Observability without
the invoice shock.
Logs, metrics and traces in one hosted platform — priced so you can afford to keep the data you actually need when something breaks at 3am.
Free tier, no card required. Point an OTLP exporter at us and you're done.
The problem
You're sampling away the data you need.
Ingest-priced observability quietly turns every debug log into a line item, so teams turn logging down — and then an incident arrives and the evidence isn't there.
The bill grows with your traffic
A good quarter becomes a budget conversation. Per-gigabyte pricing means success is indistinguishable from cost overrun, and the only lever anyone reaches for is retention.
So you sample, and lose the tail
Head-based sampling drops exactly the rare request you'll be asked about. The p99 you need to explain is the one that got discarded on the way in.
Or you self-host and pay in people
Running Loki, Mimir and Tempo yourself is cheap on paper and expensive in on-call. Three stateful systems is three things to shard, upgrade and get paged about.
Whale is built on one columnar store instead of several specialised ones, which is structurally cheaper to operate — and we price accordingly rather than to what the market will bear. Keep full-fidelity data and stop rationing it.
Getting started
Change one endpoint. Keep everything else.
Whale speaks OpenTelemetry (OTLP) natively. If you already emit OpenTelemetry, this is a config change — not a re-instrumentation project.
exporters: otlphttp/whale: endpoint: https://ingest.whale.balajitech.xyz headers: x-api-key: ${env:WHALE_API_KEY}
# environment variables, nothing else changes OTEL_EXPORTER_OTLP_ENDPOINT=https://ingest.whale.balajitech.xyz OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf OTEL_EXPORTER_OTLP_HEADERS=x-api-key=$WHALE_API_KEY
What you get
A whole platform, on day one.
Not a log viewer with a roadmap. Every one of these ships today — not a promise on a slide.
The one-request view
The reason the three signals share a store. Follow a trace into a span waterfall with its correlated logs and the service metrics around it — one click, not three tabs.
Search that reads like a sentence
service:api severity>=ERROR body:"timeout" | last 1h — with a severity histogram and a live tail that streams as it happens.
Golden signals & Apdex
Throughput, error rate, p50/p95/p99 and Apdex per service, plus a dependency map built from your trace topology rather than a config file you have to maintain.
Error tracking
Errors grouped into issues with counts, first and last seen, and the traces behind them. The Sentry-shaped view, over telemetry you're already sending.
Service levels
SLOs with error budgets and burn rate, so you can answer "are we still allowed to ship?" with a number instead of a feeling.
Alerts & uptime
Threshold rules to Slack and webhooks with firing/resolved dedup, HTTP and TCP uptime checks, and a public status page you can point customers at.
Dashboards that stay fast
Rollups are selected automatically by query range, so a 30-day chart doesn't scan thirty days of raw points and time out on you.
AI where it helps
Ask in plain English, get the query. Explain an error against its correlated context. Surface metric anomalies you didn't think to alert on.
Apps and teams
Group services into apps, invite your team, and keep staging noise out of the view you use during an incident.
Servers, down to the process
One command installs whale-agent, a pinned OpenTelemetry Collector. Each host reports CPU, memory, disks and network, its busiest processes, its Docker containers, and any log files you name.
Your AWS account, mapped and audited
Connect with a read-only key. Whale pulls CloudWatch metrics and draws the account as a network — VPCs, zones and subnets, with every load balancer, instance and database where it sits — then audits it against 30-plus checks: public buckets, open ports, IAM and MFA gaps, expired certificates, missing encryption and backups, and idle resources costing money. Read-only — it never changes a thing.
Cloud security, built in
An audit of your AWS account, not just a dashboard of it.
The same read-only connection that draws the map also checks the account against 30-plus rules across 17 services — the posture review most observability tools leave to a separate security product. Read-only: it discovers and reports, and never modifies, stops or deletes anything. The AWS map and audit are on the Scale plan.
Public exposure
Buckets open to the world, databases with a public IP, security groups and network ACLs that allow 0.0.0.0/0 on SSH, RDP or a database port, load balancers with no WAF, and publicly shared machine images.
IAM & access
Root users without MFA, root access keys that should not exist, console users missing MFA, and access keys that are old or have gone unused — the findings a CIS review opens with.
Encryption & logging
Unencrypted volumes, databases and buckets; CloudTrail that isn't logging, is single-region or unencrypted; and log groups with no retention. The controls auditors ask for first.
Backups & resilience
Databases with automated backups off or deletion protection missing, DynamoDB tables with no point-in-time recovery, and expired or soon-to-expire certificates still in use.
Cost you're not using
Unattached volumes and Elastic IPs, orphaned and year-old snapshots, and log groups that keep data forever — the quiet line items on the bill, surfaced next to the security ones.
Every finding, explained
Severity and confidence, the evidence behind it, why it matters, how to fix it, and a deep link straight to the resource in the AWS console. Filter, assign, dismiss or suppress, and export the lot to CSV, JSON or a printable report.
Under the hood
Why we can charge less.
One columnar store holds every signal. That's not a detail — it's the entire reason the economics work differently, and it's why correlation is a join rather than an integration.
Pricing
Priced on events, not surprises.
You're metered on events — one log line, one metric point, or one span. Watch the count live in your dashboard before you commit to anything.
Plans are billed monthly or yearly. Overage billing isn't switched on yet, so going past your plan's events costs nothing extra today.
The fine print
Things you'll ask before you send us data.
Stop rationing your telemetry.
Free tier, no card, and your existing OpenTelemetry setup works unchanged.