Open-source alternatives to Elastalert

Tautulli is a monitoring tool and administration interface for Plex Media Servers. It tracks real-time streaming activity, maintains detailed playback histories, and provides a centralized dashboard for server analytics. The project distinguishes itself through an event-driven notification system that triggers custom scripts and alerts based on server activity. It includes a template-based engine for generating periodic newsletters and utilizes webhooks to dispatch alerts to third-party services. The software covers broad capability areas including media library auditing, usage trend analysi

This project is a software development kit and cluster management tool for PHP. It serves as a full-text search SDK and vector search interface, enabling applications to perform lexical, fuzzy, and semantic searches against indexed data. The library implements a PSR 7 HTTP client to ensure cross-environment compatibility through standardized messaging interfaces. It provides a specialized interface for retrieving embeddings and performing semantic retrieval workflows using vector data. Its capability surface covers a wide range of administrative and operational tasks, including search index

RisingWave is a cloud-native streaming database and real-time analytics engine that uses standard SQL to process continuous data streams. It functions as a streaming data lakehouse, combining the capabilities of a streaming SQL database with a platform that integrates streaming ingestion with open table formats. The system is distinguished by its use of the PostgreSQL wire protocol, allowing it to integrate with existing SQL tools and drivers. It employs a decoupled compute and storage architecture, persisting streaming state and materialized views in cloud object storage to enable independen

SigNoz is a full-stack observability platform designed to collect, store, and visualize metrics, logs, and distributed traces in a unified environment. It leverages OpenTelemetry-based data collection to ingest telemetry from diverse sources using vendor-neutral protocols, ensuring interoperability across complex microservices architectures. The platform utilizes a high-performance columnar storage engine to enable rapid aggregation and filtering, providing a centralized backend for monitoring application health and performance. What distinguishes the platform is its focus on automated instru

Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments

Alertmanager is a monitoring notification gateway and routing service that deduplicates, groups, and directs alerts to the correct receivers. It functions as a central manager for Prometheus alerts, using a hierarchical routing tree and label-based matchers to dispatch notifications to external services. The system employs a peer-to-peer mesh network to coordinate multiple instances in a high availability cluster, ensuring continuous alert processing. It features a dedicated inhibition engine and grouping mechanisms to reduce notification noise by suppressing redundant alerts when related iss

OpenSearch is a distributed search and analytics engine designed for indexing, searching, and analyzing massive volumes of structured and unstructured data in real time. It functions as a comprehensive platform that integrates enterprise-grade search capabilities, a vector database for high-dimensional similarity lookups, and a unified observability suite for monitoring logs, metrics, and traces across complex distributed environments. The platform distinguishes itself through its support for agentic workflow automation, allowing users to orchestrate multi-agent tasks and integrate foundation

Boto3 is the AWS SDK for Python, providing a programmatic interface for managing and automating AWS cloud infrastructure and services. It serves as a cloud management API client and resource manager for provisioning, configuring, and scaling virtual servers, databases, and storage. The library enables the implementation of infrastructure-as-code through declarative templates and scripts, allowing for the deployment of identical resource stacks across multiple accounts and geographic regions. It also provides a framework for coordinating distributed workflows, serverless functions, and contain

Opserver is a cross-platform monitoring server and infrastructure dashboard designed for tracking system health, performance metrics, and backend service availability. It functions as an external metric aggregator and enterprise health oversight tool, centralizing data from third-party monitoring sources into a single view. The system integrates with incident response services like PagerDuty to map user identities and manage notification workflows. It also connects with external directory and identity providers to handle user authentication and permission assignments. The platform covers sev

HyperDX is an OpenTelemetry observability platform that provides centralized log management, distributed tracing, and a self-hosted monitoring stack. It functions as a unified system for collecting, indexing, and visualizing logs, metrics, and traces from cloud and container environments. The platform distinguishes itself with specialized tooling for large language model monitoring and session replay, allowing user interactions in the browser to be linked to backend telemetry. It employs schema-less JSON parsing to index structured logs dynamically and uses source maps to resolve minified sta

Delta is a lakehouse table format that brings ACID transactions and data warehouse consistency to large scale data lakes on cloud object storage. It serves as an ACID transaction manager, coordinating atomic commits and serializable isolation for concurrent reads and writes across distributed compute engines. The project provides a multi-engine interoperability layer that uses format translation to allow diverse SQL engines and processing frameworks to read and write the same tables. It functions as a data versioning system, utilizing a transaction log to enable time travel, historical snapsh

open62541 is an open-source implementation of the OPC Unified Architecture standard, providing a complete stack for industrial automation and data exchange. It functions as both an OPC UA server and client, enabling the creation of an object-oriented address space to model physical industrial assets and their relationships. The project is designed for versatility across diverse hardware, offering a C99 library that can be deployed to both cloud servers and resource-constrained embedded environments. It distinguishes itself through a pluggable network layer and interface-based security backend

Vector is a high-performance observability data pipeline designed to collect, transform, and route logs, metrics, and traces across distributed infrastructure. It functions as a modular engine that decouples data ingestion from processing and transmission, utilizing a component-based architecture to connect diverse sources to multiple destinations. The project distinguishes itself through a focus on reliability and flow control. It implements backpressure-aware data movement to prevent data loss during traffic spikes and utilizes disk-backed event buffering to ensure durability during network

📈 Collect customer event data from your apps. (Note that this project only includes the API collector, not the visualization platform)

Open source framework for processing, monitoring, and alerting on time series data

Next-generation web analytics processing with Scala, Spark, and Parquet.

SQL-based streaming analytics platform at scale

An open source event analytics platform

Snowplow is a behavioral event data pipeline and customer data infrastructure designed to capture user interactions and transform them into structured events for real-time analysis and long-term storage. It functions as a customer data platform that gathers user signals and enriches them with metadata to create a unified view of customer behavior. The system operates as an event schema validation engine to enforce strict data contracts on incoming streams, preventing data corruption. It further serves as a real-time event router and an event-driven automation platform, triggering proactive bu

Backend for managing dimensional time series data.

An convenient R tool for manipulating tables in PostgreSQL type databases and a wrapper of Apache MADlib.

Project SnappyData - memory optimized analytics database, based on Apache Spark™ and Apache Geode™. Stream, Transact, Analyze, Predict in one cluster

VictoriaMetrics is a high-performance, scalable time series database and observability platform designed for long-term storage and analysis of metric, log, and trace data. It functions as a unified backend for monitoring ecosystems, offering full compatibility with industry-standard protocols and query languages. The system is built to handle massive data volumes through a distributed architecture that supports horizontal scaling and efficient data lifecycle management. The platform distinguishes itself through a storage engine that utilizes consistent hashing for data sharding and log-struct

Pinot is a distributed, columnar analytical database designed for high-concurrency, low-latency query processing. It functions as a real-time OLAP datastore, enabling interactive, user-facing analytics by ingesting and querying massive datasets from both streaming and batch sources. The system architecture relies on a centralized controller for cluster coordination and a distributed segment-based storage model to ensure horizontal scalability. The platform distinguishes itself through a hybrid ingestion pipeline that unifies real-time event streams and historical batch data into a single quer

HertzBeat is an agentless monitoring platform designed to collect performance metrics from network devices, databases, and servers without requiring client software. It functions as an infrastructure monitoring dashboard, an alert management system, and a centralized log aggregator using the OpenTelemetry Protocol. The system utilizes a cloud-edge collection hierarchy to scale data gathering across clusters and isolated networks. It distinguishes itself with a flexible extensibility model, allowing users to define new monitoring workflows through configuration-based metric templates and custo