OpenObserve

OpenObserve is an observability platform for logs, metrics, and traces.

Key features:

• Log aggregation and search
• Metrics visualization
• Distributed tracing
• Low resource usage

shc install openobserve --stack observability

Common variables:

• admin_user - Admin username (default: admin)
• admin_password - Admin password (auto-generated)
• public_host - Public hostname
• s3_bucket - S3 bucket for storage (optional)

Configure SHC to send telemetry to OpenObserve:

collector:
  enabled: true
  endpoint: "http://openobserve:5080"
  logs:
    enabled: true
  metrics:
    enabled: true
  traces:
    enabled: true

OpenObserve receives:

• Logs: JSON format via /shc_logs/_json
• Metrics: Custom format via /ingest/metrics/_json
• Traces: OTLP format via /v1/traces

• URL: https://{public_host}
• Username: {admin_user}
• Password: (from vault) shc vault get observability/admin_password

Example log query:

SELECT * FROM shc_logs
WHERE tenant = 'production'
  AND timestamp > now() - interval '1 hour'
ORDER BY timestamp DESC
LIMIT 100

OpenObserve backup includes:

• Configuration
• User accounts
• Dashboards and alerts
• Indexed data (if using local storage)

Note: S3-backed data is not included in backups (managed externally).

Common issues:

Problem: No logs appearing Solution: Verify collector endpoint in config.yaml

Problem: High memory usage Solution: Reduce retention period or use S3 storage

• Config Files
• App Commands