Honeycomb

Honeycomb is an observability platform built around a high-cardinality, high-dimensionality column store.

Concepts

Teams model organisations.
Datasets partition stored data, and may model environments. Note that there's no privilege separation between datasets within a team at this time.
BubbleUp is the core experience: it surfaces anomalies in dimensions based on a selection made on a histogram.
Events are structured representations of actions taking place in a system, e.g. web transactions. Everything in Honeycomb is stored as an event.
- Columns available will differ with the type of event.
- Derived Columns allow computing additional values for each event based on that event's other column values.
Queries
- Query results represent point-in-time executions of a query.
Triggers enable notification delivery when query results cross configured thresholds.
SLOs model expectations of service quality as Service Level Objectives.
- Burn rate alerts behave similarly to triggers, but are based on the depletion rate of the error budget.

Beelines are proprietary SDKs for ingesting data, deprecated in favour of OpenTelemetry.
Honeytail ingests log files.

COUNT is the number of events
COUNT_DISTINCT(column) is the number of unique values - for the given field
CONCURRENCY yields the number of matching spans in-progress (as determined by start time and duration) in each time interval.
SUM(column)
AVG(column)
MAX(column)
MIN(column)
Pnn(column) computes a percentile.
RATE_MAX(column), RATE_AVG(column) and RATE_SUM(column) computes the rate of change between time buckets.