Skip to main content

​
The platform and its engine

To grow capacity, see Scaling beyond a single node. Quickwit has no authentication of its own: serve Rootprint on your public URL and keep Quickwit private.

​
How data flows

​
Ingest

  • Every push needs an ingest API key (rp_), scoped to one index. Logs go to that index. Spans always go to the span store. See Traces.
  • Rootprint forwards the payload to Quickwit unchanged, so it must match the target index’s schema.
  • Pull-based sources are configured in Rootprint, but Quickwit reads them directly, bypassing the gateway.
See Send logs for the full list of ingestion paths.

​
Query

The web UI authenticates with a session cookie. External tools use a query API key (rpk_).

​
What’s stored where

Three independent stores hold all durable state.
Rootprint’s Postgres database and Quickwit’s metastore must each be their own database, even if they share a Postgres server. Back up all three stores: each holds state the others cannot reconstruct. Deleting the index-storage volume permanently destroys your logs.