Skip to main content

​
General

LogFleet is an open source edge log management platform for distributed systems. It collects logs at edge locations (retail stores, IoT devices, warehouses), stores them locally, extracts metrics, and streams full logs on-demand.Key differentiators:
  • Edge-first: Logs stored locally, not shipped to cloud by default
  • 100x bandwidth savings: Only metrics go to cloud, not raw logs
  • Offline capable: Works without internet connectivity
  • On-demand streaming: Full logs available when you need them
Traditional observability platforms require shipping all logs to the cloud, which is:
  • Expensive: Bandwidth costs for 20,000+ locations add up fast
  • Unreliable: No logs when internet is down (exactly when you need them)
  • Wasteful: 99% of logs are never queried
LogFleet inverts this model:
  • Store logs at the edge with automatic retention
  • Extract and ship only metrics (summaries, counts, gauges)
  • Stream full logs on-demand when debugging
This reduces bandwidth by 100x while keeping full logs accessible.
Yes! The edge agent is Apache 2.0 licensed. You can:
  • Run it on your own infrastructure
  • Modify it for your needs
  • Contribute improvements back
LogFleet Cloud (the management platform) is a commercial product with a free tier for up to 5 locations.
LogFleet is designed for distributed deployments with hundreds to tens of thousands of locations. The architecture is inspired by production systems handling:
  • 20,000+ edge locations
  • Millions of transactions per day
  • Global retail and restaurant operations
For smaller deployments (fewer than 5 locations), the open source version is free.

​
Technical

The edge agent consists of:
  • Vector: High-performance log collector and transformer
  • Loki: Horizontally-scalable log storage with LogQL
  • Control Plane: Manages streaming, config sync, and health
All components run as containers on your edge device.
Minimum per edge location:
  • CPU: 2 cores (Intel Core i5 or equivalent)
  • RAM: 4GB (8GB recommended)
  • Storage: 50GB SSD (scales with retention period)
  • Network: Intermittent internet connectivity
For production deployments, we recommend a 3-node Kubernetes cluster per location.
When internet connectivity is lost:
  1. Logs continue to be collected and stored locally
  2. Metrics are buffered in Vector’s disk buffer
  3. When connectivity returns, metrics are forwarded automatically
  4. No manual intervention required
The edge agent is designed to operate indefinitely without cloud connectivity.
Configurable from 1-30 days, with automatic rotation. Loki’s compactor enforces retention limits, implementing ring-buffer semantics where oldest logs are deleted when storage fills.Default: 7 days
Vector supports 100+ sources including:
  • Syslog (RFC 3164, RFC 5424)
  • JSON logs
  • Docker/Kubernetes logs
  • File-based logs (any format with regex parsing)
  • HTTP endpoints
  • And many more
Yes! Each edge location runs a full Loki instance. You can query directly:
curl -G "http://localhost:3100/loki/api/v1/query_range" \
  --data-urlencode 'query={job="myapp"}' \
  --data-urlencode 'limit=100'
Or use Grafana connected to local Loki for a UI experience.
Use Vector’s log_to_metric transform. Example:
transforms:
  my_metrics:
    type: log_to_metric
    inputs: ["my_logs"]
    metrics:
      - type: counter
        field: status
        name: http_requests_total
        tags:
          status: "{{status}}"
See Custom Metrics for detailed examples.

​
Security

  • In transit: All API communication uses TLS 1.3
  • At rest: Loki data can be encrypted with filesystem encryption
  • API keys: Stored hashed, never in plaintext
  • JWT tokens: Short-lived with secure signing
See Security for full details.
LogFleet uses Tailscale for zero-trust remote access:
  • No exposed ports on edge devices
  • Mesh VPN with WireGuard encryption
  • Identity-based access control
  • Audit logging of all access
You can query any location securely without VPN concentrators or port forwarding.
LogFleet Cloud is pursuing SOC 2 Type II certification. The self-hosted edge agent inherits your existing compliance posture.For enterprise compliance requirements, contact us.

​
Pricing & Licensing

  • Up to 5 edge locations
  • Full edge agent functionality
  • Community support via GitHub
  • No credit card required
Perfect for small deployments and evaluation.
You pay per edge location (site, store, device cluster), not per log volume. This makes costs predictable regardless of log volume.
  • Pro: $99/location/month (6-100 locations)
  • Enterprise: Volume discounts for 100+ locations
View pricing
Yes! The edge agent is fully open source. You can:
  • Run unlimited edge agents
  • Build your own management plane
  • Never connect to LogFleet Cloud
LogFleet Cloud provides convenience (fleet management, dashboards, alerting) but is not required.

​
Getting Started

  1. Clone the repo: git clone https://github.com/logfleet/logfleet.git
  2. Start locally: cd deploy/docker && docker-compose up -d
  3. Send test logs: curl -X POST http://localhost:8080 -d '{"message": "Hello!"}'
See Quickstart for the full guide.
  • Local testing: 5 minutes
  • Single edge location: 15-30 minutes
  • Production fleet: Varies by scale and automation
The edge agent is a single docker-compose up command.