quickwit VS openobserve

Hi folks, Quickwit cofounder here.

We started Quickwit 3 years ago with a POC, "Searching the web for under $1000/month" (see HN discussions [0]), with the goal of making a robust OSS alternative to Elasticsearch / Splunk / Datadog.

We have reached a significant milestone with our latest release (0.7) [1], as we have witnessed users of the nightly version of Quickwit deploy clusters with hundreds of nodes, ingest hundreds of terabytes of data daily, and enjoy considerable cost savings.

To give you a concrete example, one company is ingesting hundreds of terabytes of logs daily and migrating from Elasticsearch to Quickwit. They divided their compute costs by 5x and storage costs by 2x while increasing retention from 3 to 30 days. They also increased their durability, accuracy with exactly-once semantics thanks to the native Kafka support, and elasticity.

The 0.7 release also brings better integrations with the Observability ecosystem: improvements of the Elasticsearch-compatible API and better support of OpenTelemetry standards, Grafana, and Jaeger.

Of course, we still have a lot of work to be a fully-fledged observability engine, and we would love to get some feedback or suggestions.

To give you a glance at our 2024 roadmap, we planned to focus on Kibana/OpenDashboard integration, metrics support, and pipe-based query language.

[0] Searching the web for under $1000/month: https://news.ycombinator.com/item?id=27074481

[1] Release blog post: https://quickwit.io/blog/quickwit-0.7

[2] Open Source Repo: https://github.com/quickwit-oss/quickwit

[3] Home Page: https://quickwit.io

We tested S3 Express for our search engine quickwit[0] a couple of weeks ago.

While this was really satisfying on the performance side, we were a bit disappointed by the price, and I mostly agree with the article on this matter.

I can see some very specific use cases where the pricing should be OK but currently, I would say most of our users should just stay on the classic S3 and add some local SSD caching if they have a lot of requests.

[0] https://github.com/quickwit-oss/quickwit/

Hi HN, I’m one of the builders of Quickwit, a cloud-native OSS search engine for observability. As of 2023, we support logs and traces, metrics will come in 2024.

You know the pitch: while software like Datadog or Splunk are great, they often comes with hefty price tags. Our mission is to offer an affordable alternative. So we’ve built Quickwit, we’ve made it compatible with the observabilty ecosystem (OpenTelemetry, Jaeger, Grafana) and above all, we’ve made it cost-efficient / “easy” to scale (well it’s never easy to scale to petabytes..).

To give you a glance at the engine performance I made a benchmark on the GitHub Archive dataset, 23 TB of events, here are the main observations:

Indexing: costs $2 per ingested TB. With 4CPU, throughput is at 20MBs However, you'll observe > 30MB throughput on simpler datasets, like logs and traces.

Search: a typical query costs $0.0002 per TB (considering both CPU time and GET request costs). Using 8CPU, a simple query on 23TB is achieved in under a second.

Storage: on S3, it costs $8 per ingested TB per month on the GitHub Archive dataset. With logs and traces, you might see costs around $5/ingested TB due to a 2x better compression ratio.

I'm eager to get your thoughts on this!

Benchmark: https://quickwit.io/blog/benchmarking-quickwit-engine-on-an-...

Github repo: https://github.com/quickwit-oss/quickwit/

Website: https://quickwit.io/

- On S3, it costs $8 per ingested TB per month on the GitHub Archive dataset. With logs and traces, you might see costs around $4/ingested TB due to a 2x better compression ratio.

I'm eager to get your thoughts on this!

[0] Benchmark: https://quickwit.io/blog/benchmarking-quickwit-engine-on-an-...

Quickwit (https://quickwit.io/) | Paris, France | Onsite and remote (based in Europe) | Full-time

The company is fully remote but we also have a small office in Paris. We prefer candidates based in Europe but can make exceptions for the right profiles.

- Senior Software Engineer 80-110k€ + 0.25-1% equity based on experience.

    We’re looking for a senior software engineer to contribute to [Quickwit](https://github.com/quickwit-oss/quickwit), our open-source search and analytics engine. We have an ambitious roadmap for the next 18 months (performance optimization, distributed storage, support for SQL, query optimizer, revamp of our execution engine, etc.), and this is a great opportunity to shape the future of Quickwit while tackling fun and challenging problems in the field of distributed databases.

In our latest blog post, we walk you through the steps of instrumenting your Rust application and monitoring the performance on Grafana using Quickwit + Jaeger.

Link: https://github.com/quickwit-oss/quickwit

Lot of interesting OSS observability products coming out in recent years. One of the more impressive(and curious for many reasons) IMHO is OpenObserve: https://github.com/openobserve/openobserve .

As opposed to just a stack, they are implementing just about the whole backend shebang from scratch.

in case it matters to others, https://github.com/openobserve/openobserve/tree/v0.7.0 is the last Apache2 licensed copy before they went AGPL with 0.7.1

https://github.com/openobserve/openobserve/blob/v0.7.0/.env.... is some "onoz" for me, but just recently someone submitted https://github.com/aenix-io/etcd-operator to the CNCF sandbox so maybe things have gotten better around keeping that PoS alive

eCharts is awesome. We moved from plotly after using it for several months to echarts at https://github.com/openobserve/openobserve and are super happy.

Wouldn't make more sense to have the same observability stack on production and development? For instance, open-observe is also a single binary that provides UI for logs, metrics and traces, although every log producer would have to be properly configured and routing to it.

Another idea: maybe chrome dev-tools could be repurposed to display server logs instead of client logs, somehow [2].

--

1: https://github.com/openobserve/openobserve

2: https://chromedevtools.github.io/devtools-protocol/

It doesn't read from files unfortunately, but https://openobserve.ai/ is very easy to set up locally (single binary) and send otel logs/metrics/traces to.

Here's how I run it locally for my little shovel project - https://github.com/bbkane/shovel#run-the-webapp-locally-with... .

Also linked from that README is an Ansible playbook to start OpenObserve as a systems service on a Linux VM.

Alternatively, see the shovel codebase I linked above for a "stdout" TracerProvider. You could do something like that to save to a file, and then use a tool to prettify the JSON. I have a small script to format json logs at https://github.com/bbkane/dotfiles/blob/2df9af5a9bbb40f2e101...

Implement a monitoring stack, or openobserve for an all-in-one package.

I would recommend you take a look at OpenObserve (https://github.com/openobserve/openobserve ). It's free and open source and can do all you asked and more with far lower resource utilization. It's the easiest to run of any log system that you can find. Can capture windows and linux logs. Also compresses them heavily (30-60x, YMMV). 100 GB ingested logs can be 3 GB stored.

I have used https://github.com/openobserve/openobserve in several hobby projects and liked it. It's an all-in-one solution. It's likely less featureful than many others but a single binary and everything in one place pulled me in and worked for me so far.

Not affiliated, I just like the tool.

A good one. A lot is being built on top of clickhouse. I can count at least 3 if not more (hyperdx, signoz and highlight) built on top of clickhouse now.

We at OpenObserve are solving the same problem but a bit differently. A much simpler solution that anyone can run using a single binary on their own laptop or in a cluster of hundreds of nodes backed by s3. Covers logs, metrics, traces, Session replay, RUM and error tracking are being released by end of the month) - https://github.com/openobserve/openobserve