Storage & compression

Keeping everything only works if storing everything is cheap and searching it stays fast. That's the job of the storage layer: a custom compression engine paired with the analyzer, writing to immutable storage you don't have to operate.

How small — and how honest

Structured, named data compresses far better than raw text. We measure it on the standard public log-parsing benchmark corpora — deliberately format-diverse, a worst case for compression — and land at about 15.8× on aggregate — 6.68 GB of benchmark logs down to 424 MB — measured the hard way: your original raw bytes in, to fully structured and searchable bytes out. Counted the way the rest of the industry usually reports it — from already-structured data — the same result is 31.4×. We lead with the raw number, because that's the real disk you save. Real production logs repeat far more, so they compress further — see how we measure.

Index everything, without the storage blow-up

Here's the part that's hard: every field is indexed, so all of it is fast to search and you never decide what to make queryable. In most engines, indexing everything explodes your storage — which is exactly why they make you choose which columns to index or how to order them, and why a fully-indexed store often ends up larger than the raw logs you fed it. We index every field and still land at those ratios. Those two pull against each other everywhere else; doing both is what we built for.

Cost is a value, not a line item

We built it this way on purpose. A featherweight agent so collection doesn't tax your nodes, and heavy compression so keeping everything doesn't tax your storage. Most of this industry quietly bills you more as your data grows; we engineered against that. Keeping all of it stays affordable — retention stops being a budget decision — and your compute and storage stay yours.

Immutable and tamper-proof

Everything lands in immutable storage. Once data is written it can't be rewritten after the fact — not even by your own engineers — which is the property an audit trail needs to be worth anything. You get a record you can prove, not just a record you have.