Industries: each industry's logs, records and events in one SQL engine
Every industry keeps text next to its numbers: security logs, clinical notes, call records, product catalogs, player chat. SereneDB is one Postgres-compatible engine that finds the relevant records in that text and computes over them in the same query. These ten pages each take one industry's data through the questions its teams ask, in SQL that ran on SereneDB 26.11.2.
Security & operations
Logs, traces, sign-ins and security events in indexed tables: searched as text, then counted, joined and timed in the same SQL statement.
Logs, traces and metrics in SQL
OpenTelemetry exports land in indexed tables over OTLP: quantile_cont gives each service's span latency, and a JOIN on trace_id ties a slow span to its log lines.
quantile_cont(duration_ns, 0.99)p99 per service · from spansThreat hunting over security logs
VPN, endpoint, proxy and DNS logs in one search table: sweep indicators with <<= over an address range, follow a password spray with MATCH_RECOGNIZE and time a beacon with lag().
src_ip <<= '203.0.113.0/24'an address range · from the indexAgency logs, patches and records
Sign-ins, scan findings and records in one engine: count a password spray per address, set patch deadlines from CISA's KEV catalog and find the records a request asks for by phrase.
@@ ts_phrase('change order')records request · phrase searchCommerce & media
Catalogs, campaigns and players: the words people type and the events they leave, searched and counted in one engine.
Product search with typos and facets
Typo-tolerant BM25 over the catalog with ts_levenshtein, the store's synonyms, facet counts from the index and vector similarity, in one query over the product table.
@@ ts_levenshtein('runing', 1)typo tolerance · ranked by bm25Clickstream, funnels and attribution
Impressions, clicks and site events in one engine: sessions from the gaps between events, funnel steps with FILTER, last-click credit with ASOF JOIN and creative search with BM25.
ASOF JOIN clicks ceach purchase · the click before itPlayer events, cohorts and chat
Daily players, day-1 and day-7 retention and the new-player funnel from one event table, live dashboards, and chat search that still finds gems with a typo.
@@ ts_levenshtein('gems', 1)chat search · one typoFinance, health & industry
Payments, clinical notes, call records and sensor readings, with the text written beside them searchable in the same SQL tables.
Fraud rules, AML and reporting
Fraud rules as window functions over a card's payments, watchlist screening that survives typos with ts_levenshtein, and payments ranked by vector distance to a reported fraud.
@@ ts_levenshtein('kesling', 1)watchlist screening · one typoClinical notes and cohorts in SQL
BM25 over clinical notes with medical synonym groups, so htn finds hypertension, and typo tolerance, next to visits and diagnosis codes: one query counts the cohort the notes describe.
@@ ts_levenshtein('metfromin', 1)clinical notes · one typoCDRs, network logs and tickets
Call detail records, the network log and trouble tickets in one engine: dropped-call rates per cell, the alarm behind each call with ASOF LEFT JOIN, and the customers it hit.
@@ ts_phrase('feeder connector')network log · phrase searchSensor data and machine logs
Sensor readings in time buckets, a machine log searched with typo tolerance, and each alarm joined to the reading at that moment with ASOF JOIN.
time_bucket(INTERVAL '1 hour', ts)sensor drift · per hourEvery walkthrough ran on SereneDB 26.11.2
Each page's data is invented for it, from an hour of security logs to a shift on four machines, and every statement and result on the page ran on SereneDB 26.11.2 from an empty database; the notes under each step are that run's output. Claims about other systems link to those systems' own documentation. Performance figures come from SearchBench (commit c3e7fe9: 1 billion OpenTelemetry log rows, 92 queries, 11 engines in 17 configurations, SereneDB 26.09.1), whose queries, settings and scripts are published.