Search, dashboard, and alert from one binary
tplx ingests, indexes, and searches your logs and events, with dashboards, alerting, RBAC, and SSO built in — all from a single Rust binary with no external database required.
# find slow checkout requests in the last hour, by service
index=prod_web datatype=access_log path="/checkout*"
| eval duration_ms = response_time * 1000
| where duration_ms > 800
| stats count, avg(duration_ms) by service
| sort -countEverything an observability stack needs, none of the sprawl
One deployable, covering ingest through alerting.
Automatic onboarding
Point tplx at your data and it's indexed — datatypes and field templates are inferred automatically, with every field indexed by default. No schema to model up front.
A real query language
A pipe-based search language with dozens of commands — eval, stats, join, lookups, field extraction — for ad hoc investigation, not just filters.
3× faster searches, vs competitors
In head-to-head testing across 32 real-world data sources, tplx searched 3× faster than a leading competing platform on average (geometric mean across 191 queries) — and over 10× faster on aggregation-style searches.
Half the storage, vs competitors
In the same benchmark, tplx used 49% of the storage of a leading competing platform on average — less to buy, less to pay for every month.
Dashboards & reports
Build dashboards from saved searches, version them, export to PDF, and share across teams.
Alerting
Schedule searches on a cron, throttle noisy conditions, and keep a fire history for every alert that triggered.
RBAC & SSO
Role-based access control and single sign-on out of the box — no bolt-on auth proxy required.
Admin & audit
Manage users, roles, indexes, and datatypes from the UI, with an audit trail of who changed what.
Knowledge objects
Macros, event types, tags, lookups, and field extractions let teams encode institutional knowledge into search.
Monitoring built in
Watch the platform's own health — ingest lag, index size, job queues — from the same interface you search in.
Nothing else to run
One binary, embedded database and session store included — nothing extra to install or operate.
REST API
Everything in the UI — search, dashboards, admin — is backed by a REST API, so ingestion and reporting script cleanly into existing tooling.
From raw event to answered question
The same path every search takes, start to finish.
Ingest
Stream or batch logs and events in, tagged with index and datatype.
Index
Events land in a compact on-disk format built for fast range scans.
Search
Query with a pipe-based language purpose-built for exploring event data.
Act
Turn a search into a dashboard panel, a scheduled alert, or a shared report.