Open-source alternatives to Fluentd

Uptrace is an OpenTelemetry-based observability platform designed to collect, store, and analyze distributed traces, metrics, and logs. It functions as a centralized logging backend, a distributed tracing system, and a metrics engine to monitor application performance and system health. The platform is distinguished by AI-powered operational capabilities, allowing users to query telemetry data and manage monitoring dashboards using natural language. It specifically includes specialized monitoring for generative AI pipelines, tracking token usage and response quality for LLM interactions and r

Logstash is a JVM-based event processor and extract, transform, load system designed for log data processing pipelines. It functions as a plugin-based data ingestor that collects, transforms, and delivers logs and event data from multiple sources to various destinations. The system utilizes a modular architecture of interchangeable input, filter, and output components to handle real-time data ingestion and enterprise log aggregation. Users can extend the pipeline's functionality by developing custom plugins to support unique data sources or specific transformation logic. The platform covers

Fluent Bit is a cloud-native log shipper and unified telemetry collector designed as a resource-efficient data pipeline. It ingests logs, metrics, and traces from multiple sources, processing them in real-time before routing the data to external storage backends. The project functions as a real-time stream processor and OpenTelemetry log processor, capable of transforming and filtering data using SQL and conditional logic. It also acts as a distributed tracing agent that can sample traces to reduce data volume while preserving full request paths. The system provides reliable data delivery th

Telegraf is a modular, cross-platform telemetry pipeline designed to collect, process, and route metrics from diverse infrastructure, applications, and hardware. It functions as a server-side middleware that normalizes heterogeneous data into a unified format, enabling consistent monitoring across complex environments. By utilizing a plugin-driven architecture, the agent manages the entire lifecycle of telemetry data from initial ingestion to final transmission. The project distinguishes itself through a declarative, configuration-driven execution model that allows users to define complex dat

GreptimeDB is a distributed, open-source time-series database built for unified observability. It stores and queries metrics, logs, and traces together in a single columnar engine, supporting both SQL and PromQL for analysis. The database is designed as a Kubernetes-native operator with a decoupled compute and storage architecture, enabling horizontal scaling and multi-region deployment. What distinguishes GreptimeDB is its role as a multi-protocol ingestion gateway, accepting data through OpenTelemetry, Prometheus Remote Write, InfluxDB, Loki, Elasticsearch, Kafka, and MQTT protocols without

Logspout is a container log aggregator, forwarder, and routing engine designed to gather logs from Docker containers and route them to centralized external logging systems. It functions as a network-based utility that pipes container output to remote destinations such as syslog or TCP endpoints. The system features a dynamic routing engine that allows the creation and updating of log routing configurations and destination filters in real time via an HTTP interface without restarting the service. It utilizes an adapter-based architecture, enabling the development of custom output modules and t

Scribe is a distributed log aggregation system designed to collect and route real-time log data from numerous servers to centralized storage or analysis tools. It functions as a log data pipeline and scalable collector that gathers streaming data and writes it to local disks or remote endpoints. The system employs a log routing server model that organizes incoming streams into specific buckets based on predefined configuration mappings. It supports multi-hop log forwarding, allowing data to be routed through a chain of intermediate servers to centralize logs from diverse network segments. Re

Beats is a collection of lightweight, modular agents designed to gather, process, and forward operational telemetry from distributed infrastructure to centralized storage and analysis platforms. These agents function as a distributed data transport layer, decoupling the collection of logs, metrics, and network events from their final delivery destination. By maintaining local state and managing data flow, the system ensures reliable transmission of information across heterogeneous environments. The project distinguishes itself through a modular pipeline architecture that allows for the assemb

The OpenTelemetry Collector is a vendor-agnostic proxy and observability data pipeline that receives, processes, and exports traces, metrics, and logs. It functions as a telemetry ingestion gateway and multi-backend monitoring agent, translating various data formats into a standardized internal representation for consistent processing. The project distinguishes itself through a plugin-based component model, allowing the integration of custom receivers, processors, and exporters without modifying the core codebase. It utilizes a configurable pipeline system where telemetry flows through a sequ

Winston is a versatile logging library for Node.js designed to record system events and metadata. It functions as a multi-transport log manager that routes data to various destinations and a structured log formatter that transforms entries into JSON or plain text. The project is distinguished by its pluggable transport architecture, which decouples the logging interface from delivery mechanisms. This allows for the creation of custom transport extensions and the use of hierarchical logger instances to inherit configurations while attaching persistent metadata to downstream messages. The libr

HyperDX is an OpenTelemetry observability platform that provides centralized log management, distributed tracing, and a self-hosted monitoring stack. It functions as a unified system for collecting, indexing, and visualizing logs, metrics, and traces from cloud and container environments. The platform distinguishes itself with specialized tooling for large language model monitoring and session replay, allowing user interactions in the browser to be linked to backend telemetry. It employs schema-less JSON parsing to index structured logs dynamically and uses source maps to resolve minified sta

This project provides an observability data pipeline designed to collect, transform, and route logs, metrics, and traces from diverse sources into standardized formats for analysis. It operates as a plugin-based component architecture using modular receivers, processors, and exporters to move telemetry data through sequential processing chains. The system utilizes an interface-driven component model that allows for interchangeable connectors and community-contributed extensions. It distinguishes itself through a domain-specific language for telemetry filtering, metadata-based resource attribu

toolong is a terminal log viewer and TUI log manager designed for monitoring live log streams and navigating large log files. It functions as a log aggregator and JSONL formatter, capable of merging multiple log files into a single chronological view by automatically detecting timestamps. The application supports the visualization of structured data by pretty printing JSONL files and applying syntax highlighting to common web server log patterns. It handles large-scale data efficiently through virtual-sized scrollable views, allowing users to open compressed logs or files of any size without

lnav is a terminal-based log viewer and analyzer designed for aggregating, filtering, and analyzing multiple log files in a single chronological view. It functions as a console application that can replace the system pager, providing syntax highlighting and document navigation for system or application logs. The project distinguishes itself by mapping unstructured log data to virtual SQLite tables, enabling the use of SQL and PRQL for structured data analysis, aggregations, and relational queries. It further differentiates its capability set through native integration for retrieving and taili

mtail is a log-based metrics extractor and time-series monitoring agent. It functions as a log pattern parser that transforms unstructured log text into structured numerical monitoring data without requiring modifications to the original source code. The tool operates as a push-based telemetry pipeline, aggregating extracted metrics in memory before transmitting them to remote monitoring endpoints and time-series databases. Its capabilities cover log data telemetry, application performance monitoring, and custom log monitoring through a pipeline that moves parsed data from text logs to exter

log.io is a real-time log monitoring system designed for streaming and visualizing system logs in a web browser as they are generated. It consists of a TCP log aggregator that collects formatted messages from remote sources and a file-based log streamer that monitors local files for changes. The system provides a web-based log viewer capable of ad-hoc visualization, allowing users to route specific active log streams to different screens for targeted monitoring. This is supported by a centralized message broker that redistributes incoming logs to web clients. The platform covers centralized

Containerd is a daemon-based container runtime that manages the complete lifecycle of containers on a host system. It functions as a core orchestration backend, handling image distribution, storage, and process execution while adhering to industry-standard specifications for container execution and configuration. The project is distinguished by its modular, plugin-based architecture, which allows for the extension of storage, runtime, and networking capabilities without requiring a full daemon recompile. It utilizes a shim-based execution model to delegate low-level operations, ensuring isola

Benthos is a declarative stream processor and data integration pipeline used to route, transform, and filter information between disparate services. It functions as an at-least-once message broker and change data capture engine, using a transaction model to guarantee message delivery despite system crashes or server faults. The system is defined by an observability-first approach, featuring built-in HTTP health probes, performance metrics export, and distributed request flow tracing. It utilizes a plugin architecture that allows the core engine to be extended with custom binaries for new inpu

This project is an LLM coding agent orchestrator and AI software engineering platform designed to manage fleets of agents that autonomously solve issues, handle pull requests, and fix CI failures. It functions as an agentic CI/CD automator and parallel workflow manager, coordinating the end-to-end development lifecycle from initial ticket tracking to final code merging. The system is distinguished by its modular plugin framework and isolated worktree management, which allow multiple agents to work on separate coding tasks simultaneously without file system conflicts. It utilizes role-based mo

Graylog2-server is an open-source centralized log management system and aggregator. It functions as a log analysis platform designed to collect, index, and analyze log data from multiple sources within a centralized searchable index. The system provides capabilities for enterprise log aggregation and infrastructure monitoring. It enables the gathering of logs from various servers and applications to facilitate log data analysis and root cause troubleshooting across a network. The platform utilizes a distributed indexing pipeline and message-queue based ingestion to handle log streams. It inc

OpenTelemetry Go is a framework for generating and collecting distributed traces, metrics, and logs from Go applications. It provides a standardized telemetry instrumentation API for adding observability markers to code and a corresponding SDK for processing and emitting these signals. The project utilizes a configurable observability pipeline to sample and export telemetry data to external backends using the OTLP wire protocol. It features a pluggable export system and a separation between the public API and the SDK implementation, allowing telemetry to be routed to third-party platforms wit

Prefect is a workflow orchestration platform designed to define, schedule, and monitor complex data pipelines as Python code. It functions as a container-native engine that wraps individual tasks in isolated environments, ensuring consistent dependencies and resource allocation across diverse infrastructure. By utilizing a state-machine-based orchestration model, the system tracks execution progress through discrete transitions and persistent event logs to maintain reliable and observable task processing. The platform distinguishes itself through a decoupled worker-API architecture, which sep

Logan is a cross-platform mobile logging framework that collects, stores, and uploads client-side logs from iOS, Android, Web, and Flutter environments for centralized debugging and analysis. It provides a complete pipeline from client-side log buffering and file-based local storage through to server-side ingestion and a visual browser for inspecting parsed logs. The system uses a structured binary protocol to encode log entries with content, type, timestamp, and thread metadata, enabling consistent parsing across platforms. A log receiving server handles uploaded files, while a web-based int

Prometheus is a comprehensive monitoring and alerting platform designed to track infrastructure health and application performance. It functions as a time series database that ingests, indexes, and queries high-frequency numerical data points. By utilizing a pull-based model, the system periodically collects multi-dimensional metrics from monitored targets, storing them in an optimized block storage format that supports high-throughput ingestion and efficient historical analysis. The platform distinguishes itself through a specialized query engine that enables real-time analysis of performanc

Grafana is an observability data platform designed to aggregate metrics, logs, and traces from diverse sources into a unified environment. It functions as a centralized interface for visualizing complex telemetry data, transforming raw streams into interactive dashboards that support real-time system health tracking and performance monitoring. The platform distinguishes itself through a plugin-based modular architecture that integrates disparate databases, cloud services, and monitoring tools via a standardized data abstraction layer. This framework allows for the dynamic loading of external

StatsD is a network-based metrics daemon and aggregator that collects application performance data, such as counters and timers, for periodic delivery to backend services. It functions as system monitoring middleware, receiving telemetry via UDP to minimize performance overhead on monitored services. The system acts as a distributed metrics router, employing consistent hashing to distribute data points across clusters and ensure aggregation accuracy. It includes cluster health monitoring to track node availability and automatically recalculate routing paths when services go offline. The proj

cAdvisor is a container resource monitoring agent and performance analyzer that collects and exports CPU, memory, network, and disk usage statistics from running containers. It functions as a telemetry tool for discovering containers across various runtimes and serves as a Prometheus-compatible metrics exporter. The agent distinguishes itself by analyzing Linux control groups to provide visibility into resource consumption and limits. It utilizes kernel perf events and NUMA statistics for low-level hardware performance tracking and diagnostics, and it can identify out-of-memory kill events th