For the short version, read How aiAxonIQ works.
This page is the same path with the reasoning left in.
The path your data takes
1
Your exporter sends OTLP
An OpenTelemetry SDK, a Collector, a Prometheus server or the zero-code
agent. All four speak standard protocols; none of them is aiAxonIQ-specific
software. See Ingest endpoints.
2
The receiver authenticates and stamps the record
It validates your license key, applies rate limits, and attaches the
organization the key belongs to. Then it acknowledges the request.
3
A streaming buffer holds the batch
Acknowledgement happens here, before storage. This is what keeps ingest
available when a storage node is slow, and it is why
202 Accepted means
accepted, not stored.4
Workers batch and write
A worker per signal reads the buffer and writes to the analytical store,
flushing at 50,000 rows or five seconds, whichever comes first.
5
You query
The dashboard and the API read from whichever store answers the question,
with a short response cache in front.
Why acknowledgement comes before storage
The alternative — hold your request open until the row is committed — sounds safer and is worse. It couples your application’s latency to the platform’s write path, so a slow compaction becomes your outage. It also makes every exporter retry a duplicate.The practical consequence: a five-second floor between sending and seeing.
On a busy account the row-count flush wins and it is much faster. On a quiet
new account nothing else is arriving, so you wait out the five-second timer.
That is why the Quickstart tells you to wait ten
seconds before looking, and why “I sent it and it is not there” is almost
never a real problem in the first ten seconds.
Four stores, four jobs
The platform does not use one database, because the four questions you ask have genuinely different shapes. Which store answers a question determines how fast it is, how far back it goes, and what syntax it accepts.Rollups: why old metrics survive and old logs do not
As metrics are written, the analytical store continuously maintains pre-aggregated one-minute and one-hour tables. A dashboard asking for a month of data reads the hourly table — thousands of rows instead of hundreds of millions. This is invisible until it isn’t:- A wide time range is served at coarser resolution. A 30-day chart cannot show a 15-second spike, because the row it reads is an hour wide.
- A record just written is in the raw table before it is in the rollup. A fresh record can therefore be genuinely absent from a “last 24 hours” view while being present on “last 15 minutes”. This is the single most common reason a first-install record appears to be missing.
- Metrics outlive logs. Raw telemetry is deleted after 30 days; the hourly metric rollup is kept for a year. See Data retention.
Tenancy is applied on the way in
Your organization’s identifier is attached by the receiver, derived from the license key. It is never read from the payload, so an exporter cannot claim to be someone else by setting an attribute — and equally, you cannot route data to a different organization by editing your resource attributes. The key decides. Every query then filters on it. See Organizations and multi-tenancy.The AI service
Anomaly detection, forecasting, natural-language query, log clustering and retrieval-augmented answers run in a separate service. It is never reachable from the internet and never from your network: the only caller is the aiAxonIQ API, on your behalf, for your organization. See AI features.What this means for you
Accepted is not queryable
The five-second flush, and the three places to look before concluding data
is lost.
Retention differs by signal
30 days raw, 90 days at minute resolution, a year at hour resolution.
Your data is isolated by key
What an organization is, and what crosses between them.
Nothing here is proprietary
Standard OTLP in, standard OTLP everywhere. Point the same exporter
elsewhere and it works.