Open Source · Apache 2.0

Decentralized Observability
for the Distributed Edge

Process telemetry where it originates. Store logs locally, extract metrics at the edge, and stream only the anomalies.

Eliminate 90% of data ingress costs without sacrificing visibility.

<50MB memory footprint
Partition-tolerant by design
No vendor lock-in

Get running in under 5 minutes

terminal

# Clone and start with Docker Compose

$ git clone https://github.com/sadhiappan/logfleet.git

$ cd logfleet && docker compose up -d

# Loki UI: localhost:3100 | Vector metrics: localhost:9598

# Logs stored locally, metrics extracted at edge

The "Centralize Everything" Model Is Broken

For years, the industry has preached a single mantra: ship all logs to the cloud. But for distributed systems, this model creates more problems than it solves.

The Bandwidth Tax

Streaming gigabytes of raw logs from every location is financially unsustainable. Most of that data is noise that never gets queried.

The Latency Blackhole

When the network goes down, your central observability platform becomes useless precisely when you need it most.

Single Point of Failure

Centralized architectures create centralized vulnerabilities. One cloud outage and visibility across your entire fleet goes dark.

LogFleet inverts the model.

Process at the edge. Store locally. Ship only what matters. Your logs stay where they're generated—ready for instant access when you need them.

Built for the edge

Everything you need to observe distributed locations without breaking the bank on bandwidth.

Local-first storage

Store 7-30 days of logs at each location. Ring buffer automatically rotates old data.

Metrics extraction

Convert logs to metrics at the edge. Ship summaries, not raw data. 100x bandwidth savings.

Offline capable

Full functionality during internet outages. Buffer and forward when connection returns.

On-demand streaming

Cloud users can stream full logs with one click. Open source users access logs via SSH or API.

Zero-trust access

Tailscale mesh VPN for secure remote access. Query any location without exposed ports.

Multi-protocol

Collect via syslog, HTTP, files, or Kubernetes. Built on Vector for 10x performance.

How it works

A simple, proven architecture for edge-first observability.

Step 1

Collect & Store Locally

Vector collects logs from all sources. Loki stores them locally with 7-30 day retention.

Step 2

Extract Metrics at Edge

Transform logs into metrics before shipping. Send summaries, not raw data.

Step 3

Ship Only What Matters

Metrics go to your existing dashboards. Full logs stream on-demand when needed.

90%
Less data egress
100%
Partition tolerant
<50MB
Memory footprint

100% Open Source

Everything you need is free. Self-host or use our managed cloud.

Enterprise add-ons available for AI analytics and security compliance.

Everything Included

Open Source

Free

Forever. No limits.

  • Unlimited nodes
  • Full log streaming
  • Metrics extraction & UI
  • Fleet management dashboard
  • Alerting (Slack, webhooks)
  • Full Vector YAML control
  • Self-host or managed cloud
  • Apache 2.0 license
View on GitHub

Enterprise

Custom

AI & security add-ons

  • AI-powered analytics
  • Anomaly detection
  • SSO & RBAC
  • Audit logging
  • Custom retention policies
  • Dedicated support & SLA
Contact Us

Everything you need is open source—log streaming, metrics, fleet management, alerting.
Enterprise adds AI-powered insights and security compliance for regulated industries.

Frequently Asked Questions

Everything you need to know about LogFleet. Can't find what you're looking for? Reach out to our team.

Key Differentiators

OpenTelemetry is a fantastic collection standard, and we use it! But OTEL was designed for cloud-native environments with reliable connectivity.

LogFleet adds the missing edge layer:

  • Local storage: Logs stay on-site for 7-30 days, queryable even during outages
  • Bandwidth optimization: Extract metrics at the edge, ship summaries instead of raw logs
  • Partition tolerance: Full functionality when the network goes down

Think of LogFleet as the "edge-first" complement to your OTEL pipeline, not a replacement.

This is exactly what LogFleet was built for. During network outages:

  1. 1Local storage continues: Loki stores all logs locally with configurable retention (7-30 days)
  2. 2Metrics buffer: Extracted metrics queue locally and forward when connection returns
  3. 3Full query capability: SSH or local API access lets you query logs from any edge device
  4. 4Automatic recovery: No manual intervention needed. Data syncs automatically when connectivity restores

Your edge locations become autonomous observability nodes, not just dumb collectors.

No vendor lock-in, by design:

  • Apache 2.0 license: Self-host forever with full functionality
  • Standard formats: Vector + Loki = industry-standard tools you can swap anytime
  • Multi-cloud ready: Ship metrics to Datadog, Grafana Cloud, New Relic, or your own Prometheus
  • Export anytime: Your logs are stored in standard formats, easily migrated

The cloud tier adds convenience (one-click streaming, fleet UI), but the core agent is identical and fully open source.

Technical Details

LogFleet is designed for minimal footprint:

  • Memory: <50MB typical, <100MB under heavy load
  • CPU: Single core sufficient for most deployments
  • Storage: Depends on retention, roughly 10GB per week of logs at moderate volume
  • Recommended: Any modern x86/ARM device. Runs on Raspberry Pi 4, industrial PCs, or full servers.

For high-volume sites (>100,000 events/sec), we recommend 2+ cores and SSD storage.

Built on Vector, LogFleet supports virtually any log source:

Protocol-based:

  • Syslog (RFC 3164 & 5424)
  • HTTP/HTTPS endpoints
  • TCP/UDP raw streams
  • MQTT (IoT devices)

File-based:

  • Log files (with rotation support)
  • Docker container logs
  • Kubernetes pod logs
  • Journald

Application-specific:

  • Apache/Nginx access logs
  • Application JSON logs
  • Custom formats via VRL transforms

Missing a source? Vector has 50+ built-in sources, or write custom VRL transforms.

Security is layered throughout:

Edge Security:

  • No exposed ports required. Agent initiates outbound connections only
  • mTLS for all cloud communication
  • Local API secured via token authentication

Cloud Security:

  • Zero-trust access via Tailscale mesh VPN (optional)
  • JWT-based authentication with refresh tokens
  • Organization-level isolation with RBAC
  • SOC 2 Type II compliance (Enterprise tier)

Data Security:

  • Logs never leave your edge unless you explicitly stream them
  • Encryption at rest and in transit
  • Sensitive field masking via VRL transforms

Pricing & Plans

Open Source (Self-hosted):

  • Unlimited nodes, unlimited logs, unlimited retention
  • Full Vector YAML control
  • No cloud features (UI, alerting, fleet management)

Cloud Free:

  • Up to 3 nodes
  • 7-day retention in cloud metrics
  • Basic alerting (email only)
  • Community support

No credit card required. Upgrade when you need more nodes or features.

Simple, predictable pricing based on active nodes:

  • $19/node/month for Cloud Pro
  • Volume discounts at 50+ nodes (Enterprise)
  • A "node" is any device running the LogFleet agent

What's included per node:

  • Unlimited local log storage (you control retention)
  • Unlimited metrics extraction
  • One-click log streaming
  • Fleet management dashboard
  • Standard alerting

No per-GB egress fees. No query-based pricing. No surprises.

Integrations

Absolutely. LogFleet is designed as a complement, not a replacement:

Metrics export to:

  • Prometheus / Grafana Cloud
  • Datadog
  • New Relic
  • Any OpenMetrics-compatible endpoint

Alerting integrations:

  • Slack, PagerDuty, Opsgenie
  • Custom webhooks
  • Email

Log forwarding (when needed):

  • Elasticsearch / OpenSearch
  • Splunk
  • S3 / GCS for archival

Your existing dashboards keep working. LogFleet feeds them edge-extracted metrics instead of requiring full log ingestion.

Absolutely. LogFleet supports both edge K8s clusters and traditional deployments:

For edge K8s (K3s, MicroK8s):

  • DaemonSet deployment for pod log collection
  • Helm chart available
  • Auto-discovers pods and namespaces
  • Works with standard K8s logging patterns

For non-K8s edge:

  • Docker Compose for containerized deployment
  • Native binary for bare metal
  • Ansible playbook for fleet rollout

The same agent works in both environments, just with different deployment methods.

Start building today

Self-host with full power, or try the managed cloud experience.

Prefer managed hosting? Get notified when LogFleet Cloud launches.