Documentation

Quick start

Send one event with curl, confirm it landed, and run your first search — including the timestamp trap that silently hides data the ingest plane already accepted.

Quickstart →

Authentication

Which credential headers the ingest plane and the app plane each accept — they are not the same set — plus a step-by-step 401 triage, now a page of its own.

Authentication →

Quickstart by platform

Pick your stack — each guide is a 5-minute end-to-end setup with copy-paste-ready config, the exact verification steps, and the gotchas we've seen on real deployments.

Not on this list? The protocol table below works for any shipper that speaks Elasticsearch Bulk, Loki Push, OTLP HTTP, FluentBit, Fluentd, Syslog, or plain JSON.

Supported Integrations

Epok accepts logs from any source. Pick the integration that fits your stack.

A config alone won't tell you whether data actually arrived. Each platform guide adds a verification step and the failure branches — see the platform grid above, or start with the quickstart.

Metrics

Host, container, Kubernetes and database metrics over OpenTelemetry, Prometheus remote write, or line protocol — now a full install guide, with a separate guide for existing Prometheus fleets.

Install: metrics & infrastructure →

Traces

OpenTelemetry auto-instrumentation for Node, Python, Java and Go, plus the golden signals derived server-side from your spans — now a full install guide with verification steps.

Install: traces (APM) →

Search syntax

Field filters, booleans, wildcards and regex, time and stream filters, pipes, and the two time-range behaviours that surprise people — now a reference page of its own.

Search syntax →

Service overview (APM)

Every service Epok discovers gets a live service page — request rate, latency, errors, and per-endpoint breakdowns in one view. Open it from Services in the sidebar (or press 5), then click a service. Deep-link a single service with #/services?svc=<name>.

What the service page shows

• RED + Apdex strip — throughput (req/s), error rate, latency p50/p95/p99, and an Apdex score. Click any tile to drill into the matching traces (the p95 tile opens requests at or above p95; the Apdex tile opens requests past the tolerance threshold).
• Latency distribution — a histogram of request durations; click a bar to see the traces at least that slow.
• Per-endpoint table — req/s, error %, and p50/p95/p99 for each route. Expand a row for that endpoint's own RED, latency distribution, and top errors.
• Top errors — the failing operations and the most common error messages for the service, each linking straight to the underlying traces or logs.
• Recent deploys — deploy markers with the before→after change in error rate and p95, so a regression lines up with the release that caused it.
• Infrastructure & dependencies — host CPU/memory for the service, plus its upstream and downstream services (from trace context) with their error rates.

Configuration examples

Copy-paste shipper configs now live in the picker above, and each platform has a guide of its own that covers verification and the failure branches a bare config cannot.

Quickstart →

What happens next

What the engine does with your data over the first hour, the first three days, and the first week — including why early thresholds are deliberately wider — is now part of the quickstart.

Quickstart: what happens next →

Detectors

Every detector we ship, what each one looks for, the alert it produces, and which are still capped at warning severity while they soak — now a browsable catalog with a page per detector.

Detector catalog →

Alerting & alert hygiene

Deduplication, grouping and escalation still happen automatically. Mute schedules, maintenance windows, the weekly digest, the audit trail and custom actions are documented on their own page.

Alerting hygiene →

Want alerts to carry who's affected — per-tier counts, top accounts — in the notification itself? Paste a customer roster once.

Customer impact →

Analysis Tools

When an alert fires, Epok automatically runs analysis to help you understand what happened, why, and what to do next. Deterministic analysis runs on every tier; AI-assisted explanations are included starting with the 14-day trial (capped by daily AI budget). Open an incident in the sandbox →

Investigate

Investigate is the single window where Epok pulls together every signal for one service or incident — without bouncing between tools. Instead of stitching by a fuzzy time window, it joins signals by trace_id: the metrics, traces, and logs for a degraded service, plus any real-user sessions that hit the same error traces.

Signals only appear when present — no metrics pipeline, no metrics tile; trace propagation off, no RUM panel. The strongest correlation is the shared trace_id join — exact, not a guess based on timing. When a service sends metrics or logs without traces, Epok still gathers its signals by service name over the incident window, so a metrics-only or logs-only service is never left out.

AI Features

Every detector and deterministic analysis tool runs on every tier. AI explanations sit on top: they turn detector output into readable prose, explain dimension shifts, auto-tune alert noise, and translate English into a search query. AI runs against your data only at your tenant's request; your data is never used for model training.

Notifications

Configure where Epok sends alerts. Trial and Team include channels; Growth and Custom are unlimited.

Team Management

Epok supports team collaboration with role-based access control.

Configuration

Epok works with zero configuration out of the box. All settings below are optional and can be adjusted in the dashboard.

Custom rules

Threshold rules (one search crosses a number over a window) and composite rules (several signals true at once) — full field reference, worked examples, and the test endpoints — now a page of its own.

Custom rules →

API Reference

Key endpoints for programmatic access. All endpoints require authentication via API key. Full OpenAPI reference →

Download the raw spec at /openapi.json to generate clients or import into Postman.

curl 'https://app.getepok.dev/api/v1/tenants/YOUR_TENANT_ID/alerts?state=firing' \
  -H 'Authorization: Bearer YOUR_API_KEY'

curl -X POST https://app.getepok.dev/api/v1/tenants/YOUR_TENANT_ID/search \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"query": "level:error", "start": "-1h", "end": "now", "limit": 100}'

Limits & error codes

Body size caps, ingest rate and burst, the daily volume quota, every HTTP status code the ingest plane returns, and what changes on day 15 of the trial — now a page of its own.

Limits & error codes →

Migrating From Another Tool

Moving from Datadog, Splunk, or Loki? Dual-ship for a day, verify parity, then cut over on your own schedule. The migration guide walks through each source with concrete Vector configs.

Further Reading