For a long time, Fastly has provided excellent aggregate statistics. Our real-time dashboards and historical metrics show you high-level trends, like for example when your traffic spikes, or when your service encounters a sudden cluster of 403 errors. But if you're an engineer troubleshooting an incident or auditing a security threat, you need to understand things like: "Where exactly are these 403 errors coming from? Who (or what) is making these requests, and what are they trying to do?"
Historically, to answer those questions, our customers would stream their raw logs to an external third-party destination. Fastly’s high-performance, real-time logs are free and we support over 30 integrations with logging providers. However, our customers still had to pay these providers (e.g., Splunk, Grafana, and others) to store the logs, run queries, and build dashboards. With some of the organizations I work with, adding another vendor can be a time consuming challenge involving procurement, security, legal, and so on. I wanted a way for Fastly customers to be able to search, filter, and visualize 100% of their raw, request-level log data instantly, using only Fastly tools and infrastructure, and without having to pay a third-party vendor or incur massive egress fees.
So, I built Fastly Log Analytics: a self-hosted, open-source data lake and interactive dashboard that gives you total ownership of your data. Here is how it works, what it can do for your team, and how you can get started today.
Fastly Log Analytics and Fastly Object Storage
The idea for this project clicked once Fastly shipped Object Storage. Fastly Object Storage is S3-compatible, which means you can use Fastly Object Storage as a real-time log streaming endpoint natively. And critically, it's yours: Fastly doesn't have access to your bucket without you handing over a key, and the data is encrypted at rest. You own your logs in a way you don't when they land in someone else's platform.
How it works
You can run Fastly Log Analytics on your laptop or any machine that you own. Under the hood, it's a straightforward pipeline built entirely on open-source tools:
A provisioning wizard automatically creates your Object Storage bucket, a log-fronting CDN Fastly service (so reads are cheap and cached), a structured JSON logging endpoint on your VCL service and custom VCL snippets to collect data about your traffic.
Raw
.gzlog files land in the bucket continuously as traffic flows through Fastly. You get to choose how quickly you want the logs written and what is included in each log line.A background job pulls new files, parses them, and commits them into an Apache Iceberg table, which is an ACID-compliant format that tolerates concurrent readers and writers without locking. Once a file is committed, the raw log is deleted and only the optimized Parquet data sticks around, which is what keeps storage costs down over time.
DuckDB queries the Iceberg table locally for fast, interactive dashboards — no separate database server is needed and the local tables are compacted and rolled up for performance.
The parquet files can also be stored in Fastly Object Storage for backup and/or analysis by additional tools.
The parquet files can also be stored in Fastly Object Storage for backup and/or analysis by additional tools.
It's genuinely just docker-compose up --build to get going (a manual uv + npm install path exists too). You'll need a Fastly account with Object Storage enabled, at least one VCL service to point it at, and an API key with superuser permissions. The wizard handles creation of the bucket, keys, CDN service, log format, and VCL snippets. Logs typically start flowing within a couple of minutes. You can also tear down the entire setup with one click.
You control exactly what gets logged: thirteen built-in field groups (core HTTP, geolocation, TLS fingerprinting, NGWAF signals, origin performance, network quality, and more). You can also inject your own custom VCL to collect additional data. The more you log, the more insight you get, but it’s going to cost you a little more too. The good news is that it's a dial you control, not an all-or-nothing switch, and you can see estimates of log line size and cost as you go.
Key features
Automated anomaly detection: The Insights page runs 45 built-in anomaly detectors across five categories (with more coming with each release): security & threat detection, origin health, edge performance, network path, and traffic volumetrics. It compares recent traffic against a baseline and surfacing things like error spikes, content-discovery scans, cache regressions, and NGWAF signal changes.
Streaming analytics and CMCD: Fastly doesn't natively process CMCD (Common Media Client Data). We're the messenger, not the analyzer. But CMCD fields ride in on a query string or header, so this is the ideal tool to extract and visualize them with the included full streaming dashboard: buffer health, bitrate, concurrent sessions, rebuffering events, with per-session drill-down. If you've ever had a streaming customer ask "can Fastly tell me about video playback quality," this is your new source of truth.
Interactive dashboards: View traffic over time, a global request map, top-N aggregations on any field, and a raw log viewer with click-to-filter.
What it costs
There's no license fee and no third-party vendor bill. Costs come entirely from Fastly Object Storage and CDN egress for log downloads. You pay for the storage plus the class operations (reads, writes, lists, deletes) the pipeline performs, scaling with how much traffic you log, how quickly you need to see the logs, and how you configure ingestion. The app keeps that down by default: CDN-frontend reads that cost zero Class B operations once cached, batched deletes, lazy listing, and optional sampling on high-traffic services. A built-in cost estimator on the Usage & Cost page pre-fills from your actual traffic stats, so you can see the impact of your selections before committing to them.
Where this Stands Today
This is an open-source project, not a Fastly product so think of it as buyer-beware in the best sense: no formal support SLA, but active development, real releases, and the Fastly Community if you hit issues. Also, it hasn't been stress-tested at extreme scale (think millions of requests per second) yet. That's the next architecture problem to solve.
It's also meant to be forked and we welcome contributions! If you want to add a feature or wire in your own custom fields, the codebase is there for you, and if you're using AI coding tools, you'll find it's a pretty approachable codebase to extend.
Give Fastly Log Analytics a Try Today
If you're running anything on Fastly, you can spin this up today:
git clone https://github.com/fastly/fastly-log-analytics
cd fastly-log-analytics
docker-compose up --buildThen open http://localhost:3000 and follow the provisioning wizard. Full setup docs, the feature reference, and a walkthrough video are in the repo.