Logystera is for any JSON Log

Feature Catalogue

From ingestion to alerting, every piece is designed for JSON audit logs (including Vault), multi-tenancy, and enterprise observability.

Request a Demo View Features

Signals, Rules, and Metrics for Your JSON Logs

Logystera extracts high-value operational and security signals from JSON audit logs using real-time ingestion, pre-built detection rules, and Prometheus-compatible metrics. Namespace-aware isolation keeps multi-tenant teams separated while still supporting Vault as the flagship example.

Core Capabilities

Real-time ingest pipeline

File, Fluentd, or RabbitMQ with tenant/cluster labels on ingress.

Parallel forwarder/consumer/processor sized independently.
Backpressure-aware flow control for bursty audit streams.

alert rules & metrics

Thresholds, windows, suppression, bundling without redeploys.

Dynamic labels from any JSON field for precise routing.
Versioned rules and metrics compiled into PromQL.

Multi-tenant isolation

Namespaces and tenants isolated by default.

Per-tenant dashboards, quotas, alerts, and rate limits.
Safe for regulated shared clusters.

Identity-aware detection

Vault-native semantics with extensible JSON parsing for any source.

Pre-built coverage for Vault tokens, entities, namespaces, leases, auth flows.
Extendable to Kubernetes, CI/CD, APIs, and any structured JSON system.

Prometheus metrics

Multi-registry /metrics tuned for low-latency scrapes.

Counters, gauges, and histograms derived from your logs.
Throughput, latency, queue depth, alert outcomes, registry health.

Alerting engine

Email, webhook, Slack with retry, dedupe, and suppression.

Bundling collapses bursts into actionable alerts.
Alert outcomes and suppression state exposed as metrics.

Redis-backed state + workers

Low-latency state with parallel evaluation.

Redis stores windows, dedupe keys, suppression lists with <5ms access.
Sidekiq/worker parallelism with detailed worker metrics.

On-prem PKI-ready pipeline

Built for private networks and self-hosted deployments.

Private PKI for mTLS between agents, services, Redis, RabbitMQ.
No external dependency; deploy in high-security environments.

Everything Shipped Out of the Box

Full Catalogue

A complete list of capabilities to deploy, observe, and alert on modern workloads.

Real-time log ingestion: file, Fluentd, RabbitMQ; 40M+ entries/day with on-the-fly tenant, cluster, and node labels.

Ready-Made Views for Ops and Security

Platform and tenant-level dashboards with alert outcomes, suppression state, and namespace isolation.

Platform view

Compare clusters, namespaces, and tenants with structured PromQL. See auth methods, token behavior, mounts, and error hot spots.

Namespace isolation baked in.
Auth and token lifecycle analysis.
Operator performance and regression views.

Tenant view

Safe, isolated dashboards for each tenant or business unit with KPIs for chargeback and compliance.

Requests and errors per namespace and path.
Mount and KV usage relevant to that tenant.
Alert outcomes and suppression state.

Feature Details That Keep You Fast and Quiet

Clear examples of how Logystera avoids cardinality explosions, suppresses noise, and stays Vault-smart while remaining source-agnostic.

Multi-registry /metrics tuned for low-latency scrapes

Per-tenant metric registries prevent cardinality explosion.

The Problem: Combining all metrics into one registry in multi-tenant environments creates cardinality blow-ups and slow scrapes.

Logystera's Solution:

Prometheus scrapes only relevant metrics per tenant.
No cross-tenant metric pollution.
Faster scrapes and queries.
Clear cost attribution per tenant.

Thresholds, windows, suppression, bundling without redeploys

Intelligent alert management reduces noise by 60%.

The Problem: Traditional alerting creates fatigue—too many alerts, too much noise.

Logystera's Solution:

Bundling: Related alerts grouped into one notification.
Suppression: Avoid re-alerting for known issues.
Windows: "Alert only if X happens Y times in Z minutes."
Hot-reload: Change alert rules without restarts.

Real impact: Teams report ~60% reduction in alert volume while catching more real issues.

Vault-Native Semantics

Deep understanding of Vault-specific concepts with extensible JSON parsing for any log source.

What this means: Pre-built rules for Vault, easy customization for K8s, CI/CD, APIs, or any system that writes JSON.

For Vault: Token lifecycles, entity relationships, namespace isolation, lease management, auth method behavior.

For Other Systems: Kubernetes pods/RBAC, CI/CD pipelines, API gateway routes, any structured JSON logs.

Map these features to your Vault setup

Book a Technical Session

Trusted by Security Teams

We had 40 million Vault events per day and no idea what was noise. Logystera cut our alert volume by 60% while catching things we previously missed.

Infrastructure Lead, European Financial Institution

Logystera changed how we think about Vault observability. We went from grep scripts to production-grade metrics in a week.

Platform Engineer, Global Technology Company

On-prem, air-gapped, and private PKI were non-negotiable for us. Logystera delivered all three without compromise.

Security Architect, Government Infrastructure Agency