Quickwit - Cloud-Native Search Engine for Logs Cheatsheet
Quickwit is an open-source, Rust-based search engine designed for append-only data — logs, traces, and audit events — that runs directly on object storage (S3, GCS, Azure). Unlike Elasticsearch, it needs no local disk or cluster state for indices, which decouples compute from storage and makes petabyte-scale retention economical. It exposes an Elasticsearch-compatible search API and is a native Jaeger backend for traces.
Installation
| Method | Command |
|---|
| Install script | `curl -L https://install.quickwit.io |
| Docker | docker run -p 7280:7280 quickwit/quickwit run |
| Kubernetes | Helm chart available |
| Start a node | ./quickwit run |
| UI / API | http://localhost:7280 |
Core Concepts
| Term | Meaning |
|---|
| Index | A named dataset with a doc mapping |
| Split | An immutable indexed shard stored in object storage |
| Metastore | Tracks indices/splits (file or PostgreSQL) |
| Source | Where documents come from (Kafka, file, ingest API) |
| Node roles | indexer, searcher, metastore, control plane |
Creating an Index
# index-config.yaml
version: 0.8
index_id: app-logs
doc_mapping:
field_mappings:
- name: timestamp
type: datetime
fast: true
input_formats: [rfc3339, unix_timestamp]
- name: level
type: text
tokenizer: raw
- name: service
type: text
tokenizer: raw
- name: message
type: text
tokenizer: default
timestamp_field: timestamp
indexing_settings:
commit_timeout_secs: 30
search_settings:
default_search_fields: [message]
quickwit index create --index-config index-config.yaml
Ingesting Data
| Method | Command |
|---|
| File | quickwit index ingest --index app-logs --input-path logs.json |
| Stdin | `cat logs.json |
| Ingest API | POST /api/v1/app-logs/ingest |
| Kafka source | Define a source in the index config |
| OTLP | Native OpenTelemetry endpoint for logs/traces |
curl -XPOST "http://localhost:7280/api/v1/app-logs/ingest" \
--data-binary @logs.ndjson
Searching
# CLI search
quickwit index search --index app-logs --query "level:ERROR AND service:api"
# REST search
curl "http://localhost:7280/api/v1/app-logs/search?query=level:ERROR&max_hits=20"
| Query syntax | Matches |
|---|
term | Full-text term in default fields |
field:value | Exact field match |
a AND b, a OR b, NOT a | Boolean logic |
field:[10 TO 100] | Range |
"exact phrase" | Phrase match |
field:prefix* | Prefix match |
Aggregations & Time Filters
# Time-bounded search (uses the fast timestamp field)
curl "http://localhost:7280/api/v1/app-logs/search?query=*&start_timestamp=1753400000&end_timestamp=1753486400"
Quickwit supports Elasticsearch-style aggregations, so existing dashboards and queries often port over with little change.
Managing Indices
| Command | Description |
|---|
quickwit index list | List indices |
quickwit index describe --index X | Show stats/splits |
quickwit index clear --index X | Delete all documents |
quickwit index delete --index X | Delete the index |
quickwit split list --index X | Inspect splits |
Retention
retention:
period: 90 days
schedule: daily
Because splits live in object storage, retention is just deleting old splits — cheap and fast.
Integrations
| Target | Note |
|---|
| Jaeger | Quickwit is a native Jaeger storage backend |
| Grafana | Data source plugin for dashboards |
| OpenTelemetry | Native OTLP ingestion for logs and traces |
| Elasticsearch API | Compatible search endpoints ease migration |
Quickwit vs Alternatives
| Aspect | Quickwit | Elasticsearch | Loki |
|---|
| Storage | Object storage only | Local disk | Object storage |
| Full-text index | Yes (true search) | Yes | Label-based, limited |
| Cost at scale | Very low | High | Low |
| Traces | Native Jaeger backend | APM add-ons | Via Tempo |
| Best for | Cheap searchable log/trace retention | General search | Grafana-native logs |
Compare with Loki and OpenObserve; pair with Vector for ingestion.
Resources
