Obzly
Features

What Obzly does

Every feature on this page is in the open source image. Nothing here needs a licence key.

Logs

Search a week of logs in seconds

  • Search by text and field, with a query builder or SQL and a field sidebar.
  • Live tail with cursor paging, so new arrivals don't shift the page you're reading.
  • Patterns and anomalies: new, spiking and dropping patterns against an earlier period.
  • Log context: the logs before and after any result, from the same pod or service.
  • Promoted fields: up to 12 per project become typed columns for fast filters and number ranges.
  • Wide searches read newest-first and stop once the page is full. Searching for an ID skips every segment whose bloom filter lacks it.
Search bar
level:error service_name:checkout "timeout"
Volume · errors in red · last hour
rollout · cart v4213:3014:0014:30
Patterns · against yesterday
payment provider timeout after <*> msnew · 1.2k
upstream payments returned <*>spiking · ×9
POST /api/orders <*> in <*>mssteady · 48k
Traces

Follow a request across services

  • OTLP traces over gRPC or HTTP, from any OpenTelemetry SDK.
  • Trace explorer and a service map built from real calls.
  • Jaeger-compatible query API: existing Jaeger clients work unmodified.
  • Tail sampling keeps whole traces, not random spans.
  • Zero-code traces on Kubernetes with OpenTelemetry eBPF Instrumentation (OBI).
Service map · harborline-shop
frontendcheckoutpayments-apicartorders-db120 rps2.1% err
Trace · POST /checkout · 412 ms
frontendcheckoutpayments-apiorders-dbcartslow
Metrics

Keep Grafana, drop the metrics stack

  • OTLP and Prometheus remote-write ingestion.
  • PromQL-compatible API: point an existing Grafana Prometheus datasource at Obzly.
  • Rollups at 5 minutes and 1 hour keep long ranges fast and can outlive raw samples.
  • Host and Kubernetes metrics from the generated Collector config.
PromQL, no quoting needed
sum by (k8s_pod_name) (system_cpu_time)
Rollups · long ranges read fewer points
raw5 min1 hour
Synthetics

Know an endpoint is down before your users do

  • Checks: HTTP with assertions on status, latency, headers and JSON; TLS certificates (expiry, chain, protocol, self-signed allowed per monitor); TCP; DNS; ICMP.
  • Your own locations: obzly-probe runs as a Linux service, a container or a Helm release, inside your network or out on the internet.
  • Probe groups: several instances per location share the monitors. If one stops, the others take over within a minute.
  • Test runs an unsaved monitor from every location in seconds, with a timing waterfall from DNS to transfer.
  • Folders and dependencies: while a parent is down its children show Impacted and their alerts stay quiet, so an outage pages once.
  • Alerts per monitor through the shared channels: down, degraded, or a certificate about to expire.
  • YAML import and export with a preview, for reviewing monitors in git.

Synthetics runs on a control plane. Results land in a Site project as ordinary metrics, so dashboards and PromQL work on them too.

Monitors · 3 locations
Payments/EU
api-gatewaydown · 2 of 3
quotes-apiimpacted · muted
payments-apiimpacted · muted
Storefront
shop.harborline.example99.99% · 240 ms
TLS mail.harborline.examplecert 12 d
api-gateway · availability, last 2 hours
edge-northedge-southoffice-pier
Run detail · POST /v1/quotes · 182 ms
DNS 12connect 18TLS 34TTFB 96transfer 22
Infrastructure

Every asset, its health and the reason

  • One inventory of clusters, nodes, hosts, namespaces, workloads, pods, containers and services, built every 5 minutes from data your agents already send.
  • Health with the reason: CPU, memory, disk, restarts, replicas, error logs and firing alerts.
  • Lifecycle and a change feed: new, not reporting, terminated, restarted.
  • Tree or table, with charts per asset and links straight into its logs, traces and dashboards.
  • Cloud connections add what runs no agent: load balancers, databases, buckets, functions and scaling groups from AWS accounts and Azure subscriptions. VMs and clusters join the hosts and clusters your agents report.
  • Read-only, keyless: a wizard writes the CloudFormation, Bicep or CLI. A probe group scans with its own identity, a role, or a federated token. Obzly stores identifiers only.
  • Cloud health: a full discovery every 4 hours and a health scan of what it found every 15 minutes: instance status checks, load balancer targets and Azure Resource Health.
Needs attention
cart-5d8f-q2x7rCrashLoopBackOff
node-b7 · harbor-prod-1memory 93%
shop-alb1 of 4 targets unhealthy
orders-dbdatabase · available
Tree · cluster to container
harbor-prod-1cluster · 2 nodes · 61 podsnode-b7memory 93%cart-5d8f-q2x7r12 restarts in 1 hcart-5d8f-k8m2wrunningnode-c2healthy
Cloud connections join what your agents report
VM · i-0a1b2c3dfrom AWS 111122223333host · node-b7from the Collectorhost_idone asset · node-b7cloud · metrics · logs
Dashboards & Alerts

Bring your dashboards, get paged quickly

  • Dashboards: build your own, or import a Grafana or OpenObserve dashboard's panels and layout, then add each panel's query.
  • Alert rules over metrics (PromQL), logs (counts of a search, optionally per field) or traces (count, errors, latency percentiles).
  • for durations, repeat intervals, labels and a live preview.
  • Notifications to webhooks, Slack, PagerDuty or email, through an outbox with retries and silences. About 15 seconds from rule to notification.
  • Channels and email are set up once in Obzly settings and shared by every project. On a control plane they are central, and each Site keeps a copy so alerts still go out if the control plane is down.
  • Incidents group error logs, failed spans and their shared traces.
Dashboard · imported from Grafana JSON
p95 latency · checkout182 msrequests / serrors by servicepaymentscartshoperror rate0.4%
Rule to notification · about 15 s
rulecount > 50 for 5moutboxretries · silencesSlackPagerDutyEmailWebhook
AI observability & MCP

Let your assistant read production

  • MCP server at /mcp: Claude Code, Cursor, claude.ai and Claude Desktop can search logs, run SQL over them, inspect traces and service maps, and run PromQL.
  • Read-only, with exactly the access your account has. Tokens work only on /mcp.
  • Browser sign-in for claude.ai and Claude Desktop, with connected apps listed and revocable in your profile.
  • Multi-site aware: one endpoint covers every Site you can access.
  • Claude Code usage per project: cost, tokens, cache use and sessions.
Claude, connected over MCP
Why did checkout start failing at 14:02?
search_logslog_patternslog_contextget_trace
payments-api timed out after 3 s on 41 requests from one pod, starting 30 s after the cart v42 rollout. Trace 9f2c… shows the wait in the card authorisation call.
Connect Claude Code
claude mcp add --transport http obzly \
	https://obzly.harborline.example/mcp \
	--header "Authorization: Bearer obz_pat_..."
Claude Code cost · this week
$18Mon$24Tue$31Wed$22Thu$40Fri$12Sat$9Sun
Enterprise

Identity, scale and recovery

  • SSO through any OIDC provider, with Microsoft Entra ID group mapping.
  • SCIM 2.0 from Okta or Entra ID; TOTP MFA required for admins, or for everyone with one switch.
  • Settings overview: deployments, ingest and storage per Site, what needs attention, and readiness before each upgrade.
  • Organizations, teams and plans with per-organization quotas.
  • High availability: rolling updates with readiness draining, leases so each shard has one owner, no single query node.
  • Durable ingest: losing an api pod, a worker or one broker loses no acknowledged data.
  • Disaster recovery runbooks with a measured restore drill (RPO under a minute) and a weekly integrity audit.
  • Audit log of every change and every denied request, with CSV export.
Identity, from one place
IdentityproviderOIDCSCIMcontrol planeorgs · teamsMFA · audit loggrantsSite · northSite · south
Guardrails
Restore drill, recovery pointunder 1 min
Ingest buffer full429, client retries
Runaway queryrefused at 100 GiB
Audit logCSV export