/Vite project for the Vue 3 frontend, built separately and then embedded into the same binary at release time. Feature flags declared in the root Cargo.toml (enterprise, cloud, vectorscan, mimalloc, jemalloc, profiling) toggle optional dependencies like o2_enterprise per crate, so the same source tree produces both the open-source and enterprise builds.
Frontend
web/package.json names the frontend zinc-observe-web (a holdover from the project's earlier name, Zinc Observe) and builds a Vue 3.5 application with Vue Router and Vuex, bundled by Vite 7 and type-checked with vue-tsc across tsconfig.app.json, tsconfig.composite-alerts-tests.json, and other targeted tsconfig files. Visualization relies on ECharts and echarts-gl for the 19+ chart types the README describes, monaco-editor for SQL/PromQL/VRL editing, @vue-flow/core for the visual pipeline editor, and leaflet for geo-map panels. Styling runs through Tailwind CSS 4 (@tailwindcss/vite, @tailwindcss/postcss) alongside custom lint scripts (lint:tokens, lint:token-purity, lint:design) that check design-token and CSS consistency. Tests split between Vitest for units and Cypress for end-to-end (test:e2e runs cypress run --e2e against a built preview server).
Backend & APIs
The server is built on Axum (axum, axum-extra, axum-server, axum-client-ip workspace dependencies) running on Tokio, with tonic/tonic-prost providing gRPC for inter-node communication in clustered deployments. Ingestion is OpenTelemetry-native: opentelemetry, opentelemetry-otlp, and opentelemetry-proto are direct workspace dependencies, matching the README's description of OTLP as the primary ingest path alongside dedicated src/api/ingest and src/ingestion_common crates. Query execution runs through Apache DataFusion (datafusion, datafusion-proto, datafusion-functions-json) over Arrow record batches, with separate promql and promql-service crates handling PromQL specifically for metrics, and search/search_service crates handling the SQL path shared by logs and traces.
Data & persistence
There is no conventional application database for telemetry data: logs, metrics, and traces are written as Parquet files (parquet workspace dependency) to an object_store-backed target, which the README states is S3-compatible object storage, and Cross.oss.toml/Cross.ent.toml plus docker/postgres-upgrade.sh-adjacent tooling suggest S3-first design with optional local-disk fallback for single-binary mode. Query acceleration comes from a Tantivy full-text index (tantivy, tantivy-fst dependencies, backed by the tantivy_utils workspace crate) layered on top of the Parquet/DataFusion path. A separate relational layer exists for metadata: src/db/Cargo.toml depends on sea-orm, and src/infra/Cargo.toml depends on both sea-orm and sea-orm-migration, giving OpenObserve a pluggable metadata store distinct from the Parquet-based telemetry store, though the audited manifests do not pin which relational engine backs it in a given deployment.
Realtime / collaboration
src/report_server and src/jobs workspace crates handle scheduled report generation and background jobs, and chromiumoxide (a headless-Chrome driver, listed as a direct dependency of both the root binary and src/config) is used to render dashboard screenshots for scheduled reports and alert notifications. WebSocket/streaming connections for live log tailing and dashboard updates run through the same Axum/Tokio stack rather than a separate realtime service.
Build, test & deploy
CI is unusually extensive: the .github/workflows directory holds dozens of targeted workflows, including db-testing.yml and db-schema-version-check.yml for the sea-orm metadata layer, api-testing.yml and unit-tests.yml for the Rust code, playwright.yml and playwright_bugfix_regression.yml for UI end-to-end tests, and cargo-deny.yml for dependency auditing. Several workflows (ai-code-review.yml, claude.yml, claude-auto-implement.yml, claude-pr-fix.yml, query-agent.yml) automate PR review and fixes using AI tooling, and scripts/ai-review/package.json implements a custom multi-agent review system instrumented with OpenTelemetry. deploy/build/Dockerfile builds the web UI with Node 24 first, then compiles the Rust release binary in a second stage using sccache, before copying only the final binary into a slim Debian runtime image.
Self-hosting notes
OpenObserve is designed to run as a single binary or Docker container out of the box: the README's quick-start runs docker run with a mounted /data volume and root credentials via ZO_ROOT_USER_EMAIL/ZO_ROOT_USER_PASSWORD. For clustered, high-availability deployments the repository ships deploy/k8s Kubernetes manifests, and the workspace's enterprise/cloud Cargo features gate multi-region "Super Cluster" federation described in the README as an enterprise-only capability layered on the same codebase.
What to copy (and what not to)
The Parquet-plus-object-storage design, with DataFusion providing SQL over it, is a strong pattern for any system that needs cheap, durable storage for high-volume append-only data without operating a separate database cluster. Gating proprietary features behind Cargo feature flags on optional dependencies, rather than maintaining a divergent enterprise fork, keeps a single codebase auditable end to end. Less portable to smaller projects: the sheer number of dedicated CI workflows and the 40-plus-crate workspace split reflect a large, mature team, and a small project adopting the same granularity of crates before it needs that separation would mostly add build-graph overhead.
Sources & repo audit
- Root Cargo.toml (Rust workspace: Axum, Tokio, DataFusion, Arrow, Parquet, Tantivy, feature flags)
- web/package.json (Vue 3, Vite, TypeScript, Tailwind CSS, Cypress/Vitest)
- deploy/build/Dockerfile (multi-stage web + Rust release build)
- src/config/Cargo.toml (config crate depending on datafusion, tantivy, vrl, sea-orm)
- src/db/Cargo.toml (sea-orm-backed metadata store crate)
Independent analysis of repository at github.com/openobserve/openobserve. Spotted an inaccuracy? Use the claim form to request a correction.
Show this stack on your README or website
[](https://stackitfast.com/project/openobserve)Paste it into your README. It shows your current stack and links to this page.
Scaffold it with your agent
Paste this prompt into Claude Code, Cursor, Windsurf or AGY to start a project with OpenObserve's architecture.
- 1Copy the promptThe full markdown spec, with every layer and decision.
- 2Open your AI toolClaude Code, Cursor, Windsurf or Copilot, in a new repo.
- 3Paste and scaffoldUse it as the first instruction; review before you ship.
# MISSION: Scaffold "OpenObserve" Production Architecture
You are an expert Senior Staff Software Architect and Full-Stack Engineer. Your mission is to scaffold and implement a production-grade, highly reliable, and modular codebase following the proven architecture of **OpenObserve**.
---
## 1. PROJECT SPECIFICATIONS & BENCHMARK
- **Reference Architecture**: OpenObserve
- **What It Does**: OpenObserve is an open-source, AGPL-3.0 Rust observability platform that stores logs, metrics, traces and RUM data as Parquet files on S3-compatible storage, queried with SQL and PromQL from a single binary.
- **Domain & Category**: Cloud-Native Observability Engine
- **Production Scale**: 6-20 People
- **Development Mode**: CLASSIC
- **Architectural Rationale**: Storing telemetry as Parquet on object storage instead of a traditional database, paired with DataFusion for SQL and dedicated PromQL crates, is what the project credits for its lower storage cost, while Cargo feature flags keep enterprise-only code optional inside the same open-core binary.
- **Live Website Reference**: https://openobserve.ai
- **Source Repository**: https://github.com/openobserve/openobserve
---
## 2. PRODUCTION TECH STACK
- **Full Stack Array**: Rust, TypeScript, Vue, Vite, Axum, Tokio, gRPC, OpenTelemetry, Prometheus, Docker, Kubernetes, DataFusion, Parquet, Arrow, S3
- **Primary Language(s)**: TypeScript, Rust, Vue
- **License of the reference repo**: AGPL-3.0
- **Frontend**: Vue — Vue 3 single-page app for logs, traces, metrics, dashboards, alerts and pipelines.; TypeScript — Primary language for the web UI, type-checked with vue-tsc across several tsconfig targets.; Vite — Builds and serves the UI, mounted under the /web/ base path (npm run dev runs "vite --base /web/").; Monaco Editor — Powers SQL/VRL/PromQL editing surfaces in the query builder and pipeline editor.
- **Backend & APIs**: Rust — The entire server is one Rust binary; the workspace root Cargo.toml lists 40+ internal crates under src/.; Axum — HTTP framework for the ingest, search and management APIs (axum, axum-extra, axum-server workspace deps).; Tokio — Async runtime underlying the server and all workspace crates.; gRPC — tonic/tonic-prost provide inter-node RPC for the clustered/HA deployment mode.; OpenTelemetry — Native OTLP ingestion (opentelemetry, opentelemetry-otlp, opentelemetry-proto workspace deps) as the primary ingest protocol.
- **Data & persistence**: Parquet — Logs, metrics and traces are stored as Parquet files; the parquet crate is a direct workspace dependency.; Arrow — Columnar in-memory format used across ingestion, search and compaction (arrow, arrow-flight, arrow-json workspace deps).; DataFusion — SQL query engine executed over the Parquet/Arrow data for logs and trace search.; Tantivy — Full-text search index used to accelerate log search (tantivy, tantivy-fst workspace deps).
- **Infrastructure & deploy**: Docker — deploy/build/Dockerfile is a multi-stage build: Node builds the web UI, then Rust compiles the release binary into a Debian runtime image.; Kubernetes — deploy/k8s holds Kubernetes manifests for clustered/HA deployment.; GitHub Actions — db-testing.yml, api-testing.yml, cargo-deny.yml and dozens more workflows gate every PR before merge.
- **Tooling, testing & ops**: Model Context Protocol — src/mcp is a workspace crate; the main binary depends on openobserve-mcp to serve an MCP endpoint for AI agents.
---
## 3. KEY ARCHITECTURAL DECISIONS (audited from https://github.com/openobserve/openobserve @ b85030e)
1. **Enterprise features are optional Cargo feature flags, not a separate repo**: Cargo.toml declares an "enterprise" feature that pulls in an optional o2_enterprise dependency across most crates (audit, common, core, db, jobs, search_service), plus "cloud" and "vectorscan" features layered on top, so the same open-core binary can be built with or without proprietary code.
2. **Telemetry data lands as Parquet on S3-compatible storage, not a database**: The root Cargo.toml depends directly on parquet, arrow and object_store, and the README attributes the "140x lower storage cost" claim to this Parquet-on-S3 design rather than a row-oriented database, with DataFusion executing SQL queries over the resulting files.
3. **Logs and traces query with SQL; metrics query with SQL or PromQL**: Dedicated promql and promql-service workspace crates sit alongside the DataFusion-based search and search_service crates in Cargo.toml, matching the README’s claim of supporting both query languages instead of a proprietary one.
4. **Full-text search runs on a Tantivy index layered over Parquet**: tantivy and tantivy-fst are direct workspace dependencies used by the tantivy_utils crate (a workspace member in Cargo.toml) alongside the DataFusion/Parquet search path, giving log search an inverted index without a separate search cluster.
5. **The web UI is one Vue SPA served under a fixed /web/ base path**: web/package.json’s dev and build scripts pass --base /web/ to Vite, and postbuild copies the compiled assets into dist/src/assets, so the UI is designed to be served by the same Rust binary rather than a separate static host.
6. **An MCP server ships as a first-party workspace crate**: src/mcp appears as a workspace member in Cargo.toml, and the top-level openobserve binary depends on openobserve-mcp.workspace = true, making Model Context Protocol access to OpenObserve data part of the shipped binary rather than an external add-on.
---
## 4. NON-NEGOTIABLE ARCHITECTURAL GUARDRAILS
1. **Monorepo & Modular Separation**:
- Structure as a Turborepo monorepo with strict package boundaries:
- `apps/web`: Application UI, routing, layouts, and server endpoints.
- `packages/ui`: Shared design tokens, CSS variables, and Radix UI primitive components.
- `packages/db`: Database schemas, client singleton, declarative migrations, and seed scripts.
- `packages/config`: Shared TypeScript, ESLint, and build configurations.
2. **Strict Type Safety & Zero `any` Policy**:
- Enable `strict: true`, `noImplicitAny: true`, and `strictNullChecks: true`.
- Validate ALL external inputs, API request bodies, and query parameters with **Zod** schemas before execution.
3. **Frontend & Rendering Guidelines**:
- Utilize Vite 6 with TanStack Router for fully type-safe routing. Manage server state and caching via TanStack Query v5 with optimistic UI updates.
4. **Design System & Aesthetics**:
- Keep every color, radius, shadow and font in a single token file (CSS variables) and consume tokens everywhere; never hardcode hex values in components.
- Prefer crisp 1px borders and one subtle shadow scale over blurry default shadows. Pair one sans-serif for body/headings with one monospace for tags, badges, metrics, and code.
5. **Data Layer & Reliability**:
- Write declarative schema definitions with foreign keys, composite indexes on queried filters, and automated timestamp triggers.
- Use connection pooling and prepared statements for serverless database execution.
---
## 5. STEP-BY-STEP SCAFFOLDING ROADMAP
- **Phase 1: Workspace & Root Config**: Initialize package manager, monorepo configuration (`turbo.json`, `tsconfig.base.json`, `package.json`).
- **Phase 2: Database Schema & Client**: Set up the data layer (Parquet, Arrow, DataFusion, Tantivy): client, connection pool, models, and migration scripts.
- **Phase 3: Design Tokens & UI Primitives**: Build accessible `Button`, `Input`, `Card`, `Badge`, and layout wrappers inside `packages/ui`.
- **Phase 4: Core Application Routes & Handlers**: Implement primary authentication, user session handling, and application routes.
- **Phase 5: Quality Assurance & Build Verification**: Run `tsc --noEmit`, ESLint, Prettier, and smoke test suites to ensure zero compilation or runtime errors.
---
## 6. EXECUTION INSTRUCTIONS
1. Review all specifications, architectural guardrails, and stack choices above.
2. Present the full monorepo directory tree structure.
3. Systematically generate the complete, production-ready codebase according to the 5-phase roadmap above — starting with the root workspace setup, followed by the database schema, UI design system package, and full-stack application routes until the repository is fully scaffolded and ready to run.Frequently asked about OpenObserve
What is OpenObserve built with?
A Rust backend on Axum and Tokio using DataFusion, Apache Arrow, Parquet and Tantivy for storage and search, paired with a Vue 3 and TypeScript frontend built with Vite.
What database does OpenObserve use for logs and traces?
None in the traditional sense: telemetry data is written as Parquet files to S3-compatible object storage and queried with DataFusion; a separate sea-orm-backed crate (src/db) handles relational metadata.
Can OpenObserve be self-hosted?
Yes. It ships as a single Rust binary, a Docker image built from deploy/build/Dockerfile, and Kubernetes manifests under deploy/k8s for clustered deployments.
Does OpenObserve support querying with PromQL?
Yes for metrics, via dedicated promql and promql-service workspace crates; logs and traces are queried with SQL through DataFusion.
Does OpenObserve expose an MCP server for AI agents?
Yes. src/mcp is a workspace crate and the main binary depends on openobserve-mcp directly, shipping MCP access as part of the standard build.
What does the OpenObserve architecture look like?
OpenObserve is a Rust Cargo workspace of 40+ crates (ingester, WAL, search, HTTP API, MCP) compiled into a single binary with a Vue 3 UI embedded. Telemetry is stored as Parquet files and queried with Arrow and DataFusion, with Tantivy for full-text indexing.
One email a month: new deep dives and stack trends
New source-audited architectures, head-to-head comparisons and the monthly stack report. No spam, unsubscribe anytime.
Similar architectures
- RustFSClassicS3-Compatible Object Storage · 20+ peopleShares Rust · Tokio · gRPC
- VectorClassicObservability Data Router & Telemetry Pipeline · 21-100 peopleShares Rust · Tokio · OpenTelemetry
- AtuinClassicShell History Sync · 2-5 peopleShares Rust · Axum · Tokio
- QdrantClassicVector Similarity Search Engine · 20+ PeopleShares Rust · Tokio · Docker
- UplevelerHybridDeveloper Work Log & Promotion Coach · SoloShares Rust · Axum · Tokio
- AxumClassicRust Web Framework · 1M+ MAUShares Rust · Axum · Tokio