Introduction
log0 is a multi-tenant log intelligence and incident management platform. It ingests high-volume logs, clusters similar errors using fingerprinting, and creates actionable incidents routed directly to Slack.
What is log0?
log0 is a backend-first SaaS platform for engineering teams drowning in log noise. It ingests application logs from distributed services, groups similar errors into incidents using deterministic fingerprinting, and routes them to the owning engineer via Slack - with AI-generated summaries attached at creation.
Think: SigNoz + PagerDuty, designed from the ground up for multi-tenant use.
The Problem
Modern microservice teams face three compounding failures:
| Failure | log0's answer |
|---|---|
| Alert fatigue - 10,000 error logs for the same root cause | Fingerprinting + clustering → 1 incident |
| Unclear ownership - an alert fires, nobody knows who owns it | Slack-native assignment with engineer selection modal |
| Slow root cause - engineers manually correlate logs across services | AI summary attached at incident creation, before the engineer opens a terminal |
Quick Start
Send your first log to a running ingestion gateway:
curl -X POST http://localhost:8080/api/v1/logs \
-H "Content-Type: application/json" \
-H "X-TENANT-ID: your-tenant-id" \
-H "X-SERVICE-NAME: payment-service" \
-H "X-ENVIRONMENT: production" \
-H "X-API-KEY: your-api-key" \
-d '{
"timestamp": "2026-03-24T10:00:00Z",
"level": "ERROR",
"message": "Payment gateway timeout after 30s",
"trace": "com.example.PaymentService.process:142"
}'A 202 Accepted response means the log was received and published to Kafka. The normalization, clustering, and incident pipeline runs asynchronously - your service is never blocked waiting for it.
What's in These Docs
Architecture
How the platform is built - system context, all six services, Kafka event pipeline, storage layers, and the design decisions behind every choice.
Flow Diagrams
What happens at runtime. Traced through a concrete scenario: a payment service error storm from first HTTP request to Slack notification.
Service Internals
Class diagrams, data models, and Kafka event schemas for every service. Reference for implementation code.
Architecture Decisions
Why Kafka, why ClickHouse, why SHA-256 fingerprinting, why manual ACK. Every significant design choice with alternatives considered.
How is this guide?