Skip to content

What is Keel?

Keel is a self-hosted appliance — you run it on your own infrastructure, cloud or on-prem — for log analytics, observability, and AI-assisted root-cause analysis. The log data plane — ingest, storage, search, and dashboards — runs entirely on infrastructure you own — your own cloud or your datacenter — and nothing is sent to an Infranexis service. For AI, Keel uses a model you configure: the relevant context for a given request goes only to that endpoint, or — with a local model — nothing leaves your network at all.

You deploy Keel as a virtual machine on your own hypervisor (VMware, Hyper-V, KVM/Proxmox, or compatible). It ingests logs and alerts from your systems, stores and indexes them, evaluates alert rules, and uses a Large Language Model (LLM) you control to explain incidents and suggest remediations.

Who it's for

Teams that need modern observability and AI incident analysis but cannot send their data to a SaaS — because of data-residency rules, air-gapped or regulated environments, security policy, or cost. Keel gives you the AI-RCA experience of a cloud platform while your log data stays on infrastructure you own — and, for isolated sites, with a local model so nothing leaves the network.

AI-native from the home screen

Keel's landing page is a plain-English console: an Ask Keel anything bar backed by Platform Intelligence. Ask "why did checkout-api error?" and Keel investigates, answers with the underlying logs as proof, and — with your confirmation — can even make the change. Every configuration change is confirmed, RBAC-scoped, and audited.

  • Ask — Platform Intelligence gives you a briefing at sign-in and answers questions in plain English; Explore turns a question into a chart with Dynamic Charts with AI alongside curated dashboards.
  • Automatic RCA — turn alerts into incidents and get an AI Root Cause Analysis — root cause, timeline, affected services, log evidence, and remediation — grounded in your logs and your uploaded runbooks. See Incidents & RCA.
  • Bring your own model — the AI runs on the endpoint you configure: a local model (Ollama, air-gapped), or your own Anthropic / OpenAI / Gemini / OpenAI-compatible key. See LLM Configuration.
  • Connect your own agents — the read-only MCP server lets Claude, Cursor, or your own agent query Keel, scoped and rate-limited per key.

What else it does

  • Ingest logs over OpenTelemetry (OTLP), Syslog, and Fluentd; receive alerts from Alertmanager, Datadog, PagerDuty, and generic webhooks.
  • Parse heterogeneous logs into fields in the log pipeline.
  • Store & tier logs in a built-in column store, with hot local storage and optional cheaper S3-compatible cold storage by retention class.
  • Search with a fast log browser, live tail, and read-only SQL.
  • Ground answers on your own runbooks and post-mortems via the RAG Context knowledge base.
  • Forward & report — send processed logs onward to other systems; export professional PDF/CSV reports; expose logs read-only to Grafana/Metabase/Superset via the BI Connector.

Why self-hosted

  • Data residency & privacy — your log data is never sent to Infranexis or any SaaS backend. AI uses only the model endpoint you configure — a local model (e.g. Ollama) so nothing leaves at all, or your own Anthropic/OpenAI(-compatible) key.
  • Works in restricted networks — including air-gapped, with offline licensing.
  • Predictable cost — a licensed appliance, not per-GB SaaS billing.

How you get it

Keel is delivered 100% digitally as a downloadable VM image (OVA / VHDX / QCOW2) from the customer portal. You import it into your hypervisor, attach a second disk for log storage, and apply your license. See the deployment guide.

Editions & licensing

Keel is licensed per deployment with tiered entitlements (ingest volume, AI RCA volume, node count, and features). Licenses come in connected mode (node-locked, activation-based) or air-gapped mode (annual, expiry-only). See licensing.