One appliance in your cloud or datacenter. Ask your logs anything in plain English, get root cause the moment an alert fires, and bring the AI model you trust. Flat annual price; your log data stays with you.
No install, no signup. Prefer to talk? Book 30 minutes · Brochure (PDF)
A 30-second look at Keel.
Prefer hands-on? Try the live demo → · Watch the full walkthrough →
The bill, the operational burden, or a compliance line — most teams are stuck with a tool built for a different era.
Volume-based licensing grows your bill every time your infrastructure does. You pay more for ingestion alone, before any analytics or AI.
Self-managed open-source stacks weren't designed to run themselves. Tuning, scaling, upgrades and recovery can tie up a full-time engineer just to keep it alive.
Shipping logs to a vendor cloud is a compliance failure before any investigation begins. The answer isn't "skip the AI" — it's a platform you run yourself, with AI built in.
Keel is a self-contained appliance — not a collection of open-source tools to wire together. Import the VM image, complete the setup wizard, and start querying your logs.
Keel is priced per appliance, not per gigabyte of ingest. As your log volume grows, your Keel bill stays flat. Compared with volume-based list pricing at the same ingest, Keel is typically 80–90% lower — estimate your savings →
All ingest, storage, search, and dashboards run on infrastructure you own — nothing goes to an Infranexis service, and Keel needs no phone-home to operate. Residency and sovereignty by architecture, not by a policy promise. For fully isolated sites, Keel can run air-gapped with nothing leaving the network at all.
Keel ships no bundled model. Point it at your own Anthropic, OpenAI, or Google Gemini key, any OpenAI-compatible endpoint, or a fully local model — with automatic failover. When AI runs, only the context for that request leaves, to the endpoint you control; run local and nothing leaves at all.
Explore the AI in Keel →
Four steps from raw log data to answered questions and resolved incidents.
Any logs, IT or OT — apps, servers, network & security gear, and industrial (OT/ICS) systems — over open standards, no proprietary forwarder.
Logs are compressed and indexed for fast, cost-efficient search at any retention length.
Ask Keel anything in plain English — get an answer, save it, pin it to a dashboard, or drop to read-only SQL.
Alert fires → Keel automatically investigates → root cause delivered to your team in plain English. No manual triage required.
Everything ships in the VM image — no add-ons, no separate clusters to run, no plugins to maintain.
When an incident fires, Keel investigates on its own — correlating surrounding logs and reading your runbooks — and delivers a plain-English root cause to Slack, PagerDuty, or email. No manual triage.
Ask your logs any question in plain English and Keel answers — a result, a chart, or a summary. Save what you ask and pin it to a dashboard; power users can drop to read-only SQL.
Connect your own AI agents — Claude, Cursor, your own — to your logs and Keel's intelligence over MCP. Read-only and scoped: they investigate but never change anything, and run inside your network, so your logs never reach a vendor cloud.
Upload your runbooks and SOPs; Keel grounds every RCA in them, not generic advice. The same knowledge base powers a chat assistant that investigates in plain English and can take actions — which it asks you to confirm first.
Applications, servers, containers, network and security appliances, and OT/ICS systems (which speak syslog) — all over OTLP (gRPC/HTTP), syslog, and Fluentd, plus connectors for AWS, Azure, GCP, Datadog, Grafana, Prometheus, PagerDuty, and generic webhooks. No proprietary forwarder lock-in.
Configurable processing rules per source — parse, filter, enrich, and route logs before they're stored. Per-source isolation means adding or removing a source doesn't disrupt other ingest streams.
Define alert rules on your log data. Firing alerts create incidents with a full timeline and linked log entries. Notifications route to Slack, PagerDuty, email, SNMP traps, or any webhook.
3-node HA cluster — if a node fails, the rest keep serving ingest and search without manual intervention. Built for environments where the platform itself cannot go down.
Role-based access control with teams and roles. Single sign-on via LDAP/RADIUS, SAML, and OIDC, multi-factor authentication, audit logging of mutating actions, and TLS/SSL management — all managed from the dashboard.
Guided first-run setup wizard, in-place upgrades and patching, backup and restore, network and storage administration — all from the web dashboard. No SSH required for routine operations.
Point Keel at the AI you trust: your own Anthropic, OpenAI, or Gemini key, any OpenAI-compatible endpoint, or a local model — with failover. Only a request's context leaves, to the endpoint you control; run local and nothing leaves at all.
Keel wins on cost and data sovereignty. There are areas where larger, mature platforms still lead — we'd rather you know that upfront than find out during a POC.
| Capability | Keel | Splunk | Elastic / ELK | Datadog | OSS (SigNoz / HyperDX) |
|---|---|---|---|---|---|
| Runs on infrastructure you own (cloud or on-prem) | ✓ Built for it | ⚠ Heavy setup | ✓ Yes | ✗ SaaS only | ✓ Yes |
| Cost per TB of logs | ✓ Low | ✗ High | ⚠ Storage-heavy | ✗ High | ✓ Low |
| Packaged appliance + HA | ✓ One VM image | ⚠ Multi-tier | ⚠ DIY | ✗ SaaS only | ⚠ DIY |
| Ask anything + auto RCA | ✓ Native | ⚠ Cloud / add-on | ⚠ Limited | ⚠ SaaS-hosted | ⚠ Varies |
| OpenTelemetry-native | ✓ Yes | ⚠ Partial | ✓ Yes | ✓ Yes | ✓ Yes |
| SSO / RBAC / audit | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ⚠ Varies |
⚠ = available with caveats or additional cost · ✗ = not available · Last reviewed Oct 2026
Full Keel vs Splunk comparison → · Full Keel vs ELK comparison → · Calculate your savings →
A pre-configured appliance image for every major hypervisor and private cloud. Import, power on, run the setup wizard — our team handles the initial configuration during your POC. Step-by-step install is in the deployment docs.
Deploy the OVA via Deploy OVF Template. Add a separate data volume for log storage.
Run Keel in your own cloud account — single-tenant in your VPC. Import the VM image today; marketplace images are on the roadmap. (Hyper-V VHDX too.)
Import the QCOW2 image via virt-install or the Proxmox UI.
The QCOW2 image boots on OpenStack (Glance/Nova) and OpenShift Virtualization (KubeVirt/CDI). Built for sovereign cloud estates.
No internet needed after setup. For isolated sites, Keel ships on USB or secure transfer — no external registry or CDN.
Every analytics and AI feature is included at every tier. A 3-node HA cluster is included on Business and Enterprise. The only other difference between plans is how much data you ingest per day.
All plans billed annually · 30-day guided POC included — full-feature license, we handle setup · Already a customer? Log in →
We deploy Keel inside your network, connect your log sources, and walk your team through the platform. You get a full-feature 30-day license for the duration — no commitment, no credit card, nothing to cancel if it's not the right fit.
Want to look around first? Open the live demo →
We'll be in touch within 1 business day. Prefer to talk sooner? Book a 30-min walkthrough → — or email [email protected].