The observability
platform that drives itself.
One Elixir-powered platform for metrics, traces, logs, RUM, synthetics, infrastructure, incidents, and security findings. Funnel auto-discovers your services, suggests SLOs, opens incidents on critical fires, and writes a first-draft postmortem — so your team can focus on shipping.
One platform. One time-range. Same alert.
Metrics, traces, and logs ingest through the same OTLP endpoint, query the same database, and surface in the same LiveView. No bouncing between vendors.
Time-bucketed aggregations (avg, sum, p50/p95/p99, rate). Group-by attribute, filter by service. Live forecast band with Holt-Winters.
Span tree visualization with flame graphs. Auto-computed service map from parent/child span service edges. Click any operation to drill in.
Full-text search with PostgreSQL tsvector. Severity filtering. Real-time tail as logs arrive. Click any row for full attribute drawer.
Funnel does the chores.
Most observability tools force you to register services, write alert rules, file incidents, and tag every metric by hand. Funnel auto-discovers, auto-tags, auto-suggests, and auto-summarises — leaving humans for the decisions that actually matter.
First time a service.name is seen on a metric or span, it's registered in the Software Catalog as auto + needs-owner. Someone claims it later.
Five-step checklist on the project dashboard. Each step flips green as data arrives. No setup wizard to fight.
A change in deployment.version on incoming spans automatically writes a deploy marker. Drawn as vertical lines on every metric chart.
WatchEagle shows live EWMA baselines (μ, σ). One click turns any baseline into a 3σ anomaly rule that auto-opens incidents on fire.
A critical alert auto-opens an incident. 60 s later an AI postmortem cites recent deploys and error spikes. Cooldown prevents storms.
A 6-hourly worker reads 30 days of spans per service and proposes a realistic SLO target snapped to 99.9 / 99.5 / 99.0. One click applies it.
Every metric / span / log gets tier and owner_team stamped from the Catalog in 1 µs via ETS cache. Group-by ownership without manual tagging.
SIEM / SCA / secret-scanner repeats of the same external_id upsert instead of inserting duplicates. seen_count bumps; severity escalates.
More than metrics
Eighteen Datadog-class surfaces, one product. Each one is real, queryable, and wired into the same alert pipeline.
Auto-discovered hosts and containers from a single /v1/hosts/heartbeat endpoint. CPU, memory, disk, GPU gauges.
Drop-in browser SDK (~5 KB) captures LCP / FCP / TTFB and unhandled errors via navigator.sendBeacon.
HTTP GET/POST with status, latency, and body-regex assertions. Cron-driven via Oban. Alert on N consecutive failures.
Open / acknowledge / resolve with a timeline of comments and status changes. Auto-created from critical alerts.
Services with owners, on-call URLs, repo links, tier, dependencies, and SLO targets. Backbone of every automation.
Daily roll-ups by resource kind, service, team, region. Auto-attributed to a catalog service via service.name match.
Four security pillars in one findings table. Source discriminator + dedupe on external_id. Severity escalates over time.
Dedicated anomaly view. Live baselines update every minute. Holt-Winters forecast preview per metric. One-click rule promotion.
Project-aware LLM gateway. Anthropic / OpenAI / Echo providers. Per-call cost, monthly budget, rate-limit. Powers AI postmortems.
Production-grade by default
Token-bucket rate-limit per key. Scope-locked tokens. Read API at /api/v1 mirrors the write API at /v1.
14 named scopes (ingest:*, read:*, ai:chat). Bearer auth, bcrypt-hashed. Audit log for every key issuance and revoke.
Threshold, error-rate, anomaly, log-pattern, synthetic-failure. HMAC-signed delivery via Oban with retries.
Auto-detected from telemetry, or POST /v1/deployments from CI. Renders on every chart so you can see before/after instantly.
Drop-in /metrics endpoint compatible with any Prometheus scraper. Project-scoped via Bearer auth.
libcluster Gossip strategy for dev. Phoenix PubSub fans out across nodes. Ingestion shards by project_id.
From first packet to first incident — without touching a knob
Point OTLP at /v1
Send metrics / traces / logs from any OpenTelemetry SDK over HTTP+JSON or gRPC. Bearer-auth a project token, choose scopes, done.
$ curl -X POST funnel/v1/metrics \
-H "Authorization: Bearer st_..." \
-d @batch.json
Funnel infers the rest
Services auto-register. Ownership tags propagate to every datapoint. Deploy markers appear on every chart. Onboarding checklist self-checks. You did nothing.
- ✓ Service registered (tier3, needs-owner)
- ✓ tier + owner_team stamped on telemetry
- ✓ Deploy v1.2.4 marker written
Wake to a postmortem stub
Anomaly breaches threshold. Alert fires. Incident auto-opens. AI writes: "Likely cause: recent deploy of api-svc to v1.2.4". You read 3 lines, decide rollback, sleep again.
Likely cause: deploy of v1.2.4 at 14:17.
Next steps: roll back or investigate hot path.
Stop wiring observability. Start using it.
Create a project, drop in an API key, point your SDK at /v1. Auto-discovery, auto-tagging, auto-incidents, and AI postmortems are on by default.