Accept the recordStructured, unstructured, or only partly understood.
Source-aware logs for systems that keep moving
Keep every signal. Find the thread.
Quill accepts the logs you already have, keeps their normalized source context, and connects Kubernetes and Helm rollout evidence without turning proximity into certainty.
Keep the sourceEvent time, receipt time, source, parser, and bounded attributes stay attached.
Follow the rolloutKubernetes Events, pods, containers, and explicitly posted Helm records.
Name the gapEvidence, correlation, and inference remain visibly different.
Quill · source-aware observability
The incident stream has an editor.
Part archivist, part investigator, Quill keeps noisy runtime records legible. Recognized fields become useful filters, while safe extra fields remain available as bounded attributes. Every conclusion remains connected to the evidence that supports it.
- Preserve contextThe API returns the normalized event, resource map, bounded attributes, and truncation status.
- ConnectCluster, namespace, workload, release, and source context form one thread when present.
- QualifyQuill says when a deploy is merely near an error—not proven to have caused it.
01 · Inspect without preprocessing
Useful when structured. Still searchable when it is not.
Send a JSON object, a stream of NDJSON, a plain line from an old process, or an OTLP JSON log record. Quill normalizes recognized fields and bounds everything it stores.
- 01Detect the envelope
Timestamp, severity, message, service, and Kubernetes resource fields are normalized when present.
- 02Bound the unknown
Safe extra keys become bounded attributes; malformed line input stays searchable as text.
- 03Make every filter visible
The URL carries the time window, source scope, severity, and query you used.
Production · last 15 minutessource attached
| Time | Level | Workload | Message |
|---|---|---|---|
| 14:03:19.441 | error | payments-api | upstream request timed out |
| 14:03:18.920 | warn | payments-api | retry budget at 80% |
| 14:02:54.100 | info | helm-controller | revision 184 marked deployed |
| 14:02:51.006 | info | legacy-worker | worker-7: connection reset, retrying |
4 formats acceptedbounds and truncation reported
02 · Follow Helm onto EKS
The rollout and the runtime record. On one clock.
Quill groups Kubernetes Events and application logs automatically. When a record carries Helm release context—or a CI/Helm transcript is posted explicitly—it uses that context without inventing causality.
Posted Helm upgrade record
evidenceA modeled CI event says chart payments-3.18.4 applied in production.
ReplicaSet created
evidenceKubernetes Event names the workload; release context came from the explicit Helm record.
Error rate rises
correlationFirst timeout appears 18 seconds after the new pod becomes Ready.
Cause remains unproven
gapNo trace or config-diff evidence connects the rollout to the timeout yet.
Quill's read
The error starts after revision 184 reaches Ready. That timing is useful evidence, not proof that the release caused the error.
03 · Bring whatever writes
One intake edge. No perfect schema required.
Start with a direct HTTP post. In EKS, keep workload logs flowing through the platform OpenTelemetry path into Loki, then let Quill query the same operational record.
Plain text
Newline-delimited output from scripts, legacy processes, jobs, and one-off diagnostics.
JSON + NDJSON
One object or many records; common fields are normalized and safe extras are bounded as attributes.
OTLP/HTTP JSON
JSON resourceLogs with event body, event time, severity, and resource or record attributes.
EKS collection
The workload-log DaemonSet feeds platform Loki through OpenTelemetry; one cluster collector watches Kubernetes Events.
Evidence before explanation
Every answer keeps its operational receipt.
Quill records where an event came from, its event and receipt times, how it was parsed, and whether a statement is direct evidence, correlation, or inference.
Normalized record
Message, resource fields, bounded attributes, parser, and truncation status remain inspectable.
Source named
Collector, cluster, namespace, workload, and stream remain inspectable.
Two clocks
Event time and Quill receipt time stay separate so delay is visible.
Read, then write
Quill explains the record; it does not mutate a workload or roll back a release.
Questions operators actually ask
Before you ship a collector.
Straight answers about formats, EKS, deployment correlation, and normalized evidence.
What happens to a log Quill cannot parse?
Line input is accepted as searchable text with receipt metadata. Missing severity defaults conservatively to INFO unless a recognized severity appears in the message.
How do Helm applications on EKS get connected?
The existing workload-log DaemonSet sends through the platform OpenTelemetry path into Loki, and a singleton collector watches Kubernetes Events. Those events provide workload rollout evidence—not Helm history. Post Helm or CI records explicitly when release history is required.
Does “after a deploy” mean “caused by the deploy”?
No. Quill labels temporal proximity as correlation. Cause requires stronger evidence such as a trace, a config or image delta, a reproducible failure, or a rollback result.
Is the preview showing our production data?
No. The preview is explicitly modeled and runs only when you choose it. Signed-in views call Quill's authenticated APIs and show an error rather than silently substituting sample data.
The thread starts at intake
Give every runtime event a place in the record.
Sign in to your Zimac workspace, or inspect the explicitly modeled console first.
Open the log console.
Use Zimac SSO for your workspace. A pasted seat token remains available for local and enterprise deployments.