Logflare is a production-grade, multi-tenant log management platform (now part of Supabase) built with Elixir/Phoenix. It ingests logs via HTTP, gRPC (OTLP), WebSockets, and platform-specific drains, processes them through a rule engine, and routes them to user-configured backends including BigQuery, ClickHouse, Postgres, S3, and many more. The architecture is a monolithic Elixir application with internal subsystems: an ETS-backed ingest queue for high troughput, Broadway pipelines for batched ingestion, a behaviour-driven adaptor system for pluggable storage backends, a custom query languagte (LQL) with a parser and dialect transformers, a distributed cache layer via Cachex and WAL busting, and Rust NIFs for performance-critial mapping and Arrow IPC. It includes a full web UI (Phoenix LiveView), a REST API (OpenAPI-documented), billing with Stripe, team management, and alerting. The codebase is largte (1700+ files) and mature (100+ database migrations), with extensive test coverage, benchmarks, and CI/CD pipelines. While predominantly an application, it also exhibits data engineerig aspects with its focus on high-volume log ingstion, schema evolution, and query optimization.
VictoriaLogs is a high-performance, lightweight log management system designed for both small and large-scale deployments. It consists of multiple Go-based services for log ingestion (vlagent, vlinsert), storage (vlstorage), and querying (vlselect), complemented by a Preact/TypeScript web UI (vmui). The system uses a columnar storage approach with bloom filters, custom encoding, and a pipeline-based query engine (LogsQL) for efficient log processing. Key architectural patterns include composable data transformation pipes, extensible filter systems, mergeable statistical aggregations, and object pooling for performance optimization. The frontend features a modular component architecture with custom hooks for state management, contextual controls, and interactive visualizations.
HyperDX / ClickStack is a full-stack observability platform for ingesting, storing, querying, and visualizing logs, traces, metrics, and session replays. The system is architected as a monorepo with a Next.js frontend (React, Mantine, CodeMirror, Recharts), an Express.js API backend (MongoDB metadata, ClickHouse primary data store), a CLI tool (ink-based TUI), and an OpenTelemetry collector for ingestion. Key capabilities include real-time dashboards with drag-and-drop tile layout, multi-channel alerting (webhook, Slack, incident.io), advanced search with Lucene and SQL, log pattern mining (Drain algorithm), session replay, service maps, Kubernetes monitoring, and a Model Context Protocol (MCP) server that exposes observability tools to AI assistants. The platform supports authentication via local accounts or OIDC, OpAMP agent configuration, and includes an evaluation framework (hdx-eval) for benchmarking agent performance on SRE scenarios. Although the repo is primarily an application, it contains data-intensive components like the log miner and analytics query engines that cross over into data engineering territory.