CoreWatch
v2025.01
CoreWatch is the observability platform built for the engineers who get paged at 3am. One binary, one query layer, one on-call workflow — no proprietary agents, no fork of your telemetry pipeline.
A scannable index of the four jobs CoreWatch owns end-to-end. Read top-to-bottom, or jump to the deep-dive that matters to you.
OTLP/HTTP and OTLP/gRPC at line rate. OpenTelemetry-native — no proprietary agents, no sidecar lock-in. Backpressure, retries, and per-tenant quota are first-class.
Read the deep-dive →A SQL-fluent DSL over traces, metrics, and logs. Columnar Adaptive Index returns aggregate queries in milliseconds against the full 30-day hot window.
See query + alerting →Composite signal alerts with burn-rate windows, auto-grouped incidents, and native routing into PagerDuty, Slack, and Opsgenie. No double-paging across two tools.
Walk through the workflow →Editable as code, versioned in Git, rendered from the same query layer. No second dashboard engine, no broken tiles the morning after a deploy.
See the data sources →Three numbers staff engineers ask about first: where the data comes from, how fast it goes in, and what it costs at the node. Here they are.
CoreWatch speaks OTLP natively — gRPC and HTTP — so the OpenTelemetry Collector, the language SDKs, and any community exporter work out of the box. We never ask you to install our agent, and we will never ship one.
A custom columnar store adapted on a per-tenant basis — high-cardinality service tags, trace IDs, and HTTP routes stay indexed without exploding storage. One commodity node sustains 11.4M spans/sec sustained ingest.
Across 600+ production customers in our Q4 2024 benchmark, CoreWatch cut observability spend by an average of $214,000/year versus equivalent Datadog, New Relic, or Dynatrace deployments. The numbers come from invoices, not modeled projections.
OpenTelemetry-compatible receivers for the stack you ship today. Anything we do not list here, you can ship via the OTLP endpoint or the Observe SDK.
Plus 140+ community OpenTelemetry receivers, ingested as-is. See who is running this in production →
The query layer is where you investigate. Alerting is where it wakes you up. CoreWatch keeps both on the same data model, so what you query at 9am is what pages you at 3am.
The CoreWatch query language reads like SQL with first-class trace semantics. SELECT p95(duration) FROM spans WHERE service.namespace = 'checkout' AND http.route = '/pay' LAST 6h is a complete query. Subqueries, joins across signals, and time-shifted comparisons all work without a separate metrics engine.
Alerts are the same DSL, scoped to a burn-rate window. Composite signal alerts combine error rate, latency, and saturation so you stop getting paged three times for one incident. Routing is native into PagerDuty, Opsgenie, and Slack — no webhook plumbing in the middle.
The Observe SDK has been on PyPI since 2021. 4.2M+ monthly downloads. One decorator, one tracer, one less thing to write yourself at 2am.
# CoreWatch · Observe SDK from observe import tracer, span from opentelemetry import context @span("charge_card", kind="server") def charge_card(customer_id: str, amount_cents: int) -> dict: with tracer.start_as_current_span("stripe.authorize") as s: s.set_attribute("stripe.amount_cents", amount_cents) s.set_attribute("customer.id", customer_id) result = stripe.authorize(customer_id, amount_cents) with tracer.start_as_current_span("ledger.write") as s: s.set_attribute("ledger.entry_id", result["entry"]) ledger.write(result) return {"status": "ok", "entry": result["entry"]}
pip install observe · OpenTelemetry-compatible · no proprietary agent required.