Berserk for Observability

One engine. Not a hundred silos.

Logs, metrics, traces, security events, and AI output, in one schemaless store. Ask across all of it in KQL, self-hosted.

TODAYWITH BERSERKLogsMetricsTracesAPMSIEMRUMAnalyticsLLM ObsAudit9 stores · 9 query languages · 9 billsBERSERKone schemaless store for all of itlogsmetricstraceseventspromptsaudit$1/GB · KQL · self-hostedOne query, across the whole picture.

You didn't choose a hundred silos. They accreted.

Nobody decided to run forty observability and analytics products. It happened one data type at a time. Logs went to one vendor. Metrics to another. Traces to a third. Security wanted a SIEM, product wanted analytics, compliance wanted an audit trail, and now the AI team is generating prompt and reasoning logs that fit none of them.

Each tool came with its own store, its own query language, its own retention policy, and its own login. None of them talk to each other. The question you actually have lives across four of them, so you can't ask it. You export CSVs and join them by hand.

The data was always the same shape, timestamped, attributed events. The silos were never technical. Berserk takes the slices back into one store.

The question you couldn't ask before

When traces, logs, security events, and model output sit in the same store, the cross-signal question becomes a single query, and the agent writes the KQL for you.

// every request that hit payments, failed auth,
// AND triggered an agent retry, grouped by customer
requests
| where service == "payments"
| join auth_events on trace_id
| join agent_runs  on trace_id
| where auth.result == "denied" and agent.retries > 0
| summarize count() by customer_id

Today that spans an APM, a SIEM, and an AI-observability tool. In Berserk it's one line of thought.

The shape of the fix

Schemaless ingest

Point your OpenTelemetry collectors at it and ship. New event types need no migration, when your stack changes weekly, the store doesn't flinch.

One query language

KQL across everything, the language LLMs already speak. The join between a trace and a security event is a query, not a CSV export.

Keep everything

Store every event, not just what you remembered to instrument, so the field you need during an incident, and the long retention that catches a slow regression, are already there.

Self-hosted, your object store

Your data stays yours, in your region, on infrastructure you control. We stop at the engine.

One engine. Your data. Ask anything.