What is OpenObserve?
OpenObserve is an open-source observability platform written in Rust, released under AGPL-3.0. It ingests logs, metrics, distributed traces and RUM (Real User Monitoring) events and stores them in a compressed columnar format that is 140× more storage-efficient than Elasticsearch.
Under the hood, OpenObserve uses Apache Arrow and Parquet for columnar storage, which enables sub-second SQL and PromQL queries over large datasets without the memory overhead of a JVM-based engine. The project is backed by $10M in funding and ships new releases every one to two weeks — v0.91.1 landed on July 2, 2026.
What OpenObserve gives you
- Unified ingestion: logs (syslog, Fluent Bit, Vector, OTLP), metrics (Prometheus remote_write, OTLP), traces (OTLP/Jaeger), RUM events — all in one service.
- 140× lower storage cost than Elasticsearch: columnar Parquet format + Zstd compression.
- SQL and PromQL query interfaces — no proprietary query language to learn.
- Built-in dashboards with drag-and-drop panels, time-range pickers, variables and alerts.
- LLM/AI trace monitoring: trace OpenAI, LangChain, LiteLLM and Anthropic calls natively (latency, token count, cost, errors).
- Alerting with Slack, PagerDuty, email, webhook and Microsoft Teams notifications.
- S3-compatible object storage backend: store petabytes on MinIO, R2, or Backblaze B2.
- Sub-10 MB RAM at idle — run it on any 1 GB VPS alongside your applications.
Requirements
Any ServOrbit VPS with 1 GB RAM and a recent Ubuntu 24.04 template works for a single-server setup. Docker must be installed (the one-click installer handles this). For heavy log ingestion — millions of lines per day from several services — budget 2–4 GB RAM. No GPU, no special kernel flags, no kernel tuning required.
Deploy OpenObserve on your ServOrbit VPS
One-click deploy from the marketplace
In your ServOrbit control panel, open the Marketplace tab, search for OpenObserve, and click Deploy. The installer provisions Docker, pulls
public.ecr.aws/zinclabs/openobserve:latest, and starts the container with a named volume for persistent storage. The admin credentials are generated randomly and shown in your panel.Open the web interface
Navigate to
http://<your-vps-ip>:5080in your browser. Log in with[email protected]and the password from your control panel. You land on the OpenObserve home screen — the organization is pre-created and the default streamdefaultis ready to receive data.Send your first log
Test the ingestion endpoint from any terminal:
curl -u [email protected]:YOUR_PASSWORD \ -XPOST http://YOUR_VPS_IP:5080/api/default/default/_json \ -H 'Content-Type: application/json' \ -d '[{"level":"info","message":"hello openobserve","service":"test"}]'Switch to the Logs explorer in the UI, select the
defaultstream, and your log line appears within a second.Ship Docker logs with Fluent Bit
To collect logs from all containers on your VPS, install Fluent Bit as a container:
docker run -d --name fluent-bit \ -v /var/lib/docker/containers:/var/lib/docker/containers:ro \ -e FLB_OUTPUT_HOST=YOUR_VPS_IP \ fluent/fluent-bit:latest \ /fluent-bit/bin/fluent-bit \ -i tail -p path=/var/lib/docker/containers/*/*.log \ -p parser=docker \ -o http -p host=YOUR_VPS_IP -p port=5080 \ -p uri=/api/default/docker/_json \ -p format=json \ -p [email protected] -p http_passwd=YOUR_PASSWORDEvery container's stdout/stderr now streams into the
dockerlog stream in OpenObserve, searchable by container name, image, and log level.Collect Prometheus metrics (optional)
If you already run Prometheus (or use OpenObserve's built-in Prometheus scraper), add a
remote_writeblock to yourprometheus.yml:remote_write: - url: http://YOUR_VPS_IP:5080/api/default/prometheus/api/v1/write basic_auth: username: [email protected] password: YOUR_PASSWORDMetrics flow into OpenObserve's metrics store and become queryable with PromQL in its dashboard editor.
Create your first dashboard
In the OpenObserve UI, click Dashboards → New dashboard, add a panel, and type a SQL query such as
SELECT histogram(_timestamp, '1 minute') AS x, COUNT(*) AS y FROM default GROUP BY x. Switch to a line chart and click Save. Your log volume over time is now visualized — add more panels for error rates, slow queries, or any metric you ingest.Logging in for the first time
Sign in with the address [email protected] and the password provided (copy it in full, including the suffix). Then change the address and the password of the root account from the settings.
LLM observability with OpenObserve + LiteLLM
One of OpenObserve's standout features in 2026 is native LLM trace monitoring. If you already run LiteLLM from the ServOrbit marketplace, you can route all model call traces — including model name, latency, input/output token count, cost, and error details — directly to OpenObserve via its OTLP endpoint.
In LiteLLM's config.yaml, add:
general_settings:
otel_exporter: otlp
otel_exporter_otlp_endpoint: http://YOUR_VPS_IP:5081Every model call now creates a span in OpenObserve's Traces explorer. You can create cost-per-model dashboards, alert on high latency or token burn, and drill down to individual request traces — all without sending data to a third-party APM tool.
OpenObserve vs the alternatives
| Criteria | OpenObserve | ELK Stack | Grafana + Loki + Prometheus |
|---|---|---|---|
| Containers needed | 1 | 3–4 | 3 |
| Min RAM (idle) | ~10 MB | 2–4 GB | 512 MB |
| Storage cost | ✅ 140× lower | ❌ High | ⚠️ Medium |
| Query interface | SQL + PromQL | KQL (Kibana) | LogQL + PromQL |
| Distributed tracing | ✅ Built-in | ❌ Needs APM | ❌ Needs Tempo |
| LLM trace monitoring | ✅ Native | ❌ | ❌ |
| License | AGPL-3.0 (free) | AGPL-3.0 (free) | AGPL-3.0 (free) |
The key differentiator is resource efficiency: OpenObserve achieves parity with a full ELK or Grafana stack in a fraction of the footprint, making it the practical choice for VPS deployments where RAM is scarce.
