One query language for
all your observability backends

Query logs, metrics, traces, and profiles across Loki, DataDog, Prometheus, CloudWatch and more — with a single command.

Get started → View on GitHub
› owit logs level=error service=api --last 1h --limit 25
SOURCETIMELEVELSERVICETRACE-IDMESSAGE
loki14:32:01errorapi-gwa3f9e12bupstream timeout: payment-svc (3042ms)
datadog14:32:01errorpaymenta3f9e12bstripe: connection reset by peer
appinsights14:32:03errorapi-gwa3f9e12bretry payment-svc: attempt 2/3
cloudwatch14:32:05errorpaymenta3f9e12bstripe webhook delivery failed: 503
loki14:33:11errorauthb7c1d24ejwt: signing key not found in JWKS
datadog14:33:13errorauthb7c1d24eoidc provider returned 502 Bad Gateway
appinsights14:33:14errorapi-gwb7c1d24e401 upstream: auth-svc unavailable
cloudwatch14:33:15errorauthb7c1d24edependency health check failed
loki14:38:44errorinventoryc0a5f33ddeadlock detected on orders table
datadog14:38:45errorinventoryc0a5f33dpostgres: deadlock, transaction aborted
appinsights14:38:46errorapi-gwc0a5f33d500 inventory-svc: internal server error
cloudwatch14:38:47errorinventoryc0a5f33dtx rolled back after 3 retries
loki14:42:09errorcheckoutd1b8e71finventory hold expired: order aborted
datadog14:42:10errorcheckoutd1b8e71fsaga: compensating transaction started
appinsights14:42:11errorcheckoutd1b8e71fsaga rollback: payment already captured
cloudwatch14:42:13errorcheckoutd1b8e71forder.failed enqueued to DLQ
loki14:51:22errornotifiere2c9a80aSMTP rejected: 550 address rejected
datadog14:51:23errornotifiere2c9a80asendgrid: daily rate limit exceeded
appinsights14:51:24errorapi-gwe2c9a80anotification skipped: quota hit
cloudwatch14:51:25errornotifiere2c9a80aSES throttling: message dropped
loki14:57:38errorsearchf3d0b91celasticsearch cluster status: red
datadog14:57:39errorsearchf3d0b91cquery timeout after 5000ms
appinsights14:57:41errorapi-gwf3d0b91c503 search-svc: upstream unavailable
cloudwatch14:57:42errorsearchf3d0b91ccircuit breaker open: search-svc
loki14:58:55errorapi-gwg4e1c02drate limit: 429 sent to 10.0.2.15 (burst)
⚠ 4 backends queried · 25 events · 0 backend errors
› 
› owit metrics service=api --last 30m --step 2m
SOURCETIMEMETRICVALUELABELS
prometheus14:30:00http_request_duration_p99142msservice=api env=prod
prometheus14:30:00http_request_duration_p5018msservice=api env=prod
prometheus14:30:00http_error_rate0.04%service=api env=prod
datadog14:30:00http_request_duration_p99138msservice:api env:prod
datadog14:30:00http_error_rate0.03%service:api env:prod
cloudwatch14:30:00ALBTargetResponseTime144msTargetGroup=api-prod
cloudwatch14:30:00HTTPCode_Target_5XX_Count3TargetGroup=api-prod
azmonitor14:30:00requests/duration141msroleName=api
azmonitor14:30:00requests/failed2roleName=api
prometheus14:32:00http_request_duration_p99289ms ↑service=api env=prod
datadog14:32:00http_request_duration_p99301ms ↑service:api env:prod
cloudwatch14:32:00ALBTargetResponseTime310ms ↑TargetGroup=api-prod
azmonitor14:32:00requests/duration294ms ↑roleName=api
prometheus14:34:00http_error_rate1.2% ↑service=api env=prod
datadog14:34:00http_error_rate1.4% ↑service:api env:prod
cloudwatch14:34:00HTTPCode_Target_5XX_Count18 ↑TargetGroup=api-prod
azmonitor14:36:00requests/failed22 ↑roleName=api
prometheus14:38:00http_request_duration_p993042ms ↑service=api env=prod
datadog14:38:00http_request_duration_p993108ms ↑service:api env:prod
cloudwatch14:38:00ALBTargetResponseTime3089ms ↑TargetGroup=api-prod
azmonitor14:38:00requests/duration3021ms ↑roleName=api
prometheus14:40:00http_error_rate8.9% ↑service=api env=prod
⚠ 4 backends queried · 22 data points · 0 backend errors
› 
› owit traces service=checkout status=error --last 1h --limit 20
SOURCETIMETRACE-IDDURATIONSTATUSSPANSSERVICE PATH
tempo14:32:01a3f9e12b3042mserror12checkout → payment-svc → stripe-proxy
tempo14:32:01a3f9e12b841mserror5payment-svc → stripe-proxy
tempo14:32:01a3f9e12b3041mserror3stripe-proxy [connect timeout]
jaeger14:32:01a3f9e12b3044mserror11checkout.processPayment
jaeger14:32:01a3f9e12b843mserror4payment-svc.chargeCard
datadog14:32:01a3f9e12b3048mserror—checkout [apm]
tempo14:33:14b7c1d24e201mserror6api-gw → auth-svc → oidc-provider
tempo14:33:14b7c1d24e199mserror3auth-svc → oidc-provider [502]
jaeger14:33:14b7c1d24e203mserror5api-gw.authenticate
datadog14:33:14b7c1d24e198mserror—auth-svc [apm]
tempo14:38:44c0a5f33d1204mserror8inventory-svc → postgres [deadlock]
jaeger14:38:44c0a5f33d1201mserror7inventory-svc.createHold
datadog14:38:45c0a5f33d1208mserror—inventory-svc [apm]
zipkin14:38:44c0a5f33d1210mserror9inventory-svc [deadlock detected]
tempo14:42:09d1b8e71f2103mserror15checkout → inventory → payment-svc
tempo14:42:09d1b8e71f412mserror4inventory-svc [hold expired]
jaeger14:42:09d1b8e71f2109mserror14checkout.placeOrder [saga rollback]
datadog14:42:10d1b8e71f2115mserror—checkout [apm]
zipkin14:42:09d1b8e71f2098mserror13checkout → saga rollback → payment-svc
tempo14:57:38f3d0b91c500mserror6api-gw → search-svc [circuit open]
⚠ 4 backends queried · 20 spans · zipkin: b7c1d24e not found (auth-svc not instrumented)
› 
Stage RFC & feedback
Latest release v0.4.5
License MIT
Backends 8 planned

Why OpenWatchIt

Built for the seams between tools

The individual tools are excellent. The problem is having to navigate between them.

One command, every backend
Fan-out to Loki, DataDog, Prometheus, CloudWatch, and more in parallel. One ordered result, every time.
Plugin architecture
Every vendor is a standalone gRPC plugin. Write yours in Go, Rust, Python — anything with gRPC support.
No silent failures
If a backend is unreachable you get an explicit warning alongside partial results — never silent data loss.
Secure by default
Credentials are always environment variable references. Plaintext secrets in config are rejected at startup.

Use cases

Built for the moments that matter

owit is not a dashboard replacement. It's what you reach for when something is broken and you need answers fast.

Production incident
Everything in one place during an outage
Your payment service is throwing 500s at 3am. Logs are in Loki, traces in Tempo, metrics in Datadog. Instead of switching between three browser tabs, one owit command returns everything correlated by trace ID — in your terminal, in seconds.
Multi-vendor teams
One query language across every squad
Platform chose Prometheus. Product chose Datadog. SRE chose CloudWatch. owit gives every engineer the same query syntax regardless of which vendor is behind it — no re-learning, no tribal knowledge.
Terminal-first workflows
Pipe observability data like any other tool
Dashboards are great for monitoring. Terminals are better for debugging. owit lives where you already work — pipe results to grep, jq, or your own scripts without ever opening a browser.

How it works

From one command to every backend

Three commands and you're querying every backend at once. No config files to edit, no plugins to hunt down manually.

1
Install owit
One command gets you the CLI. That's it.
owit install
2
Connect your backends
Tell owit where your backends are. It downloads the right plugin, stores the connection, and you never touch a config file.
owit backend add loki --url https://loki.internal --token $LOKI_TOKEN
3
Query everything at once
One command fans out to every connected backend in parallel. Filters read like plain English — no new syntax to memorise.
owit logs level=error service=api --last 1h --limit 25
4
One result, every source
Results from all backends arrive merged and sorted by timestamp. If a backend is down, you get an explicit warning alongside partial results — never silent data loss.

Vendor support

Every backend, one language

Official plugins for the most common vendors. Community plugins for the rest.

Vendor Signal types Target release
Grafana Loki Logs v0.5 — first release
Prometheus Metrics v0.5 — first release
Grafana Tempo Traces TBD
Jaeger Traces TBD
DataDog Logs, Metrics, Traces TBD
AWS CloudWatch Logs, Metrics TBD
Azure AppInsights Logs, Metrics, Traces TBD
Elasticsearch Logs TBD

Roadmap

What we're building next

We're focused on getting the first real implementation right before expanding scope.

v0.4.5 Current
  • Architecture RFC and plugin API specification
  • OWL query language design and syntax proposal
  • Vendor plugin contract defined via gRPC
  • Documentation to spark community discussion
v0.5 Next
  • Grafana Loki — owit logs
  • Prometheus — owit metrics
  • First working end-to-end query
  • Plugin binary install via owit backend add
Beyond TBD
  • More backends based on community demand
  • Traces, profiles, and additional signal types
  • Shape this with us — open a discussion on GitHub

Contributing

Help shape what comes next

OpenWatchIt is in early development and your input matters. Feedback, ideas, and code directly influence the roadmap.

Share feedback
We're collecting feedback on the query language design, output format, and plugin architecture. Open a GitHub Discussion with your thoughts.
Start a discussion →
Report issues
Found unexpected behavior or a rough edge? Open an issue on GitHub. Look for good first issue labels if you want to contribute a fix.
Open an issue →
Write a plugin
Every backend is a standalone gRPC plugin — Go, Rust, Python, anything with gRPC support. Read the guide and contribute support for a new vendor.
Plugin development guide →

Ready to unify your observability stack?

Open source, MIT licensed, no vendor lock-in.

Read the docs → Star on GitHub