Ask your logs questions in plain English. Get automatic root cause analysis the moment an alert fires. Run every AI feature on a local model inside your own network. One self-contained appliance — no SaaS, no data leaving the building.
Whether it's the bill, the operational burden, or a compliance requirement — most teams are stuck with a tool that wasn't built for how they actually work.
Volume-based licensing means your bill grows every time your infrastructure does. Mid-market teams regularly spend hundreds of thousands per year just on log ingestion — before any analytics or AI features.
Self-managed open-source stacks were not designed to run themselves. Tuning, scaling, upgrades, and incident recovery often consume one or more full-time engineers to keep the observability platform alive.
For regulated industries, sending logs to a cloud platform is a compliance failure before any investigation begins. The answer can't be "don't use AI" — it has to be an on-prem platform that has AI built in.
Keel is a self-contained appliance — not a collection of open-source tools to wire together. Import the VM image, complete the setup wizard, and start querying your logs.
Keel is priced per appliance, not per gigabyte of ingest. As your log volume grows, your Keel bill stays flat. Teams migrating from volume-based platforms typically see 80–90% cost reductions.
Keel generates all secrets on first boot and requires no phone-home to operate. Logs, queries, and AI inference all stay inside your perimeter — including in fully air-gapped environments.
Search in plain English. Ask any question and Keel translates it into a query and runs it — or write the query directly. Both in the same window.
Automatic root cause analysis. When an alert fires, Keel investigates automatically — it searches the surrounding logs, reads your runbooks, and delivers a root cause in plain English to Slack or PagerDuty. No analyst needed.
Fully on-prem AI. Every AI feature runs on a local model inside your network. No API calls to external services — not even for RCA. For regulated teams, this is the only viable option.
Four steps from raw log data to answered questions and resolved incidents.
Your logs arrive over open standards — no proprietary forwarder required.
Logs are compressed and indexed for fast, cost-efficient search at any retention length.
Search in plain English or write a query directly — results in milliseconds either way.
Alert fires → Keel automatically investigates → root cause delivered to your team in plain English. No manual triage required.
Everything ships in the VM image — no add-ons, no separate clusters to run, no plugins to maintain.
The moment an alert fires, Keel automatically investigates — it searches the surrounding logs, reads your uploaded runbooks and infrastructure docs, and delivers a root cause analysis in plain English to Slack, PagerDuty, or email. No analyst required. No manual triage.
Ask your logs any question — "show all errors from the payment service in the last two hours" — and Keel translates it into a query and runs it instantly. Power users can also write queries directly. Both modes live in the same window.
Upload your runbooks, architecture diagrams, and SOPs. Keel's AI reads them automatically during every RCA — so the root cause analysis references your own documentation, not generic advice. The same knowledge base powers a conversational assistant you can query directly at any time.
OTLP gRPC and HTTP, syslog, and Fluentd out of the box — plus connectors for AWS, Azure, GCP, Datadog, Grafana, Prometheus, PagerDuty, and generic webhooks. No proprietary forwarder lock-in.
Configurable processing rules per source — parse, filter, enrich, and route logs before they're stored. Per-source isolation means adding or removing a source doesn't disrupt other ingest streams.
Define alert rules on your log data. Firing alerts create incidents with a full timeline and linked log entries. Notifications route to Slack, PagerDuty, email, SNMP traps, or any webhook.
3-node HA cluster — if a node fails, the remaining nodes continue serving ingest and search without manual intervention. Designed for stability in regulated environments where the observability platform itself cannot go down.
Role-based access control with teams and roles. SAML/OIDC single sign-on, multi-factor authentication, full audit logging, and TLS/SSL management — all managed from the dashboard.
Guided first-run setup wizard, in-place upgrades and patching, backup and restore, network and storage administration — all from the web dashboard. No SSH required for routine operations.
Every AI feature in Keel — natural language search, automatic RCA, and the knowledge assistant — can run on a local LLM hosted entirely within your network. Connect any OpenAI-compatible endpoint: Ollama, vLLM, or any self-hosted model. For regulated teams, this means no AI data ever leaves the building — not even a single API call to an external service.
Keel wins on cost and data sovereignty. There are areas where larger, mature platforms still lead — we'd rather you know that upfront than find out during a POC.
| Capability | Keel | Splunk | Elastic / ELK | Datadog | OSS ClickHouse tools |
|---|---|---|---|---|---|
| On-prem / air-gap ready | ✓ Built for it | ⚠ Heavy setup | ✓ Yes | ✗ SaaS only | ✓ Yes |
| Cost per TB of logs | ✓ Low | ✗ High | ⚠ Storage-heavy | ✗ High | ✓ Low |
| Packaged appliance + HA | ✓ One VM image | ⚠ Multi-tier | ⚠ DIY | n/a | ⚠ DIY |
| AI / natural-language query | ✓ Native | ⚠ Add-on | ⚠ Limited | ⚠ Add-on | ⚠ Varies |
| OpenTelemetry-native | ✓ Yes | ⚠ Partial | ✓ Yes | ✓ Yes | ✓ Yes |
| SSO / RBAC / audit | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ⚠ Varies |
⚠ = available with caveats or additional cost · ✗ = not available
Keel is delivered as a pre-configured appliance image for all major hypervisors. Import, power on, and complete the guided setup wizard — our team handles the initial configuration during your POC.
Deploy the OVA via File → Deploy OVF Template. Minimum 4 vCPU, 8 GB RAM, 100 GB disk. Separate data volume recommended for log storage.
Import the VHDX via New Virtual Machine → Use existing virtual hard disk. Generation 2, 8 GB RAM minimum. Attach to your existing virtual network.
Import the QCOW2 image and define the VM via virt-install or the Proxmox UI. Same minimum spec applies.
No internet access required after setup. For fully isolated environments, Keel can be delivered on USB or via secure transfer — no dependency on any external registry or CDN.
One flat annual license per appliance. The only difference between plans is how much data you ingest per day — every feature is included at every tier.
All plans billed annually · 30-day guided POC included — full-feature license, we handle setup · Sign up →
We deploy Keel inside your network, connect your log sources, and walk your team through the platform. You get a full-feature 30-day license for the duration — no commitment, no credit card, nothing to cancel if it's not the right fit.
We'll be in touch within 1 business day. In the meantime, email us at [email protected].