> ## Documentation Index
> Fetch the complete documentation index at: https://docs.logclaw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> AI-powered log intelligence platform with real-time anomaly detection, trace correlation, and OTLP-native ingestion.

# Welcome to LogClaw

LogClaw is an **enterprise-grade, Kubernetes-native log intelligence platform**. It combines real-time anomaly detection, trace-correlated incident ticketing, and GitOps-native multi-tenancy into a single deployment stack.

<img className="block dark:hidden" src="https://mintcdn.com/migrify/_qg4irDGpZ7k0WyT/logo/light.svg?fit=max&auto=format&n=_qg4irDGpZ7k0WyT&q=85&s=5cb7c1c75e4df4f43e75f060d0017ff6" alt="LogClaw" width="180" data-path="logo/light.svg" />

<img className="hidden dark:block" src="https://mintcdn.com/migrify/_qg4irDGpZ7k0WyT/logo/dark.svg?fit=max&auto=format&n=_qg4irDGpZ7k0WyT&q=85&s=0e2ef96e53396dcee885b0705a957fbc" alt="LogClaw" width="180" data-path="logo/dark.svg" />

## Why LogClaw?

<CardGroup cols={2}>
  <Card title="OTLP-Native Ingestion" icon="plug">
    Uses OpenTelemetry Protocol as the sole ingestion interface. Any OTel SDK, agent, or collector works out of the box — no custom integrations.
  </Card>

  <Card title="AI-Powered Detection" icon="brain">
    Statistical anomaly scoring on error rates, automatic trace correlation across services, and blast radius computation — all in real time.
  </Card>

  <Card title="Multi-Platform Ticketing" icon="ticket">
    Route incidents to PagerDuty, Jira, ServiceNow, OpsGenie, Slack, or Zammad simultaneously with per-severity routing rules.
  </Card>

  <Card title="GitOps-Native Tenancy" icon="code-branch">
    Add a YAML file, push to main, and ArgoCD deploys a fully isolated tenant stack in 30 minutes. Namespace-per-tenant — no shared data plane.
  </Card>
</CardGroup>

## How It Works

```
Apps ──OTLP──▶ OTel Collector ──▶ Kafka ──▶ Bridge (ETL + Anomaly + Trace Correlation)
  (gRPC :4317)                                        │
  (HTTP :4318)                          ┌──────────────┴──────────────┐
                                        ▼                             ▼
                                  OpenSearch                   Ticketing Agent
                                (search + analytics)       (PagerDuty, Jira, etc.)
                                        │
                                        ▼
                                   Dashboard
                              (Next.js pipeline UI)
```

## Core Components

| Component                | Role                                                               | Technology                      |
| ------------------------ | ------------------------------------------------------------------ | ------------------------------- |
| **OTel Collector**       | OTLP gRPC/HTTP receiver, batching, tenant enrichment               | OpenTelemetry Collector Contrib |
| **Kafka**                | Durable event bus — raw logs + enriched logs topics                | Strimzi KRaft                   |
| **Bridge**               | OTLP ETL, anomaly detection, trace correlation, OpenSearch indexer | Python, Kafka                   |
| **OpenSearch**           | Full-text search, log analytics, visualization                     | OpenSearch + Dashboards         |
| **Ticketing Agent**      | AI SRE — deduplicated, trace-correlated incident tickets           | Python, LangChain               |
| **ML Engine**            | Feature Store + model inference serving                            | Feast, KServe                   |
| **Airflow**              | ML pipeline orchestration and retraining DAGs                      | Apache Airflow                  |
| **Infrastructure Agent** | Cluster health collection — Kafka lag, Flink, OpenSearch, ESO      | Go                              |
| **Dashboard**            | Web UI for log ingestion, incidents, anomalies, and config         | Next.js                         |

## Quick Start

<Tabs>
  <Tab title="Docker Compose (Fastest)">
    No cloning, no building — just pull and run:

    ```bash theme={null}
    curl -O https://raw.githubusercontent.com/logclaw/logclaw/main/docker-compose.yml
    curl -O https://raw.githubusercontent.com/logclaw/logclaw/main/otel-collector-config.yaml
    docker compose up -d
    ```

    Open **[http://localhost:3000](http://localhost:3000)** — the full stack is running. All images are pulled from `ghcr.io/logclaw/` (public, no auth required).

    Send a test log:

    ```bash theme={null}
    curl -X POST http://localhost:4318/v1/logs \
      -H "Content-Type: application/json" \
      -d '{
        "resourceLogs": [{
          "resource": {
            "attributes": [
              {"key": "service.name", "value": {"stringValue": "my-app"}}
            ]
          },
          "scopeLogs": [{
            "logRecords": [{
              "timeUnixNano": "'$(date +%s)000000000'",
              "severityText": "INFO",
              "body": {"stringValue": "Hello from LogClaw!"}
            }]
          }]
        }]
      }'
    ```
  </Tab>

  <Tab title="Kind Cluster (Full K8s Stack)">
    For the full Kubernetes experience with all operators:

    ```bash theme={null}
    git clone https://github.com/logclaw/logclaw.git
    cd logclaw
    ./scripts/setup-dev.sh
    ```

    This creates a Kind cluster, installs all operators and services, and runs a smoke test. Takes \~20 minutes on a 16 GB machine.
  </Tab>
</Tabs>

### Container Images

All LogClaw images are public on GHCR — pull directly with no auth:

```bash theme={null}
docker pull ghcr.io/logclaw/logclaw-dashboard:stable
docker pull ghcr.io/logclaw/logclaw-bridge:stable
docker pull ghcr.io/logclaw/logclaw-ticketing-agent:stable
docker pull ghcr.io/logclaw/logclaw-flink-jobs:stable
```

## Next Steps

<CardGroup cols={2}>
  <Card title="Architecture" icon="sitemap" href="/architecture">
    Understand the deployment model, data flow, and component interactions.
  </Card>

  <Card title="Tenant Onboarding" icon="rocket" href="/onboarding">
    Provision a new tenant from zero to fully operational in 30 minutes.
  </Card>

  <Card title="OTLP Integration" icon="plug" href="/otlp-integration">
    Send logs from any language or framework using OpenTelemetry SDKs.
  </Card>

  <Card title="Local Development" icon="laptop-code" href="/local-development">
    Set up a local dev environment with Docker Compose or Kind.
  </Card>

  <Card title="Dashboard Guide" icon="chart-line" href="/components/dashboard">
    Explore the web UI for log ingestion, incident management, and pipeline monitoring.
  </Card>

  <Card title="API Reference" icon="code" href="/api-reference/overview">
    Full API documentation for every LogClaw service.
  </Card>
</CardGroup>