Skip to main content
These concepts apply across intake, query, alerting, automation, and administration.

​
Signals

MoleSignal handles four telemetry signals:
  • Logs are discrete structured events.
  • Metrics are numeric samples grouped into labeled time series.
  • Traces are spans connected by trace_id and parent relationships.
  • Profiles describe CPU, allocation, heap, or contention samples as call stacks.
RUM records are stored as organization streams and link browser sessions to backend traces. APM is not a fifth telemetry stream. APM is a bounded projection derived from deduplicated trace spans before tail sampling, so sampled-out traces can still contribute service, transaction, dependency, and error aggregates.

​
Streams

A stream is the typed contract shared by intake and query, with a name, a stream_type, an evolving schema, retention, runtime state, and a queryable flag. Supported types are logs, metrics, traces, profiles, and extend. The same name can exist under more than one type, so APIs identify a stream with both fields:
Turn off queryable for a catch-all source that should feed a routing pipeline without appearing in query selectors. See Streams.

​
Organizations and workspaces

An organization is the tenant and policy boundary. The product UI calls the selected organization a workspace. Telemetry and product resources belong to exactly one organization unless an explicit cross-organization grant or resource share allows access. The permanent _sys organization is a protected platform scope for system telemetry, license history, platform administrators, and global organization operations. The _sys organization is not a normal tenant.

​
Product resources

Dashboards, saved views, alert rules, schedules, reports, functions, pipelines, and Agent workflows are organization resources. Handlers load the target resource, verify ownership, and authorize the requested action before returning or changing the resource.

​
Permissions and roles

Permissions are stable capability keys such as streams.query, alerts.manage, and sys.licenses.read. Roles are named bundles of permissions. The built-in Owner, Admin, Editor, Viewer, and Platform Administrator roles provide defaults; custom roles can express narrower responsibilities. Navigation uses an effective capability snapshot, but hiding a page never replaces backend authorization. See Identity & access.

​
Time and correlation

Exploration pages share a time range. Correlation pivots preserve that range and add identifiers such as trace_id, service, host, or session. This enables paths such as RUM → trace → log → metric → profile without treating navigation state as authorization.

​
Storage and query

Logs, metrics, and traces are stored in partitioned Parquet files. Profile metadata is queryable while compressed pprof blobs remain in object storage. PostgreSQL stores file metadata, schemas, IAM, product resources, and operational state. DataFusion and Arrow execute SQL, PromQL-compatible metric queries, local searches, and Flight-distributed scans. The planner injects the authorized organization boundary before execution.

​
Runtime roles

One binary composes these roles through [node].roles: See Architecture for module and data-flow boundaries.
Last modified on August 9, 2026