The single largest observability surface on the market. Point your existing Datadog Logs and APM searches at Sasquatch — same tag-and-facet syntax, same dashboards, same alerts. Cut the ingest line item, keep the workflow your team already lives in.

service:payments status:error
  @duration:>500ms
  | stats count by host

SPL parser + REST API shim. Splunk-shaped searches resolve against your Sasquatch chunks — no Splunk indexer required to search them.

index=app sourcetype=k8s_pod
  level=error timeout
  | stats count by service

Drop in Sasquatch as a Loki datasource. Your existing Grafana dashboards, alert rules, and ad-hoc Explore queries keep working — same LogQL, same response shape.

{namespace="payments",level="error"}
  |~ "timeout"
  | rate(5m)

Kibana queries (KQL) and Lucene-shaped searches resolve through the same adapter. Your existing Discover boards, Lens visualizations, and alert rules keep working — point them at Sasquatch instead of the Elastic ingest pipeline.

service:"payments" AND level:"error"
  AND @timestamp > "now-5m"
  AND duration > 500

OTLP traces compressed at the edge, queryable from the same Tempo datasource panel. Trace ID lookup is fast against your cold storage — no full-bucket scan.

{ resource.service.name = "api-gateway"
  && status = error
  && duration > 500ms }

PromQL adapter over the metric chunks Sasquatch already compresses. Existing alert rules and recording rules continue to evaluate against the same series labels.

rate(http_requests_total{
  status=~"5.."
}[5m])