# Architecture (/architecture) This document outlines the overall architecture of the Parseable Observability Platform, detailing the flow of MELT data from ingestion to storage and querying. This document is organized into specific sections for each sub-system like ingestion, query, search, and index. To understand the specific decisions and trade-offs, refer the [design choices document](/design-choices). Parseable Architecture ## Overview Parseable is shipped as a single unified binary (or container image if you prefer). This includes the Prism and Parseable DB. There is no additional dependency to run Parseable. The binary can be run in different modes. You’d generally run standalone mode to test and experience Parseable on your laptop, or a small testing server. As you move to a production setup, we recommend running the distributed mode. Here each node has a specific role, i.e. ingestion, query or search. ## Ingestion Parseable ingestion nodes follow a shared-nothing architecture, meaning each node independently handles the entire ingestion pipeline. In production, you typically place a load balancer in front of two or more ingestion nodes, allowing ingestion requests to be distributed across nodes seamlessly. When a node receives an ingestion request (via HTTP or Kafka), it first validates the request, then converts the payload into an Apache Arrow-based file format. During this process, it also performs auto schema detection, enabling Parseable to intelligently classify logs and generate structured schemas on the fly. This makes it easy for users to filter, search, and analyze across diverse log types with minimal upfront configuration. The Arrow files are temporarily staged in a dedicated local disk area. Once the disk write completes, the ingestion node acknowledges the request with a success response. To ensure data durability during staging, we recommend attaching a small, reliable disk (such as NFS, Azure Files, or EFS) to each ingestion node. A background job then reads the staged Arrow files, converts them into highly compressed Parquet files, and uploads them to S3 or any configured object store. During this transformation, the ingestion node also generates query metadata, which significantly enhances performance during log searches and queries. Parseable Ingestion Architecture ## Query Distributed Query nodes are Enterprise only features available in cloud and enterprise versions and cannot be deployed with OSS versions. Query node is primarily responsible responding to query API. The query workflow starts when someone calls the query API with (a PostgreSQL compatible) SQL query, and a start and end timestamp. The query node looks up the metadata locally first, falling back to object store only if not found. Based on metadata, the node identifies the relevant parquet files and uses the object store API to get these files. Here again, this only happens if the files are not already present locally. If the files are to be downloaded from object storage - this adds to latency and hence the occasional cold queries. Another node called Prism node responds to all the role, user management, dataset management API. In Parseable OSS, a query node also serves as the leader node. Parseable Query Architecture ## Design choices ### Low latency writes Ingested data is staged on local disk upon successful return by Parseable API. Data is then asynchronously committed to object store like S3. This ensures low latency, high throughput ingestion. To ensure data durability, we recommend using a small, reliable storage (EFS, Azure Files, NFS or equivalent) attached to the ingesting nodes. This ensures that data is not lost in case of a node failure. ### Atomic ingestion Each ingestion batch received via API is concurrently appended to the same file within a one-minute window. When converted from Arrow to Parquet, entries are reordered to ensure the latest data appears first. ### Efficient storage Parseable stores heavily compressed Parquet format to one of the most cost efficient storage, i.e. object storage. This leads to significant cost savings, especially for large datasets. ### Smart caching Frequently accessed logs are cached in memory and NVMe SSDs on query nodes for faster access. The system prioritizes recent data, manages cache eviction automatically, and minimizes object store API calls using Parseable manifest files and Parquet footers. ### Index on demand By default data is stored in columnar Parquet files, allowing fast aggregations, filtering numerical columns and SQL queries. Parseable allows indexing specific chunks of data, on demand - to allow text search on log data as and when needed. ### Stateless high availability High availability (HA) is ensured through a distributed mode in which multiple ingestion and query servers operate independently. ### Object storage first There is no separate consensus layer, eliminating complex coordination and reducing operational overhead. Object storage manages all concurrency control. See [AWS S3 configuration](/storage/awss3) for detailed setup instructions. ### SQL for querying We chose SQL as the query language for Parseable because it is widely used and understood, making it easier for users to interact with the system. SQL allows users to filter, aggregate, and join data from multiple sources. SQL is also very well supported by modern LLMs to generate queries from plain text. ## Trade-offs ### Staged writes Staging data locally on the ingestor node for at least a minute, leads to a minor lag in querying the data. We trades immediate persistence for low latency ingestion. ### Occasional Cold Queries The query layer fetches indexes from object storage (e.g., S3) and uses intelligent caching to accelerate future access. During the initial cache warm-up, some queries may access data directly from cold storage, resulting in higher latencies. ### Timed queries A query call requires start and end timestamp. This ensures data is queried across a fixed, definite set of files. Parseable ensures query response includes the staging and committed data on object storage as required. # Benchmarks (/benchmarks) Performance is a core requirement for observability platforms. As telemetry data volumes grow exponentially, it is critical for observability solutions to deliver high performance, at crucial times when teams need to troubleshoot and resolve issues quickly. Parseable's telemetry data lake architecture is designed from the ground up for high performance ingestion and querying of telemetry data at scale. We use modern storage formats, efficient indexing techniques, and optimized query execution strategies to deliver fast performance, additionally local NVMe and memory caching further accelerates query response times. ## ClickBench [ClickBench](https://benchmark.clickhouse.com/) is an industry-standard benchmark for analytical databases. While originally designed for clickstream data, it has been widely adopted to evaluate performance of databases for various analytical workloads, including observability data. Parseable is a top performer on the ClickBench. [View Parseable on ClickBench](http://logg.ing/clickbench) Parseable Benchmark Read more about our performance philosophy in our post: [Performance is Table Stakes](https://www.parseable.com/blog/performance-is-table-stakes). ## Real world performance Understanding Parseable's performance with a real-world scenario of ingesting and querying 100 TB of telemetry data per day. Test Results at a Glance | Metric | Result | | --------------------- | ------------------------------------ | | **Ingestion Rate** | **2 TB/hour** (sustained) | | **Query Latency** | **Millisecond-range** (even at load) | | **Monthly Cost** | **\~$11,810** (for a 4-node cluster) | | **Compression Ratio** | **Up to 90%** | For more details, see our blog post: [The Economics and Physics of 100 TB Telemetry Data Per Day](https://www.parseable.com/blog/the-economics-and-physics-of-100-tb-telemetry-data-per-day). # Design Choices (/design-choices) This document outlines our key design choices, ensuring durability, scalability, and efficiency for modern observability workloads. This page also covers the technical trade offs in Parseable. If you have a specific use case or need a feature tailored to your observability needs, let us know at [sales@parseable.com](mailto:sales@parseable.com). We ship fast and most of such requests can be done in a matter of days. ### Highlights #### Low latency writes Ingested data is staged on local disk upon successful return by Parseable API. Data is then asynchronously committed to object store like S3. This ensures low latency, high throughput ingestion. To ensure data durability, we recommend using a small, reliable storage (EFS, Azure Files, NFS or equivalent) attached to the ingesting nodes. This ensures that data is not lost in case of a node failure. #### Atomic ingestion Each ingestion batch received via API is concurrently appended to the same file within a one-minute window. When converted from Arrow to Parquet, entries are reordered to ensure the latest data appears first. #### Efficient storage Parseable stores heavily compressed Parquet format to one of the most cost efficient storage, i.e. object storage. This leads to significant cost savings, especially for large datasets. #### Smart caching Frequently accessed logs are cached in memory and NVMe SSDs on query nodes for faster access. The system prioritizes recent data, manages cache eviction automatically, and minimizes object store API calls using Parseable manifest files and Parquet footers. #### Index on demand By default data is stored in columnar Parquet files, allowing fast aggregations, filtering numerical columns and SQL queries. Parseable allows indexing specific chunks of data, on demand - to allow text search on log data as and when needed. #### Stateless high availability High availability (HA) is ensured through a distributed mode in which multiple ingestion and query servers operate independently. #### Object storage first There is no separate consensus layer, eliminating complex coordination and reducing operational overhead. Object storage manages all concurrency control. #### SQL for querying We chose SQL as the query language for Parseable because it is widely used and understood, making it easier for users to interact with the system. SQL allows users to filter, aggregate, and join data from multiple sources. SQL is also very well supported by modern LLMs to generate queries from plain text. ### Trade-offs #### Staged writes Staging data locally on the ingestor node for at least a minute, leads to a minor lag in querying the data. We enable immediate persistence for low latency ingestion. #### Occasional Cold Queries The query layer fetches indexes from object storage (e.g., S3) and uses intelligent caching to accelerate future access. During the initial cache warm-up, some queries may access data directly from cold storage, resulting in higher latencies. #### Timed queries A query call requires start and end timestamp. This ensures data is queried across a fixed, definite set of files. Parseable ensures query response includes the staging and committed data on object storage as required. # Features (/features) import { IconSparkles, IconBellRinging, IconDashboard, IconSql, IconGauge, IconLock, IconBrain, IconUserCircle, IconDatabase, IconRefresh, IconActivityHeartbeat } from '@tabler/icons-react'; Explore the main capabilities available in Parseable, from AI-native investigation and APM to dashboards, alerting, PromQL, access control, APIs, and automated Kubernetes instrumentation. Use this page as a feature map for moving from telemetry collection to investigation, operations, and production management. } title="Agent Observability"> Debug AI agent runs with traces, prompts, tool calls, costs, and runtime behavior in one view. } title="PromQL"> Native PromQL support with Grafana Prometheus data source for seamless visualization. } title="APM"> Analyze service health, latency, errors, and traces from one application performance workflow. } title="Alerting"> Set up real-time alerts to notify you of important events or anomalies in your telemetry data. } title="Dashboards"> Create customizable dashboards to visualize your telemetry data and gain insights at a glance. } title="OpenID Integration"> Seamlessly integrate with OpenID providers for secure authentication and single sign-on capabilities. } title="AI Native"> AI-powered observability with Keystone Q\&A, dataset summarization, and natural language to SQL conversion. } title="SQL Editor"> Write and execute SQL queries to analyze your telemetry data with a powerful query editor. } title="Role-Based Access Control"> Secure your data with fine-grained access controls and user permissions management. } title="Log IQ"> Transform unstructured logs into structured JSON data for easier querying, searching, and visualization. } title="Retention Policies"> Manage your data lifecycle with customizable retention policies to optimize storage costs and compliance. } title="Smart Cache"> Optimize query performance with intelligent caching mechanisms for frequently accessed data. } title="Multi-tenancy"> Run tenant-aware deployments with isolated request handling, storage layout, and access control. } title="PAI"> Parseable Auto Instrumentation, or PAI, is a Kubernetes operator that automatically collects logs, metrics, traces, and events from a cluster and exports them to Parseable, with zero manual configuration required. # Quickstart (/get-started) ## Choose how to run Parseable ### Executable Binary \[toc] ### Parseable Cloud \[toc] ### Docker Image \[toc] ### Self Host \[toc] Run Parseable directly from the single binary. Create a managed workspace. Start Parseable in a local container. Run Parseable for production workloads. Follow one of these guides to start an instance. For a local binary or Docker instance, continue below to send your first event. For Cloud, use the ingestion endpoint and credentials shown in your workspace instead of the local values. ```bash curl -fsSL https://logg.ing/install | bash ``` For Windows users ```bash powershell -NoProfile -Command "irm https://logg.ing/install-windows | Out-String | iex" ``` The local instance listens on port `8000`. Send one JSON event to the `demo` dataset: ```bash curl --location 'http://localhost:8000/api/v1/ingest' \ --header 'X-P-Stream: demo' \ --header 'Authorization: Basic YWRtaW46YWRtaW4=' \ --header 'Content-Type: application/json' \ --data '[{"message":"hello from Parseable"}]' ``` The `X-P-Stream` header selects the dataset. The authorization header uses the local default `admin:admin` credentials. ## Verify it worked Open [the local console](http://localhost:8000), sign in with `admin` / `admin`, and select `demo` in the log explorer. You should see the event with `message` set to `hello from Parseable`. If it does not appear, confirm that Parseable is still running, then check the URL, credentials, and `X-P-Stream` header in the command above. For a production deployment, use the [self-hosted installation guide](/self-hosted/installation). ## Next steps Send data from [OpenTelemetry](/ingest-data/otel), [a logging agent](/ingest-data/logging-agents), or [your application](/ingest-data/programming-languages). Then [query logs](/user-guide/sql-editor), [build a dashboard](/user-guide/dashboards), or [set an alert](/user-guide/alerting). # Home (/) Parseable is an open source, column-oriented data lake built for observability. It brings logs, metrics, traces, and agent telemetry into one system, with SQL and PromQL queries, dashboards, alerting, APM, and AI workflows on top. Telemetry does not all behave the same way. Logs can be wide and change shape from event to event; metrics can have millions of label combinations; and traces need both individual span lookup and service-level analysis. Parseable stores these signals on a shared, open data lake foundation while letting each be ingested and queried in the way it needs. ## How Parseable works Parseable treats growing telemetry as a data engineering problem. Data moves through three stages: 1. **Ingest:** The data lake engine accepts events at high volume, stages them locally, and forwards them in batches. Staging helps absorb ingestion spikes while producing efficiently sized objects for storage. 2. **Store:** Events are compressed into columnar Apache Parquet files on object storage. Queries can read only the columns they need, and other Parquet-compatible tools can use the same data. 3. **Query:** A separate query engine runs SQL and PromQL. It caches frequently accessed data on local disk, so hot queries do not need to fetch every file from object storage. Ingestion and query capacity can scale independently. Telemetry flows from ingestion through object storage to the Parseable query engine Parseable is written in Rust for predictable performance without garbage collection pauses. Apache Arrow provides an in-memory columnar format for vectorized execution; Parquet is the open format at rest. This design supports wide events, high-cardinality metrics, and growing volumes without keeping every byte on always-hot storage. Read the [architecture](/architecture) and [key concepts](/key-concepts) for the deeper model. You can use the self-hosted core as a single binary, run a managed [Cloud workspace](/quickstart/cloud), or choose [Enterprise](/editions/compare) for advanced deployments. See the [edition comparison](/editions/compare) for details. ```bash powershell -NoProfile -Command "irm https://logg.ing/install-windows | Out-String | iex" ``` The [ingestion overview](/ingestion) explains the available protocols. Start with the source you already have: Send telemetry through the OpenTelemetry Collector. Forward logs from lightweight agents and edge workloads. Route, transform, and send logs with Vector. Collect logs from Docker containers. Send logs and telemetry from Kubernetes clusters. Ingest Prometheus metrics with remote write. Send telemetry directly from application code. Observe agents, LLM gateways, runtimes, and coding assistants. ## Work with each signal * **Logs:** Work with events that range from unstructured text to JSON with changing fields. Parseable can read selected columns from wide or sparse events, while [LogIQ](/user-guide/log-iq) can extract fields from verbose log strings. [Send OTLP logs](/ingest-data/otel/logs), then use the [log explorer](/user-guide/logs) or [SQL editor](/user-guide/sql-editor). * **Metrics:** Store numeric time series identified by labels. Parseable stores label values as column data for high-cardinality metrics and provides native PromQL. Send metrics with [OpenTelemetry](/ingest-data/otel/metrics) or [Prometheus remote write](/ingest-data/prometheus), then [explore metrics](/user-guide/metrics) or [query with PromQL](/user-guide/promql). * **Traces:** Connect spans by trace ID for specific trace lookup and service-level analysis, including latency and error rates. Parseable supports both patterns on the same columnar data. [Send OTLP traces](/ingest-data/otel/traces), then use [traces](/user-guide/traces) or [APM](/user-guide/apm). * **Agent telemetry:** Bring activity from AI agents and LLM infrastructure into the same observability foundation. Follow the [AI infrastructure guides](/ingest-data/ai-agents) and [agent observability](/user-guide/agent-observability) to inspect it. ## Keep working * **Investigate and share:** [Build dashboards](/user-guide/dashboards), [set alerts](/user-guide/alerting), or [connect an integration](/integrations). * **Deploy and manage:** Follow the [self-hosted installation guide](/self-hosted/installation), then review [configuration](/self-hosted/configuration) and [access control](/user-guide/rbac). * **Use developer tools:** Find endpoints in the [API reference](/api), or use the [MCP server](/mcp) to investigate telemetry with an AI client. * **Find a cause:** If data is missing, check the [ingestion overview](/ingestion), your source guide above, and [API key setup](/user-guide/api-keys). ## Read with an AI agent Use [the full documentation as text](/llms-full.txt), or **Copy Markdown** on any page. Individual pages also have `.mdx` text endpoints, such as [/docs/pb-cli/install.mdx](/pb-cli/install.mdx). For terminal workflows, see [pb CLI for agents](/pb-cli/agents). # Ingestion Reference (/ingestion-reference) ## Ingestion HTTP headers You can use HTTP headers to control how data is ingested and processed. Field name starting with `@` is replaced with `_`. In case of key collision, the event is rejected. When an incoming event has a field with a data type different from the existing schema, the field is automatically renamed with a type suffix (e.g., `body_timestamp_utf8`, `span_kind_int64`). This prevents ingestion failures where field types may vary between events. ### Required headers | Header | Description | Example | Possible Values | | --------------- | ------------------------------------------------------------- | ------------------ | --------------------------------------------------------------------------------------- | | `X-P-Stream` | Target dataset name. Creates the dataset if it doesn't exist. | `nginx-logs` | Valid dataset name | | `X-API-Key` | API key used to authorize the request | `px_api_key` | Valid Parseable API key | | `X-P-Tenant-ID` | Target tenant ID. | `tenant-123` | Valid tenant ID - only applicable for multi-tenant setups (for example Parseable Cloud) | | `Content-Type` | Content type of the request body | `application/json` | `application/json`,`application/protobuf` | ### Optional headers | Header | Description | Example | | ----------------- | -------------------------------------------------------------------- | --------------------------------- | | `X-P-Tag-{field}` | Add custom tags/metadata to events. Replace `{field}` with tag name. | `X-P-Tag-environment: production` | ## Reference Choose a protocol below, or browse [Integrations](/integrations) for source-specific guides to databases, containers, cloud providers, streaming platforms, CI/CD tools, and security sources. * **HTTP ingestion:** [JSON ingestion API](/api/v1/ingestLogsWithHeaders). * **OpenTelemetry:** [Logs](/ingest-data/otel/logs), [metrics](/ingest-data/otel/metrics), [traces](/ingest-data/otel/traces), and [OpenTelemetry Collector](/ingest-data/logging-agents/otel-collector). * **Prometheus:** [Remote write](/ingest-data/prometheus). * **Agents and instrumentation:** [Telemetry agents](/ingest-data/logging-agents), [Parseable Auto Instrumentation](/ingest-data/auto-instrumentation), and [eBPF](/ingest-data/zero-instrumentation). * **Application sources:** [Programming languages](/ingest-data/programming-languages) and [AI infrastructure](/ingest-data/ai-agents). In case of otel-metrics, there may be key collision in the attributes key, as the attributes are present in different hierarchical levels in the otel metrics event. In such scenarios, the key values are overridden by the last available attribute. ## Log processing When agents like Fluent Bit or Vector send logs to Parseable, they typically send the entire log line in a single field (usually named `log` or `message`). With log extraction enabled, Parseable can automatically parse this raw log line and extract structured fields using regex patterns. **The flow:** 1. Agent sends JSON log data with the raw log line in a field (e.g., `{"log": "192.168.1.1 - - [10/Jan/2026:12:00:00] ..."}`) 2. Agent sets `X-P-Extract-Log` header to the field name containing the raw log (e.g., `log`) 3. Agent sets `X-P-Log-Source` header to the log format name (e.g., `nginx_access`) 4. Parseable reads the value from the specified field, applies the matching regex pattern, and adds all extracted fields to the event ### Headers for log extraction | Header | Description | Example | Possible Values | | ----------------- | -------------------------------------------------------------------- | ---------------------------- | ----------------------------------------------------------------- | | `X-P-Log-Source` | Log format name - Parseable applies regex patterns to extract fields | `nginx_access`, `syslog_log` | See [Supported log source formats](#supported-log-source-formats) | | `X-P-Extract-Log` | Field name in the JSON payload that contains the raw log line | `log`, `message` | Any valid field name | ### Supported log source formats | # | Format Name | | -- | ----------------------- | | 1 | `access_log` | | 2 | `alb_log` | | 3 | `block_log` | | 4 | `candlepin_log` | | 5 | `choose_repo_log` | | 6 | `cloudvm_ram_log` | | 7 | `cups_log` | | 8 | `dpkg_log` | | 9 | `elb_log` | | 10 | `engine_log` | | 11 | `env_logger_log` | | 12 | `error_log` | | 13 | `esx_syslog_log` | | 14 | `haproxy_log` | | 15 | `java` | | 16 | `katello_log` | | 17 | `klog` | | 18 | `kubernetes_log` | | 19 | `lnav_debug_log` | | 20 | `nextflow_log` | | 21 | `nginx_access` | | 22 | `openam_log` | | 23 | `openamdb_log` | | 24 | `openstack_log` | | 25 | `page_log` | | 26 | `parseable_server_logs` | | 27 | `postgres` | | 28 | `postgresql_log` | | 29 | `procstate_log` | | 30 | `proxifier_log` | | 31 | `rails_log` | | 32 | `redis_log` | | 33 | `s3_log` | | 34 | `simple_rs_log` | | 35 | `snaplogic_log` | | 36 | `sssd_log` | | 37 | `strace_log` | | 38 | `sudo_log` | | 39 | `syslog_log` | | 40 | `tcf_log` | | 41 | `tcsh_history` | | 42 | `uwsgi_log` | | 43 | `vmk_log` | | 44 | `vmw_log` | | 45 | `vmw_py_log` | | 46 | `vmw_vc_svc_log` | | 47 | `vpostgres_log` | | 48 | `web_robot_log` | | 49 | `xmlrpc_log` | | 50 | `zookeeper` | | 51 | `zookeeper_log` | ## Flattening Nested JSON objects are automatically flattened. For example, the following JSON object ```json { "foo": { "bar": "baz" } } ``` will be flattened to ```json { "foo_bar": "baz" } ``` before it gets stored. While querying, this field should be referred to as foo\_bar. For example, select `foo_bar` from ``. The flattened field will be available in the schema as well. ## Batching and Compression Wherever applicable, we recommend enabling the log agent's compression and batching features to reduce network traffic and improve ingestion performance. The maximum payload size in Parseable is 10 MiB (10485760 Bytes). The payload can contain single log event as a JSON object or multiple log events in a JSON array. There is no limit to the number of batched events in a single call. ## Timestamp Correct time is critical to understand the proper sequence of events. Timestamps are important for debugging, analytics, and deriving transactions. We recommend that you include a timestamp in your log events formatted in RFC3339 format. Parseable uses the event-received timestamp and adds it to the log event in the field `p_timestamp`. This ensures there is a time reference in the log event, even if the original event doesn't have a timestamp. ## Staging Staging in Parseable refers to the process of storing log data on locally attached storage before it is pushed to a long term and persistent store like S3 or something similar. Staging acts as a buffer for incoming events and allows a stable approach to pushing events to the persistent store. Once an HTTP call is received on the Parseable server, events are parsed and converted to Arrow format in memory. This Arrow data is then written to the staging directory (defaults to `$PWD/staging`). Every minute, the server converts the Arrow data to Parquet format and pushes it to the persistent store. We chose a minute as the default interval, so there is a clear boundary between events, and the prefix structure on S3 is predictable. The query flow in Parseable allows transparent access to the data in the staging directory. This means that the data in the staging directory is queryable in real-time. As a user, you won't see any difference in the data fetched from the staging directory or the persistent store. The staging directory can be configured using the `P_STAGING_DIR` environment variable, as explained in the environment vars section. ## Planning for Production When planning for the production deployment of Parseable, the two most important considerations from a staging perspective are: Storage size: Ensure that the staging area has sufficient capacity to handle the anticipated log volume. This prevents data loss due to disk space exhaustion. To calculate the storage size, consider the average log event size, the expected log volume for 5-10 minutes. This is done as under high loads, the conversion to Parquet and subsequent push to S3 may lag behind. Local storage redundancy: Data in staging has not been committed to persistent store, it is important to have the staging itself reliable and redundant. This way, the staging data is protected from data loss due to simple disk failures. If using AWS, choose from services like EBS (Elastic Block Store) or EFS (Elastic File System), and mount these volumes on the Parseable server. Similarly, on Azure chose from Managed Disks or Azure Files. If you're using a private cloud, a reliable mounted volume from a NAS or SAN can be used. # Ingestion (/ingestion) import { IconActivityHeartbeat, IconArrowsShuffle, IconBrain, IconCloud, IconCode, IconContainer, IconCpu, IconCpu2, IconDatabase, IconGauge, IconGitBranch, IconRoute, IconServer, IconShieldLock, IconTransform, } from '@tabler/icons-react'; ## Ingestion guides \[toc]
Choose the ingestion path that matches the system sending data to Parseable. ### OpenTelemetry \[toc] ### Prometheus Remote Write \[toc] ### AI Infrastructure \[toc] ### Telemetry Agents \[toc] ### Containers \[toc] ### Streaming \[toc] ### Databases \[toc] ### Parseable Auto Instrumentation \[toc] ### Security \[toc] ### eBPF \[toc] ### GPU \[toc] ### CI/CD \[toc] ### Infrastructure \[toc] ### Cloud \[toc] ### Programming Languages \[toc] } title="OpenTelemetry"> Send logs, metrics, and traces through OTLP and OpenTelemetry-compatible pipelines. } title="Prometheus Remote Write"> Ingest Prometheus metrics with the remote write protocol. } title="AI Infrastructure"> Observe agents, LLMs, gateways, runtimes, sandboxes, and coding assistants. } title="Telemetry Agents"> Forward telemetry with collectors and agents such as Fluent Bit, Vector, Logstash, and OTel Collector. } title="Containers & Orchestration"> Collect logs and telemetry from Docker, Kubernetes, ECS, EKS, GKE, and AKS. } title="Streaming"> Route events through Kafka, Redpanda, RabbitMQ, NATS, Cribl, and managed streaming platforms. } title="Databases"> Send or migrate telemetry from PostgreSQL, MySQL, MongoDB, Redis, SQL Server, and Elasticsearch. } title="Parseable Auto Instrumentation"> Collect Kubernetes logs, metrics, traces, and events with Parseable-managed instrumentation. } title="Security"> Bring security events from Auth0, Falco, Trivy, and related sources into Parseable. } title="eBPF"> Capture kernel-level observability signals with eBPF-based tooling. } title="GPU"> Collect GPU metrics and accelerator telemetry. } title="CI/CD"> Capture telemetry from GitHub Actions, Jenkins, GitLab CI, CircleCI, ArgoCD, and Terraform. } title="Infrastructure"> Collect telemetry from infrastructure services such as Traefik and Windows Server. } title="Cloud"> Ingest logs and events from AWS, Azure, Google Cloud, and Fly.io. } title="Programming Languages" className="col-span-2"> Send telemetry directly from application code in Python, JavaScript, Go, Java, Rust, .NET, PHP, and Ruby. You can ingest data to Parseable in JSON format over HTTP(s). This means that any log agent, metric collector, or tracing library that can send data over HTTP in JSON format can be used to ingest data into Parseable. For log data you can use the HTTP output plugins of all the logging agents/shippers. You can also directly integrate Parseable with your application via the [ingestion API](/api/v1/ingestLogsWithHeaders). Parseable also supports OTel native data ingestion via Protobuf over HTTP. OpenTelemetry-compatible agents and libraries can send logs, metrics, and traces to the signal-specific OTLP endpoints: `/v1/logs`, `/v1/metrics`, and `/v1/traces`. Parseable derives the telemetry signal type from the endpoint path and uses `X-P-Stream` to choose the destination dataset. ## Detailed reference For HTTP headers, schema behavior, log processing, batching, timestamps, staging, and production planning, see the [Ingestion Reference](/ingestion-reference). # MCP Server (/mcp) import { Step, Steps } from 'fumadocs-ui/components/steps'; Parseable MCP Server lets any MCP-compatible AI client work with your existing Parseable deployment. Instead of copying logs, schemas, alert details, or query output into a chat by hand, the client gets a clear tool surface for the work you would normally do in Prism or through APIs, such as finding datasets, checking schemas, running SQL or PromQL, reviewing alerts, and checking access information. It does not ingest telemetry, store query results, or create another observability backend. The MCP server is a bridge. Your AI client talks to the MCP server, the MCP server calls Parseable with the API key you provide, and Parseable still enforces the same RBAC permissions that apply everywhere else. ## How it fits ```text AI client | | MCP tool call v Parseable MCP Server | | Parseable API request with X-API-Key v Parseable ``` This is useful when you want an AI client to help with an investigation without copying logs, metrics, alert definitions, or schema details into the chat by hand. You can ask for recent errors in a dataset, inspect the fields available in a stream, run a bounded SQL query, check a PromQL expression, or review alert configuration from the same place where you are already working. ## Prerequisites You need a Parseable Cloud account or a self-hosted Parseable instance that the MCP server can reach. You also need a Parseable API key with the right RBAC permissions for the datasets and actions you want the AI client to use. For local setup, make sure Node.js and `npm` are available on the machine where your MCP client runs. For remote setup, use an MCP client that supports Streamable HTTP connections and custom headers. ## Connection options | Option | How it works | Best for | | ----------- | -------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | Local stdio | The AI client starts `@parseable/parseable-mcp-server` as a local subprocess and passes credentials through local configuration. | Claude Desktop, Claude Code, Cursor, VS Code, and other local MCP clients. | | Remote HTTP | The AI client connects to an MCP endpoint over Streamable HTTP and sends the Parseable API key in request headers. | Hosted MCP deployments or clients that prefer a remote connector. | Local setup is usually the easiest place to start. Remote setup is useful when a team wants one MCP endpoint to manage upgrades and network access centrally. ## Local setup ### Run the setup command Run the installer from the machine where your MCP client is installed: ```bash npx -y @parseable/parseable-mcp-server@latest init ``` The setup flow asks which client you want to configure, whether you are using Parseable Cloud or a self-hosted instance, and which API key should be used. ### Choose the Parseable target For Parseable Cloud, the setup writes a hosted MCP connection for clients that support it. For self-hosted Parseable, provide the base URL of your Parseable instance, for example: ```text https://parseable.example.com ``` Use the URL that your machine can actually reach. If your Parseable instance is behind a private network, the local MCP client must be on that same network or have access through your usual tunnel or VPN. ### Add the API key Paste a Parseable API key when the setup prompts for it. The key should have only the permissions needed for the work you want the AI client to perform. For example, a read-only investigation workflow should not use a key that can change alerts or manage users. After setup is complete, restart the MCP client so it can discover the new Parseable tools. You can also run setup in a scripted form. For a self-hosted Parseable instance: ```bash npx -y @parseable/parseable-mcp-server@latest init \ --client claude-desktop \ --mode self-hosted \ --url https://parseable.example.com \ --api-key "$PARSEABLE_API_KEY" ``` For Parseable Cloud: ```bash npx -y @parseable/parseable-mcp-server@latest init \ --client cursor \ --mode cloud \ --api-key "$PARSEABLE_API_KEY" ``` The interactive setup shows the clients supported by the version you are installing. ## Manual local configuration If you prefer to edit your MCP client configuration directly, add a local server entry like this: ```json { "mcpServers": { "Parseable": { "command": "npx", "args": ["-y", "@parseable/parseable-mcp-server@latest"], "env": { "PARSEABLE_URL": "https://parseable.example.com", "PARSEABLE_API_KEY": "your-api-key" } } } } ``` Some MCP clients use `servers` instead of `mcpServers`. Use the shape expected by your client. ## Remote HTTP setup In remote mode, the client connects to an MCP endpoint and sends credentials as headers. Use HTTPS for remote connections. For a self-hosted Parseable target: ```json { "mcpServers": { "parseable": { "type": "http", "url": "https://mcp.example.com/mcp", "headers": { "X-Parseable-URL": "https://parseable.example.com", "X-API-Key": "your-parseable-api-key" } } } } ``` For Parseable Cloud: ```json { "mcpServers": { "parseable": { "type": "http", "url": "https://mcp.parseable.com/mcp", "headers": { "X-Parseable-Mode": "cloud", "X-API-Key": "your-parseable-cloud-api-key" } } } } ``` Do not send credentials to an MCP endpoint you do not trust. The MCP server uses the supplied API key to call Parseable on your behalf. ## What the tools can do Parseable MCP Server exposes 27 built-in tools around the same objects you already work with in Parseable. Some tools only read data, while a few can change alert state or create alert resources. The exact result still depends on the API key. If the key cannot access a dataset or action in Parseable, the MCP tool cannot access it either. | Group | Tool | What it does | | --------------------- | --------------------- | ------------------------------------------------------------------------------------------ | | Datasets and events | `list_datasets` | Lists the datasets the API key can access. | | | `get_dataset_info` | Shows dataset metadata such as retention, time range, and dataset configuration. | | | `get_dataset_schema` | Returns the fields and types available in a dataset. | | | `get_dataset_stats` | Returns dataset-level statistics such as event count and storage size. | | | `sample_events` | Fetches a small, bounded sample of recent events from a dataset. | | Queries | `query_sql` | Runs a read-only SQL query against a dataset with query controls applied. | | | `query_promql` | Runs an instant or range PromQL query against a metrics dataset. | | | `explain_query` | Explains a SQL query plan without executing the query itself. | | Alerts | `list_alerts` | Lists alerts along with state, severity, tags, and related metadata. | | | `get_alert` | Returns the full configuration for a specific alert. | | | `list_alert_tags` | Lists the tags currently used across alerts. | | | `enable_alert` | Enables an existing alert. | | | `disable_alert` | Disables an existing alert. | | | `evaluate_alert` | Evaluates an alert immediately. This can send real notifications if the condition matches. | | | `create_alert` | Creates a new alert through a guided flow that collects the required alert fields. | | Alert targets | `list_alert_targets` | Lists configured notification targets such as Slack, webhook, or Alertmanager targets. | | | `get_alert_target` | Returns the full configuration for a specific alert target. | | | `create_alert_target` | Creates a new notification target for alert delivery. | | Access review | `list_users` | Lists users visible to the API key. | | | `get_user_roles` | Shows the roles assigned to a specific user. | | | `list_roles` | Lists the roles configured in Parseable. | | | `get_role` | Shows the permissions attached to a specific role. | | | `get_default_role` | Shows the default role assigned to new users. | | Cluster and retention | `ping` | Checks whether the MCP server can reach Parseable and returns basic connectivity details. | | | `get_cluster_status` | Shows node status for a distributed Parseable deployment. | | | `get_cluster_metrics` | Returns high-level cluster metrics for ingest, query, and storage. | | | `get_retention` | Shows the retention policy for a dataset. | ## Common workflows ### Investigate logs A typical log investigation starts by listing datasets, inspecting the schema, and sampling a few recent records. After that, the AI client can help write a SQL query for a specific time window, run it, and explain the rows that came back. Example prompts: * `Show errors from the checkout dataset during the last 30 minutes.` * `Which service produced the most 5xx responses today?` * `Sample recent events from api-logs so I can understand the fields.` ### Query metrics For metrics, use PromQL through the MCP server. You can ask for an instant query when you need the current value, or a range query when you want to inspect how a series changed over time. Example prompts: * `Run a range query for request latency over the last hour.` * `Show the current error rate for the payments service.` * `Explain this PromQL query before running it.` ### Work with alerts The MCP server can help inspect existing alerts and alert targets. It can also help create alerts through a guided flow where the client collects the dataset, condition, evaluation window, severity, tags, and notification target before creation. Be careful with alert evaluation. Evaluating an alert can trigger real notifications, so review the action before confirming it in your MCP client. ### Review access You can ask the client to list users, inspect roles assigned to a user, and compare those roles with the default role. This is useful when an API key or user can see less data than expected. ## Query controls SQL queries must include an explicit time window and are restricted to read-only use. The MCP server blocks common data-changing SQL operations and applies a row limit when the query does not provide one. `sample_events` is also bounded, so it is meant for understanding the shape of a dataset rather than exporting data. Results remain subject to Parseable RBAC and the configured query limits. For long investigations, keep time windows narrow first. Increase the range only after you know which dataset, service, or field is relevant. ## Security notes * Use API keys with the smallest set of roles needed for the workflow, and store them in your MCP client configuration or a secrets manager. Do not commit them to source control. * Use HTTPS for remote MCP and Parseable connections, and do not connect an AI client to an MCP endpoint you do not operate or trust. * Review state-changing actions such as alert creation, alert enablement, alert disablement, and alert evaluation before confirming them. * Rotate the API key in Parseable if it is exposed. Parseable MCP Server does not store telemetry data, query history, result sets, credentials, or user preferences. Parseable remains the system that authenticates the key and enforces permissions. ## Troubleshooting * If the tools do not appear in your client, restart the MCP client after running setup. * If the local server does not start, check that `PARSEABLE_URL` and `PARSEABLE_API_KEY` are present in the generated client configuration. * If you get `401` or `403`, check the API key first. `401` usually means the key is missing, invalid, or rotated. `403` means the key is valid but does not have permission for that dataset or action. * If a dataset is missing, check the dataset name and the roles assigned to the API key. * If PromQL does not work, confirm that you are querying a metrics dataset and that your Parseable deployment supports PromQL. * If a query times out, reduce the time range or result size before increasing timeouts. * If a remote connection fails, check the MCP endpoint URL, HTTPS configuration, request headers, and network reachability. # SQL Reference (/query) Parseable offers a PostgreSQL compatible SQL query interface to query log data. Users can choose to use the filter interface directly without having to deal with SQL at all. However for more complex queries and advanced users, Parseable offers a SQL query interface. You can specify the query and the relevant time range for which you want this query to be run. The response is inclusive of both the start and end timestamps. The filter interface is quite self explanatory, with options to filter by specific columns and values and also by time range. In this document, we'll cover more about the SQL API and its capabilities. Check out the [Query API](/api/v1/queryLogStream). ## How does it work? After parsing and creating the execution plan for a query, the Parseable query server uses the data manifest file to filter out the relevant Parquet files. The data manifest file is a JSON file that contains the specific column metadata for a whole day. The querier uses this file to filter the relevant Parquet files based on the query filters and the time range. Only the relevant Parquet file paths are then added as a data source to custom table provider. Datafusion then efficiently reads the files via the GetRange S3 API, pulling only the very specific data needed for the query. This ensures that only the relevant data is read from the storage, reducing the query time and cost. ## Supported functions Parseable supports a wide range of SQL functions - Aggregate, Window and Scalar functions. Refer the Apache Datafusion documentation for the complete list of supported functions and their usage. * [Aggregate Functions](https://datafusion.apache.org/user-guide/sql/aggregate_functions.html) * [Window Functions](https://datafusion.apache.org/user-guide/sql/window_functions.html) * [Scalar Functions](https://datafusion.apache.org/user-guide/sql/scalar_functions.html) ## Query with regular expressions This section provides examples of how to use regular expressions in Parseable queries. * Match regular expression (Case Sensitive) ```sql SELECT * FROM frontend where message ~ 'failing' LIMIT 9000; ``` * Match regular expression (Case Insensitive) ```sql SELECT * FROM frontend where message ~* 'application' LIMIT 9000; ``` * Does not match regular expression (Case Sensitive) ```sql SELECT * FROM frontend where message !~ 'started' LIMIT 9000; ``` * Does not match regular expression (Case Insensitive) ```sql SELECT * FROM frontend where message !~* 'application' LIMIT 9000; ``` * Matches the beginning of the string (Case Insensitive) ```sql SELECT * FROM frontend where message ~* '^a' LIMIT 9000; ``` * Matches the end of the string ```sql SELECT * FROM frontend where message ~ 'failing$' LIMIT 9000; ``` * Matches numeric type data ```sql SELECT * FROM frontend where uuid ~ '[0-9]' LIMIT 9000; ``` * Matches numeric type data (two digits) ```sql SELECT * FROM frontend where uuid ~ '[0-9][0-9]' LIMIT 9000; ``` * Matches numeric type data (two digits) ```sql SELECT * FROM frontend where uuid ~ '[0-9][0-9]' LIMIT 9000; ``` * Replace every instance of the numeric type data with the symbol \* ```sql SELECT REGEXP_REPLACE(uuid,'[0-9]','*','g') FROM frontend LIMIT 9000; ``` * When a Regex is run against a string, the REGEXP\_MATCHES() function compares the two and returns the string that matches the pattern as a set. ```sql SELECT REGEXP_MATCH(email,'@(.*)$') FROM frontend where email is not null LIMIT 10; ``` * Postgres regex numbers only: Use the REGEXP\_REPLACE() function to extract only the numbers from a string in PostgreSQL. ```sql SELECT REGEXP_REPLACE(email,'\\D','','g') FROM frontend where email is not null LIMIT 10; ``` * Postgres regex split: SPLIT\_PART() function can split a string into many parts. To divide a string into several pieces, we must pass the String, the Delimiter, and the Field Number. ```sql SELECT SPLIT_PART(email,'@',1) FROM frontend where email is not null LIMIT 10 -- return before @ from email; SELECT SPLIT_PART(email,'@',2) FROM frontend where email is not null LIMIT 10 -- return after @ from email; ``` * Postgres Regex Remove Special Characters: Using the REGEXP\_REPLACE() function, all Special Characters from a supplied text can be eliminated. ```sql SELECT REGEXP_REPLACE(email, '[^\\w]+','','g') FROM frontend where email is not null LIMIT 10; ``` * Functions and Operators in pattern matching: Like and other POSIX regular expressions are supported. ```sql SELECT * FROM frontend where email LIKE '%test%' LIMIT 10; SELECT * FROM frontend where email ~ '^test' LIMIT 10; ``` ## Case sensitivity Dataset column names are case sensitive. For example, if you send a log event like ```json { "foo": "bar", "Foo": "bar" } ``` Parseable will create two columns, `foo` and `Foo` in the schema. So, while querying, please refer to the fields as `foo` and `Foo` respectively. While querying, unquoted identifiers are converted to lowercase. To query column names with uppercase letters, they must be passed in double quotes. For example, when sending a query via the REST API, the following JSON payload will apply the `WHERE` condition to the column `Foo`: ```json { "query":"select * from dataset where \"Foo\"=bar", "startTime":"2023-02-14T00:00:00+00:00", "endTime":"2023-02-15T23:59:00+00:00" } ``` If you're querying Parseable via Grafana UI (via the [data source plugin](https://github.com/parseablehq/parseable-datasource)), you can use the following query to query the column `Foo`: ```sql SELECT * FROM dataset WHERE "Foo" = 'bar' ``` ## Query analysis In some cases, you may want to understand the query performance. To view the detailed query execution plan, use the `EXPLAIN ANALYZE` keyword in the query. For example, the following query will return the query execution plan and time taken per step. ```json { "query": "EXPLAIN ANALYZE SELECT * FROM frontend LIMIT 100", "startTime": "2023-03-07T05:28:10.428Z", "endTime": "2023-03-08T05:28:10.428Z" } ``` ## Response fields information with query results To get the query result fields as a part of query API response, add the query parameter `fields=true` to the API call, e.g. `http://localhost:8000/api/v1/query?fields=true`. For example, for a query like `select count(*) as count from app1`, with the query parameter added will respond like this: ```json { "fields": [ "count" ], "records": [ { "count": 2 } ] } ``` # Release notes (/release-notes) ## v3.0 August 9, 2026 Parseable 3.0 focuses on making the platform safer, easier to operate, and better suited to teams running logs, metrics, traces, agents, runtimes, and model traffic in one production environment. It is a hardening release for existing deployments and a broader platform release for teams adopting Parseable across AI infrastructure and day-to-day observability workflows. #### Security and operational hardening This release tightens several areas that affect authentication, authorization, query safety, and data isolation. It includes fixes and improvements around API key security, SQL injection protection in list condition expressions, SSRF protection for alert targets, path traversal protection for local filesystem filters, dataset authorization, OAuth sync, OIDC redirects, and dependency and runtime hardening across the backend and Prism UI. It also improves ingestion and trace endpoint behavior, alert query metadata, and OpenTelemetry metric handling, including exemplar and metric field fixes. #### Tools for teams and agents Parseable 3.0 adds more ways to work with telemetry outside the browser. The Parseable MCP Server gives MCP-compatible clients such as Claude, Cursor, VS Code, Codex, and other agentic tools a safer interface for inspecting datasets, schemas, logs, metrics, traces, alerts, and cluster health. The `pb` command line interface also expands the terminal workflow for querying, tailing, inspecting profiles, and automating common telemetry tasks. #### AI infrastructure observability This release expands Parseable's AI infrastructure coverage across agent frameworks, sandboxes and runtimes, LLMs, and gateways. Agent framework integrations help teams inspect runs, model calls, tool calls, workflow steps, and failures. Runtime and sandbox integrations add visibility into execution, retries, logs, traces, and metrics. LLM and gateway integrations help with model latency, errors, token usage, routing, and provider behavior. Together with Agent Observability in Prism, these integrations make it easier to follow an AI workload across the application, model, tool, runtime, and infrastructure layers. #### Governance, Prism, and Kubernetes operations Multi tenancy adds a clearer workspace boundary for shared deployments, keeping users, roles, API keys, datasets, dashboards, alerts, queries, and storage paths scoped to the right tenant. Prism continues to improve the product surfaces used during investigations, including Agent Observability, APM service maps, dashboards, and reusable templates from the public `parseablehq/dashboards` repository. On Kubernetes, Parseable 3.0 improves the installation and operations story through Helm chart updates and Parseable Auto Instrumentation (PAI). PAI uses the OpenTelemetry Operator and OpenTelemetry Collector to collect logs, metrics, traces, and Kubernetes events with less manual collector wiring, while still keeping the generated resources inspectable as normal Kubernetes objects. For a detailed walkthrough, read the [Parseable 3.0 release recap](https://www.parseable.com/blog/parseable-3-release-recap). For the complete changelog, contributors, and tagged release assets, see the [GitHub v3.0.0 release](https://github.com/parseablehq/parseable/releases/tag/v3.0.0). ## v2.9 June 13, 2026 This release is focused on making Parseable easier to use for AI agents and day-to-day observability workflows. If you are already using Parseable for logs, metrics, or traces, the console should now feel more consistent across the product. If you are building agentic applications, you now get a dedicated way to understand how your agents behave in production. #### Introducing Agent Observability You can now inspect AI agent sessions directly in Parseable. This helps when you want to understand what prompt was used, which LLM calls were made, which tools were called, how many tokens were consumed, where latency came from, and whether errors or unusual sentiment showed up in the flow. Instead of looking at disconnected logs or traces, you can follow the agent workflow in one place and see what happened step by step. This should make debugging slower responses, failed tool calls, or unexpected answers much easier. #### Log context Logs now include a **Log context** view in Prism. From any log row, open the row actions menu and choose **Show context** to see the records around that exact line. This helps when an error log does not explain enough on its own, because you can quickly check what happened before and after it, adjust the surrounding time window, jump back to the referenced line, and apply filters while staying in the same investigation. #### Prism UI refresh We have refreshed Prism across Logs, Metrics, Traces, Datasets, and the Home overview. The aim is simple: moving between observability views should feel familiar, with cleaner layouts getting in the way less often. Alongside this, the release includes fixes and improvements around ingestion, API key ingestion, Helm configuration, S3 IRSA support, metric pruning, and field stats aggregation. For a detailed walkthrough, read the [Parseable v2.9.0 release blog](https://www.parseable.com/blog/parseable-v290-release). For the complete changelog, contributors, and tagged release assets, see the [GitHub v2.9.0 release](https://github.com/parseablehq/parseable/releases/tag/v2.9.0). ## v2.8 May 30, 2026 ### Hot Tier Improvements Hot tier now has a more concurrent and tunable sync model. The refactor separates latest-data sync from historic-data sync, gives each stream its own background tasks, and makes object-store downloads safer through ranged, chunked downloads with partial-file staging. **What's new:** * Historic data sync and latest data sync now run as separate hot-tier tasks. * Each stream gets its own hot-tier background sync tasks, improving concurrency across streams. * Hot-tier file downloads are parallelized and chunked, with partial-file staging before final rename. * Operators can tune hot-tier object-store access with `P_HOT_TIER_DOWNLOAD_CHUNK_SIZE`, `P_HOT_TIER_DOWNLOAD_CONCURRENCY`, `P_HOT_TIER_FILES_PER_STREAM_CONCURRENCY`, `P_HOT_TIER_LATEST_MINUTES`, and `P_HOT_TIER_HISTORIC_SYNC_MINUTES`. ### Metrics and PromQL Improvements Metrics workflows get better series handling, better read behavior, and a smoother PromQL experience in the console. This release adds deterministic per-series hashing during ingestion, improves Parquet layout for metric reads, and expands PromQL support in Prism. **What's new:** * OpenTelemetry metrics known fields now include quantile value fields. * Metrics ingestion now writes a stable per-series hash, helping Parseable identify physical metric series consistently. * Metrics batches are sorted by metric name before Parquet write, improving pruning for metric-name based reads. * Prism adds PromQL querying, PromQL fixes, metric row filtering and copy actions, improved no-data views, and tooltip fixes in Metrics Explore. ### Query and Ingestion Reliability Parseable now surfaces more ingestion failures instead of hiding them behind panics or failed background operations. Query streaming and DataFusion execution tuning were also improved for larger workloads and multi-partition result delivery. **What's new:** * Streaming query merge was redesigned for more stable multi-partition result delivery. * Ingestion and staging operations now return and propagate errors instead of relying on unwraps or hidden failures. * Query execution adds tuning for target partitions, Parquet filtering, page index use, metadata sizing, predicate cache size, and execution batch sizing. ### Tracing and Observability Improvements Tracing is easier to enable in local and development environments, and operators get richer visibility into storage and hot-tier paths. Parseable can now export application traces directly to stdout in JSON format when the OpenTelemetry endpoint is configured for stdout. **What's new:** * Set `OTEL_EXPORTER_OTLP_ENDPOINT=stdout` or `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=stdout` to export application traces to stdout. * Tracing enablement and stdout behavior are simpler and clearer, including endpoint and header handling. * Hot-tier, object-store, startup sync, and storage paths now include richer tracing and metrics for operator visibility. ### Console and User Experience Improvements Prism received reliability and usability updates across Logs, Metrics, Traces, SQL, Alerts, and Errors. The changes reduce visual inconsistencies, improve filtering and copy workflows, and make empty or error states more consistent. **What's new:** * Empty-state handling is more consistent, including preventing flashes before query loaders in Logs, Metrics, and Traces. * Trace views now align start times more consistently and show timestamps in bubble chart tooltips. * Traces and metrics tables now support include, exclude, filter, and copy actions where relevant. * SQL autocomplete quote handling, sidebar collapse behavior, timezone changes, Errors page dataset reset, and non-exception error details were improved, with expanded Playwright coverage across core console workflows. ## v2.7 May 8, 2026 ### APM Support APM is now a dedicated workflow inside Parseable. With this release, a new **Services** view is available in the sidebar, giving teams a service-level entry point for application performance monitoring across traces, errors, request volume, and latency. Click into any service to open a scoped APM view with **Insights**, **Traces**, and **Errors** tabs, so teams can move from service health to request-level debugging without switching tools. What's new: * Browse all traced services from a dedicated Services page. * View requests, error percentage, and latency per service. * Drill into service-specific Insights, Traces, and Errors. * Open services and APM routes through deep links from alerts, runbooks, or external tools. APM Support in Parseable APM Dashboard in Parseable ### Ingestion Traces Ingestion is now a fully traced workflow inside Parseable. The server emits OpenTelemetry spans across the ingestion path, from API intake to schema inference, record-batch conversion, staging, flush, and object-store upload. This gives operators deeper visibility into ingest performance, background sync cycles, and bottlenecks across high-throughput telemetry pipelines. What's new: * Trace ingestion end to end with OpenTelemetry spans across the full ingest path. * Export ingestion traces to any OpenTelemetry collector with standard configuration. * Tune actix server behavior with new CLI args and matching `P_ACTIX_*` environment variables. * Improve high-volume ingest with batched schema inference, parallel record processing, optimized byte-size counting, and safer sync-cycle guards. ### PromQL Support Parseable now includes built-in PromQL support for metrics streams through Prometheus-compatible HTTP APIs under `/prometheus/api/v1`. Existing Grafana dashboards and Prometheus-compatible tooling can point to Parseable and query metrics without major changes. This brings PromQL-native metric analysis into Parseable while keeping logs, traces, and metrics available in one observability platform. What's new: * Query metrics with PromQL through instant query, range query, series, labels, and label-values endpoints. * Use existing Grafana Prometheus data sources with Parseable. * Run PromQL functions, aggregations, binary operators, vector matching, and subqueries. * Execute heavier queries safely with query splitting, result caching, distributed execution, memory guards, and cardinality analysis endpoints. ### Access Management and API Keys Access Management is now the central place to manage users, roles, and API keys in Parseable. With this release, teams can create scoped API keys for programmatic access without relying on personal user credentials. API keys are built for log forwarders, CLI tools, automation scripts, AI agents, dashboards, CI jobs, and other workloads where Basic Auth or OIDC is not the right fit. Each key inherits permissions from assigned roles and can be used through the `X-API-Key` header. What's new: * Create and manage API keys from Access Management. * Assign one or more roles to every API key. * Use dataset-scoped keys for ingestion agents, query agents, dashboards, and automation workflows. * Revoke keys independently without affecting users or other workloads. * Use API keys for supported ingestion and query workflows through the `X-API-Key` header. API Keys Access Management ## v2.5 December 8, 2025 **Parseable v2.5.0** is here! This major update significantly expands our platform capabilities, introducing a dedicated **Trace View**, a **Metrics View**, and powerful AI-native integrations connecting Keystone with the alerting ecosystem. ### 1. Trace View Implementation We have unlocked a new dimension of observability with the introduction of the **Trace View**. This feature is designed to help you visualize the complete lifecycle of requests as they traverse your distributed systems, making it easier than ever to diagnose latency issues and bottlenecks. * **Full Trace Visualization:** Users can now view comprehensive waterfall charts of traces, providing deep visibility into service interactions. * **Enhanced Navigation:** We added intuitive breadcrumbs to the Traces Span detail sheet, allowing for seamless navigation through complex span hierarchies. * **OpenTelemetry Standardization:** Trace field names for events and links have been updated to align strictly with OpenTelemetry standards, ensuring consistent data ingestion and better interoperability. ### 2. Metrics View The Metrics experience has been overhauled to provide deeper insights and a more fluid user experience. * **Data Consistency:** Attribute field names have been standardized across all metric types, simplifying queries and ensuring consistency across your data. ### 3. Keystone Integration with Alerts We are bringing AI-native capabilities closer to your incident response workflow. Keystone is now tightly integrated with the alerting system. * **Automated Investigation:** You can now initiate a Keystone analysis session directly from a triggered alert. This seamless handoff reduces the time between detecting an anomaly and understanding its root cause. ### 4. SQL Editor & Visualization We have enhanced the SQL Editor to support more complex data exploration and reporting needs. * **Table Chart Support:** We introduced the **'Table' chart type**, allowing you to visualize raw data rows directly within your dashboards for detailed reporting. * **Multi-Dataset Expansion:** The SQL editor now supports up to **3 distinct datasets** simultaneously, enabling more complex joins and comparative analysis. * **UX Enhancements:** * Added a **"Clear All"** button to instantly reset GroupBy selections, speeding up exploratory data analysis. * Improved state management for SQL editor tabs to prevent data loss when switching contexts. * Refined the `dbName` logic to better handle complex subqueries. ### 5. Alerting Improvements The alerting engine has been optimized for performance and better context. * **State History:** Parseable now saves the history of alert states, providing a valuable audit trail of when alerts fired, resolved, or changed status. * **Contextual Alerts:** You can now include the `metric_name` context when creating alerts, making notifications more informative at a glance. * **Performance & Clarity:** We optimized the underlying queries used for alert creation to reduce load and removed redundant text from notification messages for cleaner, easier-to-read alerts. ### 6. Bug Fixes * **SQL Editor:** Fixed an issue where error messages were not being displayed when a query failed, ensuring users now see the correct feedback. * **Visualization Logic:** Refined query data checks in the `GaugeStyleSection` to correctly respect `rangeTo` values for accurate gauge rendering. * **Recents Management:** The "Recents" list now automatically cleans itself by removing entries that are no longer valid. * **Timezones:** Fixed an issue with URL parameter handling to ensure selected timezones persist correctly during navigation. ## v2.4.3 September 22, 2025 We're excited to announce Parseable v2.4.3. This release was focussed on improving the user experience of using SQL via our SQL editor. ### New SQL editor The SQL editor has a new sidebar to showcase all the columns and their types for fast lookups. After the query is run and results are available, you can now use the chart view customization options and add these charts to dashboards directly. AI assistant, saved queries are now rearranged to the right side of the screen for better visibility and access. Dashboard SQL Chart Builder