Do I have to define a schema before sending logs?

No. Post any JSON object to the ingest endpoint and fields are discovered automatically. Types are resolved at query time, so a field that changes shape six months from now does not break historical queries or force a reindex.

How is pricing actually calculated?

One dial: gigabytes ingested per month, with retention as a multiplier. Queries, dashboards, monitors, seats and egress are included. Per-gigabyte rates drop automatically at each volume tier, so total cost grows sub-linearly.

What happens to data past its retention window?

You choose: expire it, or continuously mirror compressed blocks into your own S3-compatible bucket. Mirrored data stays queryable through the same API — there is no rehydration ticket and no separate archive product.

Can I migrate off without a rewrite?

Yes. Ingest is OpenTelemetry- and Elasticsearch-bulk compatible, so most agents point at a new URL and keep working. Exports are newline-delimited JSON or Parquet straight to your bucket.

How do AI agents fit in?

A native MCP server exposes datasets, schema and the query language to any compatible agent. Agents use the exact primitives your engineers do, with token scopes and per-dataset permissions enforced on every call.

Which regions can I ingest into?

Ashburn, Portland, Frankfurt, London, Singapore and São Paulo. Data stays in the region you pick, and Enterprise plans can pin residency per dataset.

Ingest API v1 · now in every region

The unified
logging API.

One endpoint for every log, metric, trace and event. Schema-less ingest at petabyte scale, sub-second search across all of it, and a bill you can predict before you send the first byte.

Start free Talk to sales50 GB/mo free · no card

Last 30 mins Run

BuilderEditor⌘K to generate

1['api-gateway-prod']
2| where status >= 500 and ['geo.region'] == "us-east-1"
3| extend route = tostring(attributes['http.route'])
4| summarize errors = count(), p95 = percentile(latency, 95) by route
5| order by errors desc | take 6

Results14.2B scanned · 112ms

route	errors	p95 (ms)
/v1/checkout	12,318	1,842
/v1/payments/intent	9,247	612
/v1/cart/sync	2,698	388
/v1/session	1,852	287
/v1/search	1,505	157
/v1/webhooks/stripe	789	143

events / sec ingest: 8.4M
p95 query latency: 112ms
storage compression: 96%
indexes to manage: 0

Handling machine data at scale for

NorthwindCal.comLumenVercelKestrelBasaltRivetCoveHelioAnvilParsecTidepoolNorthwindCal.comLumenVercelKestrelBasaltRivetCoveHelioAnvilParsecTidepool

The wall

What worked at gigabytes
breaks at terabytes.

Cost scales faster than value. Retention turns into a ticket queue. Every new source is another pipeline to own — and the team keeping the stack alive keeps growing.

Visibility

You sample away the answer.

Budgets force drop rules and 1-in-100 sampling. The event that explains the incident is statistically the one you threw out.

events kept1 in 100

Cost

The invoice has 14 SKUs.

Indexing tiers, per-host agents, egress, rehydration. Finance can't forecast it and engineers stop instrumenting to survive it.

Datadog$41,200

Splunk$28,900

Elastic$15,624

Operations

You now run a log cluster.

Shard rebalancing, schema migrations, capacity planning, and a pager for the observability stack itself.

on-call pages+38% QoQ

Nobody budgets for the data they throw away.

Drop rules and sampling are cost controls masquerading as architecture. The one event that explains the outage is, statistically, the one that never made it to storage.

93%

of logs never queried

1 in 100

typical sample rate

4.2 hrs

median MTTR with gaps

Q3 observabilityover budget

Ingest & indexing$14,520
Hot storage$12,480
Query compute$28,650
Retention add-on$9,340
Egress$20,734

Total$85,724

Platform

No data left behind.

Schema-less ingest on a fully managed event store with 96% compression. Keep every log and every dimension, for as long as you want, without standing up a cluster to do it.

Search the write path.

Live tail runs your filter against events as they land — before indexing, before rollups. Point it at a production firehose, narrow by any field, and watch matches arrive in well under a second.

Filter by any field, no index required
WebSocket stream to CLI, UI or agent
Pin, share and replay a tail window

--:--:--.---infoapi-gatewayGET /v1/session 200 in 31ms

--:--:--.---warnpaymentsupstream retry 1/3 · stripe timeout

--:--:--.---errorcheckoutpool exhausted: 40/40 connections

--:--:--.---infoauthtoken refreshed org_8f21c4

--:--:--.---debugotel-collectorflushed 4,096 spans in 12ms

--:--:--.---infosearchreindex shard 7 complete

--:--:--.---errorpaymentscharge.failed · insufficient_funds

--:--:--.---infoedgecache HIT ratio 0.94 · fra1

--:--:--.---infoapi-gatewayGET /v1/session 200 in 31ms

--:--:--.---warnpaymentsupstream retry 1/3 · stripe timeout

--:--:--.---errorcheckoutpool exhausted: 40/40 connections

--:--:--.---infoauthtoken refreshed org_8f21c4

One endpoint, every source

A single HTTPS ingest API plus drop-in SDKs. OpenTelemetry, Vector, Fluent Bit, syslog and Kafka land in the same store.

POST /v1/ingest/:dataset

Schema-on-read

Send whatever JSON you have. Fields are discovered at ingest and typed at query time — no migrations, no mapping conflicts.

4,096 fields per dataset

Live tail

Streaming search over the write path. Filter a production firehose by field and watch matches arrive in under a second.

WebSocket · < 800ms lag

Monitors & alerts

Any saved query becomes a threshold or anomaly monitor, routed to PagerDuty, Slack, Opsgenie or a signed webhook.

1m evaluation floor

Dashboards

Composable charts backed by the same query language, with template variables, shared time range and public snapshots.

as-code via Terraform

Tenanted by design

Org, dataset and field-level RBAC, SSO/SAML, scoped API tokens, and PII redaction applied before the byte is stored.

SOC 2 Type II · HIPAA

Query language

Modern engine. Classic UX.

A piped, sequential query language on a purpose-built columnar store. The expressiveness power users expect, on infrastructure you can actually afford to feed.

Piped and sequential — read it top to bottom, exactly how you debug.
Virtual fields transform at query time, so old data gains new columns.
The same primitives power the UI, the API, the CLI and the MCP server.

Read the language docs Open playground

production-logs · 14.2B events

BuilderRun

1['production-logs']
2| where ['status'] in ("400", "500")
3| extend region = tostring(attributes['aws.region'])
4| summarize errors = count(), p95 = percentile(latency, 95) by region
5| order by errors desc
6| take 5

region	errors	p95 (ms)
us-east-1	12,318	1,842
eu-west-1	9,247	612
ap-southeast-2	2,698	388
us-west-2	1,852	287
ap-northeast-1	1,505	57

14.2B events scanned · 0 indexes · 112 ms

Ingest pipeline

Point everything at one URL.

Agents, collectors, edge functions and cron jobs all write to the same endpoint. Transformation, redaction and routing happen on the way in — not in a pipeline you maintain.

Edge ingest

Batched, compressed, authenticated at the nearest PoP.

Transform

Redact, enrich, route and drop with declarative rules.

Columnar store

Immutable blocks on object storage, 96% compressed.

Query & alert

Vectorized scan, live tail, monitors and dashboards.

Send your first event201 Created · 18 ms

curl -X POST https://api.logstreem.com/v1/ingest/api-gateway-prod \
  -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '[{ "level": "error", "service": "checkout", "latency": 3814,
         "attributes": { "http.route": "/v1/checkout", "geo.region": "us-east-1" } }]'

Economics

Predict every bill.

One usage-based dial across logs, traces, metrics and events. No SKU stair-steps, no per-host agents, no overage tier. Per-gigabyte rates fall automatically as volume climbs.

Ingest / month

1 TB

Estimated bill

$371/mo

100 GB500 GB1 TB10 TB100 TB500 TB1 PB

Effective rate: $0.370/GB
Retention: 400 days
Seats & queries: Included

Same workload · 12-month retention

What you'd pay elsewhere

Logstreemusage-based, one dialbaseline
Grafana CloudPro tier18× more
Elastic Cloudhot + frozen tiers24× more
Datadoglogs + APM, 12 SKUs96× more
SplunkObservability Cloud128× more

Modelled on 1 TB/month ingest with full retention and no sampling, using each vendor's published list pricing.

~/incident-2317 — zshmcp connected

› why did checkout p95 spike at 14:21 UTC?

›

Agents

Built for engineers and their agents.

Agents are already in the on-call rotation. They need to query observability data the way engineers do — with the same language, the same permissions and the same audit trail.

Native MCP server
Datasets, schema and the full query language exposed to any MCP-compatible agent — no adapters, no glue code.
Same primitives as your team
Agents run the identical queries your engineers do, so a result in chat is reproducible in the console.
Scoped and audited
Per-dataset token scopes and field-level redaction apply on every agent call, and each one lands in the audit log.

Use cases

One log platform, every workload.

Container logs, serverless invocations, audit trails and product events all land in the same store and answer to the same query language.

Kubernetes and container logs

Ship stdout, stderr and events from every pod with a DaemonSet collector. Namespace, pod and container labels arrive as first-class fields, so you can slice a noisy cluster without writing a single grok pattern.

Serverless and edge functions

Lambda, Cloudflare Workers and Vercel functions emit short-lived, high-cardinality logs. Schema-less ingest keeps every invocation, request id and cold-start marker queryable months later.

Incident response and MTTR

Correlate logs, traces and deploy markers on one timeline. Live tail narrows a firehose to the failing request while the incident is still open, instead of after the rehydration job finishes.

Audit trails and compliance

Immutable retention up to 400 days with field-level redaction on ingest, so access logs and admin actions satisfy SOC 2 and HIPAA evidence requests without a second archive product.

SIEM and log-tier offload

Keep detections in your SIEM and move the bulk tier here. Ingest costs drop by an order of magnitude while the raw events stay searchable and exportable to your own bucket.

Product and business events

Signups, checkouts and feature flags are events too. One store for machine data and product analytics means the same query language answers both engineering and revenue questions.

Integrations

It already speaks your stack.

Drop-in compatibility with the collectors and agents you run today. Most migrations are a URL and a token.

OpenTelemetry

Vector

Fluent Bit

Kubernetes

AWS Lambda

Cloudflare

Vercel

Kafka

Logstash

Heroku

Datadog Agent

Syslog

Terraform

PagerDuty

Slack

Grafana

Compliance & controls

SOC 2 Type II
AES-256 at rest
SSO / SAML + SCIM
PII redaction on ingest
EU & US data residency
Immutable audit log

Pricing

Pay for bytes. Nothing else.

Free

Everything, capped. No card, no expiry.

$0forever

50 GB ingest / month
30-day retention
3 team members
Live tail & dashboards
Community support

Start free

Pro

Usage-based, with volume discounts applied in-console.

$31per 100 GB ingested

billed annually

Unlimited datasets & members
Retention up to 400 days
Monitors, webhooks, on-call routing
Field-level RBAC & API tokens
MCP server + CLI
Email and chat support

Start 14-day trial

Enterprise

For regulated teams with SLOs and auditors.

Custom

Dedicated ingest & isolated tenancy
EU / US / custom data residency
SSO/SAML, SCIM, audit export
99.99% uptime SLA
Migration support & named SRE

Talk to sales

FAQ

Questions engineers actually ask.

No. Post any JSON object to the ingest endpoint and fields are discovered automatically. Types are resolved at query time, so a field that changes shape six months from now does not break historical queries or force a reindex.
One dial: gigabytes ingested per month, with retention as a multiplier. Queries, dashboards, monitors, seats and egress are included. Per-gigabyte rates drop automatically at each volume tier, so total cost grows sub-linearly.
You choose: expire it, or continuously mirror compressed blocks into your own S3-compatible bucket. Mirrored data stays queryable through the same API — there is no rehydration ticket and no separate archive product.
Yes. Ingest is OpenTelemetry- and Elasticsearch-bulk compatible, so most agents point at a new URL and keep working. Exports are newline-delimited JSON or Parquet straight to your bucket.
A native MCP server exposes datasets, schema and the query language to any compatible agent. Agents use the exact primitives your engineers do, with token scopes and per-dataset permissions enforced on every call.
Ashburn, Portland, Frankfurt, London, Singapore and São Paulo. Data stays in the region you pick, and Enterprise plans can pin residency per dataset.

Keep every log.
Predict every bill.

Start free Talk to sales