Federated Telemetry
If you already run Prometheus, Loki, and Jaeger (or equivalents), you don't have to ship raw telemetry to InfraSage at all. Federated mode inverts the data flow: your stack keeps custody of the raw data, and InfraSage pulls what it needs.
This works because InfraSage's detection core is aggregates-only by design. The detectors, the dashboards, and the watchdog all read one-minute aggregates, never the raw firehose. Raw logs and traces are needed only as evidence during an investigation, and evidence can be fetched at investigation time from wherever it lives.
How it works
| Concern | Ingest mode | Federated mode |
|---|---|---|
| Metrics for detection | Aggregated from your OTLP/Prometheus push | Pulled from your Prometheus on an interval, written straight to aggregates |
| Raw logs (RCA evidence, Explore) | 24h transit buffer in InfraSage | Queried live from your Loki, results cached ephemerally, citations kept |
| Raw traces | 24h transit buffer | Queried live from your Jaeger/Tempo |
| Raw data custody | InfraSage (24h TTL) | Yours, entirely |
| Evidence retention | 24h | Whatever your stack retains |
The RCA's search_logs and get_traces tools route through per-tenant evidence adapters. The
analysis doesn't know or care where the evidence came from, and every adapter failure is loud and
attributed, never silently empty.
Configuring sources
Console → Connect → Federated sources, or the API:
GET/POST/PUT/DELETE /api/v1/federated/sources
A source declares a kind (prometheus, loki, jaeger), an endpoint URL reachable from
InfraSage, optional auth, and a poll interval (metrics sources only). The capability matrix on the
Connect page shows exactly which platform features each source kind powers.
:::warning Reachability is on you InfraSage queries your endpoints from its egress IPs, so your network has to allow it. Private stacks typically expose a mTLS-guarded or IP-allowlisted endpoint. The pull fails loudly per query when unreachable, and the source's status reflects it. :::
:::note Rollout status
Federated mode ships behind FEDERATED_TELEMETRY_ENABLED and is currently enabled per
deployment during partner onboarding. Talk to us before flipping it in production.
:::
When to choose which
Pick ingest mode if you want one vendor, minimal moving parts, and same-day evidence without running your own log store. It's the better fit for teams without an existing stack.
Pick federated mode if you already have an observability investment, a data-custody requirement, or retention needs beyond 24h raw. Your stack's retention becomes InfraSage's evidence window, and interactive exploration load stays on infrastructure already sized for it.
The two compose: some services pushing OTLP, others federated, in the same tenant.