# Umbrelog

> Umbrelog is an incident investigation platform for production engineering teams.
> It reconstructs what happened during a production failure so engineers can understand
> the failure path faster — and then fix it with confidence.

## What Umbrelog is

Umbrelog is not a generic log store and not a replacement for your APM.
Logging is the entry point. The product is **investigation context**: the surrounding
operational facts that turn an error into a reconstructed storyline.

## What problem it solves

When production breaks, the answer is rarely in one tool. Engineers assemble a narrative
across logs, request paths, anomalies, infra health, and “what shipped.” That assembly
time is time-to-understand. Umbrelog collapses those layers into one investigation workspace.

## Core mental model

Logs → Context → Runtime Interactions → Signals → Operational Systems → Deployments → Analytics → Investigation

## Definitions

- **Logs** — Structured events emitted by `@umbrelog/sdk`. The usual starting point for an investigation.
- **Context** — Correlation fields and surrounding operational facts that make a log investigable.
- **Runtime Interactions** — HTTP, database, cache, queue, and job operations used to reconstruct the path around a failure.
- **Signals** — Unusual volume or pattern changes for a service; investigation entry points, not only threshold pages.
- **Operational Systems** — Platform-owned infrastructure health (e.g. Postgres, Redis, Kafka) attached to investigations.
- **Deployments** — GitHub change context near the failure window (“what shipped?”).
- **Analytics** — Service-level volume and error trends that show pressure over time.
- **Investigation** — AI-assisted analysis anchored on a log: storyline, evidence, related signals, and next steps with confidence boundaries.

## Who it is for

- Production engineering and on-call teams
- Platform / SRE teams investigating distributed Node.js systems
- Teams that need logs correlated with Kafka, RabbitMQ, PostgreSQL, Redis, HTTP, and deploys

## Start here

- [What is Umbrelog?](https://umbrelog.com/docs): Umbrelog is an incident investigation platform. It reconstructs production failures from logs, context, runtime interactions, signals, operational systems, deployments, and analytics.
- [How Umbrelog works](https://umbrelog.com/docs/overview/how-umbrelog-works)
- [Incident investigation use case](https://umbrelog.com/use-cases/incident-investigation)
- [Product overview](https://umbrelog.com/pricing)

## Core concepts

- [Context](https://umbrelog.com/docs/concepts/context): Everything around a log that makes investigation possible: execution fields, interactions, signals, ops systems, and deployments.
- [Runtime Interactions](https://umbrelog.com/docs/concepts/runtime-interactions): HTTP, database, cache, queue, and job operations used to reconstruct the path around a failure.
- [Signals](https://umbrelog.com/docs/concepts/signals): Why you receive Signals—and how spike, drop, burst, and new-pattern detectors feed investigations.
- [Operational Systems](https://umbrelog.com/docs/concepts/operational-systems): Platform-owned infrastructure health that enriches investigations beyond application logs.
- [Investigation](https://umbrelog.com/docs/concepts/investigation): AI-assisted analysis from an anchor log: storyline, evidence, related signals, and next steps with confidence boundaries.

## Guides

- [Something broke in production](https://umbrelog.com/docs/guides/investigate-incident): On-call workflow from the first symptom to a validated next step in Umbrelog.
- [Why is my log volume so high?](https://umbrelog.com/docs/guides/reduce-log-noise): Cut indexed volume with capture policy, mute rules, and structured attributes—without losing errors.
- [How do I follow a request across services?](https://umbrelog.com/docs/guides/distributed-requests): Use Execution Context and runtime interactions to follow work across services.

## Compare

- [Umbrelog vs Datadog](https://umbrelog.com/compare/datadog) — when Umbrelog fits incident investigation vs a full-stack observability suite

## Blog

- [Root Cause Analysis (RCA): A Practical Guide for Production Incidents](https://umbrelog.com/blog/root-cause-analysis-production-incidents): Root cause analysis (RCA) for production incidents: incident timelines, evidence vs assumptions, postmortem structure, common mistakes, and a practical incident response workflow — with an RCA example.
- [How to Investigate Production Incidents (Step by Step)](https://umbrelog.com/blog/how-to-investigate-production-incidents): How to investigate production incidents step by step: confirm the alert, find an anchor error, build a timeline, check deploys and infra pressure, communicate findings, and write the postmortem.
- [The Hidden Cost of "What Deployed?"](https://umbrelog.com/blog/hidden-cost-what-deployed): Every incident eventually asks what shipped. The answer is rarely in one place — and that delay costs more than teams admit.
- [The Same Error 5,000 Times Is Still One Incident](https://umbrelog.com/blog/same-error-five-thousand-times-one-incident): Why duplicate errors overwhelm on-call engineers without creating understanding.
- [MTTR Is a Lagging Metric. Nobody Measures Time-to-Understand.](https://umbrelog.com/blog/mttr-lagging-metric-time-to-understand): When the graph turns green but the Zoom is still open — why fast recovery and finished understanding are not the same clock.
- [We Centralized Our Logs. Incidents Didn't Get Faster.](https://umbrelog.com/blog/centralized-logs-incidents-not-faster): Centralizing logs solves collection — not the five-tab assembly every Sev-2 still runs by hand across GitHub, APM, and Slack.
- [What Building a Logging Platform Taught Me About Incident Investigations](https://umbrelog.com/blog/incident-investigations-lessons): Why teams still spend more time understanding incidents than fixing them — and what building Umbrelog taught us about the gap between logs and understanding.

## Trust

- [Security & Privacy](https://umbrelog.com/security)
- [Privacy policy](https://umbrelog.com/privacy)
- [Subprocessors](https://umbrelog.com/subprocessors)
- [Status](https://umbrelog.com/status)

## More

- Full documentation index: https://umbrelog.com/llms-full.txt
- Sitemap: https://umbrelog.com/sitemap.xml