Imply has launched Lumi Loglake to provide an interactive log search facility for object storage to dramatically reduce observability and SIEM infrastructure costs.
Imply was started up in 2015 and develops real-tine analytics software based around the Apache Druid database. Its three founders; CEO Fangjin Yang, CTO Gian Merlino, and Chief Experience Officer Vadim Ogievetsky, were the original Druid creators. The company says that it’s the data layer for observability, security, and AI. It’s now building software providing a lakehouse architecture for unstructured logs that enables users to search these logs directly in object storage.
Eric Tschetter, Imply’s Chief Architect, said: “AI is generating more telemetry than organizations can afford to index. Lumi Loglake gives teams a new way to retain, search, and investigate that data without the cost and complexity of always-on indexing architecture. By bringing interactive log search directly to open storage, Loglake applies the economics and flexibility of lakehouse architectures to operationalize log data.”
Traditional observability architectures often require logs to be cataloged, structured, and indexed before they become searchable. Imply asserts that, at AI scale, this allows SIEM people to make upfront decisions about log data what to retain and index before they know what will matter, creating operational overhead and making costs difficult to control.
It says observability and security teams work with unstructured machine data, where investigations often begin without knowing in advance which fields, patterns, or events will matter. Lumi Loglake enables organizations to search and investigate unstructured logs directly where they are stored, including AWS S3, Delta Lake, and Apache Iceberg, without requiring data catalogs, schema definitions, or rehydration workflows.
Lumi Loglake separates compute from object storage, allowing customers to scale telemetry retention independently from compute infrastructure costs. Compute resources are provisioned dynamically based on query activity. This eliminates a need for always-on indexing infrastructure and keeps historical telemetry instantly accessible.
It says SIEM teams can keep significantly more data in object storage, search it immediately, and apply indexing only where it ’s needed. Customers can reduce software costs by 70 percent or more and hardware costs by 40 percent or more by moving data off always-on indexed storage and into low-cost open storage environments such as Amazon S3.
This means that, rather than keeping large volumes of data inside Splunk's indexing tier, organizations can retain historical telemetry in S3 while continuing to query it using SPL and receive native Splunk events. They can query the same datasets across multiple platforms without duplicating storage, including Splunk using SPL, Databricks using Spark SQL, Grafana using LogQL, and AI and BI platforms using ANSI SQL/JDBC.
Lumi Loglake is available now and is being showcased at the Databricks Data + AI Summit. Learn more in blogs by Imply Senior Product Marketing Director Matt Morrissey.