Keel Overview

Location in Keel: /home

Keel is a self-hosted, AI-native log analytics and observability appliance — you run it on your own infrastructure, cloud or on-prem. It ingests logs and alerts from your infrastructure, stores and searches them, evaluates alert rules, and lets you ask your logs anything in plain English — all on your own network, with no SaaS backend. The log data plane runs entirely on the appliance; for AI, Keel uses a model you configure — a local model (nothing leaves your network) or your own provider key.

AI-native features

• Platform Intelligence — the home console. Ask Keel anything in plain English; it investigates, answers with the underlying data, and (with confirmation) can act.
• Explore & dashboards — curated read-only dashboards plus Dynamic Charts with AI that turn a question into a chart.
• Incidents & RCA — alerts become incidents with automatic AI root-cause analysis, grounded in your logs and runbooks.
• RAG Context (Knowledge Base) — index runbooks and post-mortems so the AI reasons from your own procedures.
• LLM Configuration — bring your own model: Ollama, Anthropic, OpenAI, Gemini, or any OpenAI-compatible endpoint, with failover.
• Keel MCP Server — connect your own AI agents (Claude, Cursor, custom), strictly read-only and scoped.

Data platform

• Log sources and external log sources — ingest over OTLP, Syslog, and Fluentd.
• Log pipeline & processing and log destinations — transform and forward logs.
• Log search — fast Log Browser, live tail, and read-only SQL.
• Storage & retention — column store with hot local and S3-compatible cold tiers.
• BI Connector — expose logs read-only to Grafana, Metabase, and Superset.

Alerting & operations

• Alert sources, alert pipeline, and detections — turn signals into incidents.
• Notification channels — Slack, Teams, email, and webhooks.
• Users, roles & teams, authentication & SSO, high availability, backup & restore, and licensing.