BERLIN · 04:21 UTC
— Platform · v4.2 Cassini

How crucible
actually works.

No magic, no marketing diagrams. One ingest layer, one columnar storage layer, one query planner. Everything else is wire format. We wrote this page the way an engineer would want to be sold to — small enough to read in one coffee, honest enough to spot the holes.

— 01 / Ingest pipeline

Wires in. Segments out.

Lossless ingest at 96 GB/s peak per region. Back-pressure-safe. Schema-on-read with optional schema-on-write.
       ┌─ your services ─────────────────────────────────────┐
       │  api · worker · cron · edge · sidecar · k8s · vm    │
       └─────────────────┬───────────────────────────────────┘
                         │  OTLP · syslog · raw TCP · HTTP · Kafka · Vector
                         ▼
       ┌─ ingest workers ──────────────────────────────────┐
       │  parse · validate · enrich · dedup · zstd · batch │
       └─────────────────┬─────────────────────────────────┘
                         │  columnar segments · 64 MB · inverted index
                         ▼
       ┌─ hot tier ─────────────────┐    ┌─ in-memory index ─┐
       │  last 7 days · NVMe        │ ←→ │ field cardinality │
       │  full-text + columnar      │    │ bloom · skiplist  │
       └─────────────────┬──────────┘    └────────────────────┘
                         │  age > 7d · tier down
                         ▼
       ┌─ cold tier · S3 · ∞ ──────────────────────────────┐
       │  your bucket · your KMS key · your egress-free    │
       └─────────────────┬─────────────────────────────────┘
                         │  tier-up on query · 1 RTT to first row
                         ▲
       ┌─ query planner ───────────────────────────────────┐
       │  prunes > 99% of partitions before touching disk  │
       └─────────────────┬─────────────────────────────────┘
                         ▼
                your dashboard · alert · API
— 02 / Storage

S3 is the database.

No proprietary block storage. No replication tax. Your bucket. Your key. Our index.
— Hot tier

Last 7 days. NVMe.

Newly ingested segments live on local NVMe of the ingest layer. Median time-to-query is 38 ms. Replicated 2× within a region for durability. The hot index keeps field cardinality, bloom filters and skiplists in RAM.

2× replicated
— Cold tier

S3. Infinite.

After 7 days, segments tier down to your own S3 bucket with your own KMS key. We don't store a copy. You pay AWS, not us. Query latency from cold is 1 RTT to first row.

$0.004 / GB · cold
— Index

Inverted + columnar.

Each field gets a Roaring-bitmap inverted index plus a columnar dictionary. The query planner uses both. 99% of partitions are skipped before the first byte is read. No full scans. Ever.

142 ms · p99 on 4.1 B rows
— Durability

11 nines. Calmly.

S3 gives us 99.999999999% durability by default. Cross-region replication is a checkbox. Audit logs of every read and write are themselves logged into a separate, write-only bucket — we cannot tamper with our own audit trail.

11 nines · durability
— 03 / Query

One language. Three dialects.

CrQL is the native pipe-style. SQL and KQL compile down to the same plan. Switch per query.

CrQL · pipe-style by default.

Built for the way operators actually read incidents — left to right, source first, filters early, aggregations last. No JOINs you didn't ask for.

Every clause is a pipe. Every pipe is observable. The planner exposes its own plan as a log-line — you can query the query.

  • summarize · group + aggregate
  • where · push-down filters
  • bin · time-bucketing
  • top / takeany · sampling
  • extend · derived columns
  • parse · regex into fields, indexed on the fly
— ex. 01 · find 5xx anomalies in last hourfrom(prod-logs) | where service=="checkout" // push-down | where status >= 500 and _time > ago(1h) | summarize n=count() by region, bin(_time, 1m) | where n > baseline(region) * 3 | top 10 by n
— ex. 02 · same query, SQL dialectSELECT region, time_bucket('1m', _time) ts, COUNT(*) n FROM prod_logs WHERE service = 'checkout' AND status >= 500 AND _time > now() - INTERVAL '1 hour' GROUP BY region, ts HAVING n > 3 * baseline(region) ORDER BY n DESC LIMIT 10;
— ex. 03 · parse, then index a new fieldfrom(prod-logs) | parse msg with "tenant={tenant_id} req={req_id}" | extend tenant_id, req_id // indexed automatically | summarize p99 = percentile(latency_ms, 99) by tenant_id | top 25 by p99
— 04 / Integrations

It speaks whatever you ship.

Twenty-four first-class formats. Zero proprietary agents. Your collector stays the way you configured it.
OpenTelemetry
— ready
vector.dev
— ready
Fluent Bit
— ready
Fluentd
— ready
Logstash
— ready
Syslog (RFC 5424)
— ready
Kafka
— ready
Redpanda
— ready
nats.io
— ready
AWS Firehose
— ready
GCP Pub/Sub
— ready
Azure EventHub
— ready
Loki API
— ready
Grafana DS
— ready
prometheus
— ready
PagerDuty
— ready
Slack alerts
— ready
Webhook
— ready
S3 import
— ready
Splunk HEC
— ready
Datadog Agent
— beta
Sentry events
— beta
Honeycomb
— beta
your wire format
— byok proto
— 05 / Security & compliance

Audited. Encrypted. Boring.

Renewed annually by an actual auditor with an actual badge. We publish the reports.
SOC 2Type II · 2024
ISO 27001certified 2023
GDPRDPA on request
HIPAABAA available
BYOKKMS / HSM
EU residencyfra · ams · stockholm
— 06 / Deploy

Self-host or managed.

Same binary. Same query plan. Same data format. Walk between them on a Wednesday.
— Self-host

One binary.
Your hardware.

  • Apache-2 OSS core · no source-available trickery
  • Single static binary · 24 MB · no JVM
  • Backed by your own S3-compatible bucket
  • Helm chart, systemd, docker, nomad, bare-metal
  • Air-gapped install · we'll never see your data
  • Pay for support if you want it · or don't
$0 / forever OSS · community support · github.com/crucible/crucible
— Crucible Cloud

One signup.
Your bucket.

  • Identical binary, managed by us
  • 23 regions · BYOC (bring-your-own-cloud) in 4
  • SLA · 99.95% · credits if we miss
  • SOC 2 · ISO · HIPAA · BAA / DPA on request
  • Audit log written to a bucket you control
  • Leave with your data, in your format, in one CLI
$0.04 / GB stored Cloud · 24/7 ops · status.crucible.dev

Try it.
It's one binary.

See pricing→ Read the changelog↗