展示HN：没有人关心可观测性成本
早安，HN——我有一个关于创业和误读市场的简短故事，以及一个请求。（请求：试用我们的产品>> app.datable.io/auth/sandbox）
我叫朱利安·吉卡（Julian Giuca），曾是New Relic的早期员工，直到2022年我一直负责他们的日志产品。可以说，我对日志有自己的看法。有时我觉得它们很棒，但更多时候我认为我们可以做得更好。
当人们和我谈论日志时，他们总是抱怨可观察性成本。工程领导们说这感觉“像是保护费”，你被迫捕获和发送所有数据，却没有真正的控制杠杆。
因此，我想解决这个问题，构建了理想的流式管道来处理和路由数据。基本上是为Datadog打造的Cribl。如果你能智能地处理、过滤和路由日志，就能大幅降低可观察性账单。发送更少的数据意味着花更少的钱。Coinbase在2023年刚花了6500万美元在Datadog上！人们肯定需要这个……对吧？
错了。
每个人都在谈论他们的可观察性账单有多高，以及他们想怎么做，但我们发现这从来没有成为一个足够高的优先事项。它被视为经营成本——一个没有优先级或负责人问题。
SRE/DevOps主要关注保持系统运行，而不是数据管理。虽然有一些兴趣，但非常有限。
平台工程师们对此感兴趣，但他们在处理其他优先事项。这似乎也是一个新兴的工程领域，因此很难聚焦。
工程副总裁们专注于执行和增长收入。这意味着可观察性成本通常在优先级上低于其他事项，直到系统正常运行出现问题或首席财务官开始抱怨。可有可无，但再次强调，这并不是一个紧迫的问题。
那么，怎么回事呢？Cribl表现出色，我们看到类似的公司在进行A轮融资，我们认为我们的产品更好。结果发现，它们都是以安全为主导的。
我们曾认为“减少可观察性数据以降低可观察性支出”是关键，但没有人负责这个问题，因此也没有人有动力去解决它。
安全团队没有这种奢侈。他们迫切需要日志。清晰、理想结构化且无噪音。他们需要从各种不同来源中提取信号，而不是浪费时间筛选垃圾数据和警报。SIEM供应商通常服务于开发市场（我在看你，Splunk和Sumo），而我花了太长时间从开发的角度来看待这个问题，无法看到整体。安全团队通常是推动这些工具采用的主要力量。开发人员已经有更广泛的工具选择，并可以利用日志平台。
我仍然相信，管道是缺失的一层——第三种方式——在数据泛滥和支付不必要的数据之前，你可以结构化、丰富和路由数据。但我尊重你们的意见。
这里的朋友们有什么想法？
我们有一个对安全和DevOps都非常有用的产品，但成本并不是尝试它的理由。
所以我的请求是，试用两分钟：app.datable.io/auth/sandbox
它具备你所期待的所有功能，同时比市场上任何其他管道更容易上手和使用。我们正在积极开发自动安全检测，并不断添加更多数据源/目标。
总结：构建了一个产品以满足可观察性需求。我误读了市场；那里的紧迫性不足。发现真正的驱动力是安全运营。
查看原文
Morning HN - - I have a quick story about building a startup and misreading the market, and an ask. (The ask: Try out our product>> app.datable.io/auth/sandbox)<p>My name is Julian Giuca and I was an early employee at New Relic, where I led their Logging product until 2022. It’s safe to say I have opinions about logs. Sometimes I think they are great. Too often I think we can do much better.<p>When people talk to me about logs, they reliably complain about observability costs. Engineering leaders have said it feels “like a protection racket”, where you're forced to capture and send everything with no real levers of control.<p>So I wanted to address this and built the ideal streaming pipeline to shape and route data. Basically Cribl for Datadog.
If you can shape, filter, and route logs intelligently, you can slash your observability bill. Sending less data means spending less money. Coinbase had just spent $65M on Datadog (in 2023)! Surely, people wanted this… right?<p>Wrong.<p>Everyone talks about how much their observability bill is and what they’d like to do about it, but we found it's never a high enough priority. It was treated as the cost of doing business—a problem with no priority or owner.<p>SRE / DevOps are mostly concerned with keeping the lights on, not data management. There was some interest there, but minimal.<p>Platform engineers were interested, but were juggling other priorities. It also felt like this was an emerging segment of engineering, so it was hard to hone in on.<p>VP’s of Engineering were focused on execution and growing the top line. This meant observability costs were usually below the line in priority until uptime slipped or the CFO started screaming. A nice to have, but again, not enough of an urgent problem.<p>So, what gives? Cribl is crushing it, we see similar companies raising Series A’s, and we think we’ve got a better product.
Turns out, they’re all security led.<p>We thought “reducing observability data to reduce observability spend” was the play, but no one owned the problem, so no one was incentivized to fix it.<p>Security teams don’t have that luxury. They need logs urgently. Cleanly. Ideally structured, and noise-free. They need signal out of all of these different sources and want to stop wasting time sifting through garbage data and alerts.
SIEM vendors often serve the Dev market (I’m looking at you Splunk and Sumo), and I just spent too long looking at it that way—from the Dev lens. Couldn’t see the forest for the trees. Security teams are usually the ones driving adoption of these tools. Devs already have a wider selection of tools, and can take advantage of a logging platform.<p>I still believe that a pipeline is the missing layer—the third way—where you can structure, enrich, and route data before there’s a flood of alerts and you’re paying for data you don’t need. But I defer to you all.<p>Thoughts from folks here?<p>We have a really useful product for both Sec and DevOps, but cost isn’t a reason to try it.<p>So my ask is, try it out for 2 minutes: app.datable.io/auth/sandbox<p>It has all the features you’d expect, while being easier to get started and easier to use than any other pipeline on the market. We are actively working on automatic security detection and always adding more data sources/destinations.<p>Tl;dr: Built a product to address observability need. I misread the market; not enough urgency there. Discovered the real driver was SecOps.