Welcome to LogClaw

LogClaw is an enterprise-grade, Kubernetes-native log intelligence platform. It combines real-time anomaly detection, trace-correlated incident ticketing, and GitOps-native multi-tenancy into a single deployment stack.

Why LogClaw?

OTLP-Native Ingestion

Uses OpenTelemetry Protocol as the sole ingestion interface. Any OTel SDK, agent, or collector works out of the box — no custom integrations.

AI-Powered Detection

Statistical anomaly scoring on error rates, automatic trace correlation across services, and blast radius computation — all in real time.

Multi-Platform Ticketing

Route incidents to PagerDuty, Jira, ServiceNow, OpsGenie, Slack, or Zammad simultaneously with per-severity routing rules.

GitOps-Native Tenancy

Add a YAML file, push to main, and ArgoCD deploys a fully isolated tenant stack in 30 minutes. Namespace-per-tenant — no shared data plane.

How It Works

Apps ──OTLP──▶ OTel Collector ──▶ Kafka ──▶ Bridge (ETL + Anomaly + Trace Correlation)
  (gRPC :4317)                                        │
  (HTTP :4318)                          ┌──────────────┴──────────────┐
                                        ▼                             ▼
                                  OpenSearch                   Ticketing Agent
                                (search + analytics)       (PagerDuty, Jira, etc.)
                                        │
                                        ▼
                                   Dashboard
                              (Next.js pipeline UI)

Core Components

Component	Role	Technology
OTel Collector	OTLP gRPC/HTTP receiver, batching, tenant enrichment	OpenTelemetry Collector Contrib
Kafka	Durable event bus — raw logs + enriched logs topics	Strimzi KRaft
Bridge	OTLP ETL, anomaly detection, trace correlation, OpenSearch indexer	Python, Kafka
OpenSearch	Full-text search, log analytics, visualization	OpenSearch + Dashboards
Ticketing Agent	AI SRE — deduplicated, trace-correlated incident tickets	Python, LangChain
ML Engine	Feature Store + model inference serving	Feast, KServe
Airflow	ML pipeline orchestration and retraining DAGs	Apache Airflow
Infrastructure Agent	Cluster health collection — Kafka lag, Flink, OpenSearch, ESO	Go
Dashboard	Web UI for log ingestion, incidents, anomalies, and config	Next.js

Quick Start

Docker Compose (Fastest)
Kind Cluster (Full K8s Stack)

No cloning, no building — just pull and run:

curl -O https://raw.githubusercontent.com/logclaw/logclaw/main/docker-compose.yml
curl -O https://raw.githubusercontent.com/logclaw/logclaw/main/otel-collector-config.yaml
docker compose up -d

Open http://localhost:3000 — the full stack is running. All images are pulled from ghcr.io/logclaw/ (public, no auth required).Send a test log:

curl -X POST http://localhost:4318/v1/logs \
  -H "Content-Type: application/json" \
  -d '{
    "resourceLogs": [{
      "resource": {
        "attributes": [
          {"key": "service.name", "value": {"stringValue": "my-app"}}
        ]
      },
      "scopeLogs": [{
        "logRecords": [{
          "timeUnixNano": "'$(date +%s)000000000'",
          "severityText": "INFO",
          "body": {"stringValue": "Hello from LogClaw!"}
        }]
      }]
    }]
  }'

For the full Kubernetes experience with all operators:

git clone https://github.com/logclaw/logclaw.git
cd logclaw
./scripts/setup-dev.sh

This creates a Kind cluster, installs all operators and services, and runs a smoke test. Takes ~20 minutes on a 16 GB machine.

Container Images

All LogClaw images are public on GHCR — pull directly with no auth:

docker pull ghcr.io/logclaw/logclaw-dashboard:stable
docker pull ghcr.io/logclaw/logclaw-bridge:stable
docker pull ghcr.io/logclaw/logclaw-ticketing-agent:stable
docker pull ghcr.io/logclaw/logclaw-flink-jobs:stable

Next Steps

Architecture

Understand the deployment model, data flow, and component interactions.

Tenant Onboarding

Provision a new tenant from zero to fully operational in 30 minutes.

OTLP Integration

Send logs from any language or framework using OpenTelemetry SDKs.

Local Development

Set up a local dev environment with Docker Compose or Kind.

Dashboard Guide

Explore the web UI for log ingestion, incident management, and pipeline monitoring.

API Reference

Full API documentation for every LogClaw service.

Getting Started

Components

Ingestion

Integrations

Configuration

Introduction

Welcome to LogClaw

Why LogClaw?

OTLP-Native Ingestion

AI-Powered Detection

Multi-Platform Ticketing

GitOps-Native Tenancy

How It Works

Core Components

Quick Start

Container Images

Next Steps

Architecture

Tenant Onboarding

OTLP Integration

Local Development

Dashboard Guide

API Reference

​Welcome to LogClaw

​Why LogClaw?

OTLP-Native Ingestion

AI-Powered Detection

Multi-Platform Ticketing

GitOps-Native Tenancy

​How It Works

​Core Components

​Quick Start

​Container Images

​Next Steps

Architecture

Tenant Onboarding

OTLP Integration

Local Development

Dashboard Guide

API Reference

Welcome to LogClaw

Why LogClaw?

How It Works

Core Components

Quick Start

Container Images

Next Steps