Keel Infranexis

Keel is a log analytics appliance you import as a VM (VMware OVA, Hyper-V VHDX, or QCOW2 for KVM/Proxmox/OpenStack/OpenShift) and run entirely inside your own network. It ingests via OpenTelemetry, syslog, and Fluentd; stores hot data in ClickHouse with an optional S3-compatible cold tier that stays queryable; and adds an AI layer for natural-language search and automatic root-cause analysis on alerts. The key design choice: Keel ships no bundled model. You point it at an LLM endpoint you host — Ollama or vLLM on your own network for fully air-gapped operation, or your own OpenAI/Anthropic key if policy allows. Because of that, the appliance can run with zero external API calls — which is what makes it usable for banks, hospitals, government, and defense networks where logs legally can't leave. If the LLM endpoint is down or never configured, Keel degrades to a complete, conventional log platform: ingest, search, dashboards, alerting, and incident tracking.

The AI assistant is read-only by design — it searches, investigates, and summarizes, but has no tools to change or delete anything, which contains the blast radius of prompt injection through log data. Licensing verifies offline (RS256), updates are signed bundles, and there's a 3-node HA mode.

Pricing is flat annual bands ($6K/yr up to 5 GB/day, $14.8K up to 50 GB/day) — every feature in every tier, no per-GB metering, since it runs on your hardware and your disk.

If the short description field rejects it for length (some forms cap it around 140–200 characters), use this shorter one instead: On-prem AI-native log analytics appliance: natural-language search and automatic root-cause analysis, running fully inside your network against an LLM you host.