Ok, I posted this here a few months back and it didn't go well. I gathered the feedback, and the fair part of it was that I never explained why I built this or how it compares to what everyone already runs, so it read like just another "self-promotion, vibe-coded over a weekend" post. Trying again.

I have a fleet of IoT devices (very cool robotic hives) writing messy, unstructured logs, and I needed something that can store and search years of it. What I ended up looking for was a real inverted index, long retention that doesn't cost a fortune, fast needle-in-a-haystack search, and something one person can run and manage.

Why not Loki: Loki indexes labels, not log content. Search for anything outside your labels and it slows down a lot. Fine when you know which stream you want. Less fine when you don't, which is most of my searches.

Why not ELK: It does full text search well, no argument there. But it's a lot of moving parts for one person: nodes, shards, heap, ILM. I didn't want that to become my second job. To put it simple: it felt too heavy for my needs.

Why not VictoriaLogs: I like it, and I run it for different purpose. It stores on local disk though, and object storage is on their roadmap but not shipped, so retention still means paying for EBS. Otherwise a great tool and you can happily point it at your logs.

On the other hand, this amazing tool - Quickwit - does what I needed. Proper inverted index, and the index files live in object storage, so queries read straight from the bucket. Mine is around 100GB a day of raw logs, compressing about 5.5x, kept for 24 months, and S3 comes to roughly $300 a month.

So why I built Rootprint?

Quickwit ships an API with very basic UI. I ran it behind Grafana's Quickwit plugin for a while and that plugin gives you search and not much else. My team works with these logs every day, so I built the layer above it:

• log search with a field sidebar, click-to-filter and a histogram
• saved views that remember query, filters, sort and columns
• configurable context around a log line, plus a traceback tab for stack traces
• OTel traces next to the logs, basic APM based on spans
• ingest over OTLP or HTTP NDJSON, or pull from Kafka, Kinesis and SQS/S3
• roles, scoped ingest keys, Google and GitHub login
• indexes, mappings, field config and retention from the UI

It's built around OTel, but most of the features works also with custom-shaped data.

What it's not: no metrics. This is logs and traces only, so for metric dashboards and alerting you still need something else next to it.

Demo with real data: https://demo.rootprint.io

Code, Apache 2.0: https://github.com/rootprint/rootprint

Tech-stack: Bun and Hono on the API, SvelteKit for the UI, Postgres for metadata, Quickwit for search.

Fair warning: I'm a solo developer on this, with QA from my team, so expect bugs, rough edges and some clunky UI. Open a GitHub issue and I'll look at it. I'm not claiming parity with Grafana, VictoriaLogs or ELK. It's just a passion project after 8+ years of doing strict infrastructure work and getting a bit tired of it :)

On AI, since it came up last time: Claude Code wrote some parts of the project and I've been refactoring them constantly. It also does a first review pass on my code and some general reviews. The core logic and architecture is mine, mostly written by hand. Feel free to call it AI-assisted, because that's what it is.