In four minutes, checkout breaks.
Beforemath replays production incidents from your logs and traces, every pane at the same second. Scrub forward to the page, or back to the deploy that caused it.
Start free trialHow the nine minutes look
One field, your work email. 14 days, no card, your data in the EU or US. Plans from $49 a month, example price.
03:09:52you are heredrag, or use the arrow keysdrag
Drag the playhead or use the arrow keys. Every pane shows the state at that second.
Logsfilter: WARN and above, deploys, sampled requests; up to 03:09:52
- INFOcheckout-apiGET /healthz 200 in 2 ms
- INFOcheckout-apiPOST /checkout 200 in 198 ms trace 5c1e04
- INFOpgbouncerpool ready: max 40 server connections
- INFOdeploycheckout-api v2.31.0 rollout complete, 6/6 pods ready
- INFOcheckout-apiPOST /checkout 200 in 212 ms trace 9b4d71
- WARNcheckout-apipg.query SELECT items FROM carts WHERE user_id = $1 took 612 ms (slow > 500 ms)
- WARNpgbouncerpool 26/40 in use, 0 waiting
- WARNcheckout-apipg.query SELECT items FROM carts WHERE user_id = $1 took 840 ms (slow > 500 ms)
- INFOcheckout-apiPOST /checkout 200 in 1,046 ms trace 2e77c9
- WARNpgbouncerpool 38/40 in use, 4 waiting
- WARNpgbouncerpool 40/40 in use, 12 waiting
- ERRORcheckout-apipg.query canceling statement due to statement timeout (2,000 ms) trace 7f3a2b
- ERRORcheckout-apiPOST /checkout 503 in 2,412 ms trace 7f3a2b
- ERRORcheckout-apiPOST /checkout 503 in 2,405 ms trace c018e5
- WARNautoscalercheckout-api cpu 31 %, no scale-out
- ERRORcheckout-apiPOST /checkout 503 in 2,409 ms trace 61aa0f
- WARNprom-rules5xx ratio 18 % over 60 s, CheckoutErrorRateHigh pending
- ERRORcheckout-apiPOST /checkout 503 in 2,418 ms trace e35b98
- WARNprom-rules5xx ratio 41 % over 60 s, CheckoutErrorRateHigh pending
- CRITalertsCheckoutErrorRateHigh fired, paging on-call
Tracelast request before the playhead
No request before the playhead yet.
POST /checkout200198 mstrace 5c1e04
- auth.verify12 ms
- cart.load17 ms
- pool.acquire2 ms
- pg.query carts134 ms
- payments.charge28 ms
- http.response5 ms
POST /checkout200212 mstrace 9b4d71
- auth.verify12 ms
- cart.load19 ms
- pool.acquire2 ms
- pg.query carts148 ms
- payments.charge26 ms
- http.response5 ms
POST /checkout2001,046 mstrace 2e77c9
- auth.verify12 ms
- cart.load18 ms
- pool.acquire144 ms
- pg.query carts840 ms
- payments.charge27 ms
- http.response5 ms
POST /checkout5032,412 mstrace 7f3a2b
- auth.verify12 ms
- cart.load31 ms
- pool.acquire348 ms
- pg.query carts2,004 ms, timeout
- payments.chargenot reached
- http.response17 ms
POST /checkout5032,409 mstrace 61aa0f
- auth.verify11 ms
- cart.load30 ms
- pool.acquire356 ms
- pg.query carts2,004 ms, timeout
- payments.chargenot reached
- http.response8 ms
POST /checkout5032,418 mstrace e35b98
- auth.verify12 ms
- cart.load29 ms
- pool.acquire367 ms
- pg.query carts2,005 ms, timeout
- payments.chargenot reached
- http.response5 ms
Three seconds an alert never shows you
The page fires at 03:14:00. By then the cause is nine minutes old. Beforemath keeps those minutes on the timeline, with the logs, the trace and the series at every second. Here is the whole window, outage included, and three of its seconds:
-
T−08:4203:05:18
The deploy nobody connects to the page
v2.31.0 rolls out clean, six of six pods ready. Ninety seconds later the first query on carts crosses the slow threshold. In the replay the deploy line and the slow query sit two lines apart.
- INFOdeploycheckout-api v2.31.0 rollout complete, 6/6 pods ready
- WARNcheckout-apipg.query SELECT items FROM carts WHERE user_id = $1 took 612 ms (slow > 500 ms)
Logs at this second, sample data -
T−04:1003:09:50
The pool saturates, two seconds before the first error
40 of 40 connections in use, 12 requests waiting. The next checkout waits 348 ms for a connection, then Postgres cancels its query at the 2,000 ms statement timeout. Payments is never reached.
- pool.acquire348 ms
- pg.query carts2,004 ms, timeout
- payments.chargenot reached
Trace 7f3a2b at 03:09:52, sample data -
T−00:0003:14:00
The page, where your investigation usually starts
5xx ratio at 52 %, CheckoutErrorRateHigh pages the on-call. Without a replay this is second zero. With Beforemath the nine minutes before it are already on the timeline.
- CRITalertsCheckoutErrorRateHigh fired, paging on-call
Sample data
03:14:01one second after the page
Next time, the replay is already waiting
Beforemath records nothing new. It reads the logs and traces you already ship, puts every row on one clock, and hands you a playhead. Three steps, and the first one happened before the page fired.
-
Ship what you already ship
Your collector keeps sending logs, traces and deploy markers to one endpoint. Nothing changes inside the services; the rows below are the ones the sample incident arrived with.
- INFOpgbouncerpool ready: max 40 server connectionsvia syslog
- INFOdeploycheckout-api v2.31.0 rollout complete, 6/6 pods readyvia CI webhook
- spancheckout-api7f3a2b POST /checkout 503, 6 spans, 2,412 msvia OTLP/gRPC
Three rows of INC-2291 as they arrived, sample data -
Every row lands on one clock
A log line, a span and a derived series are aligned to the second they happened, not the second they arrived. This lane is bound to the playhead above: scrub the hero and it follows.
p99 latencyplayhead03:09:52
log lines up to here13
last sampled trace7f3a2b, 503
Every pane at the same second, sample data -
Scrub to the second, read the trace
From here the page's own scroll is the scrubber: it runs the same playhead as the hero from 03:09:52 to the page at 03:14:00, with every pane following. Drag, play at 8x or use the arrow keys instead whenever you like.
03:09:52you are heredrag, or use the arrow keysdrag
p99 latencypool in use (pgbouncer)5xx ratioLogsfilter: WARN and above, deploys, sampled requests; up to 03:09:52
- INFOcheckout-apiGET /healthz 200 in 2 ms
- INFOcheckout-apiPOST /checkout 200 in 198 ms trace 5c1e04
- INFOpgbouncerpool ready: max 40 server connections
- INFOdeploycheckout-api v2.31.0 rollout complete, 6/6 pods ready
- INFOcheckout-apiPOST /checkout 200 in 212 ms trace 9b4d71
- WARNcheckout-apipg.query SELECT items FROM carts WHERE user_id = $1 took 612 ms (slow > 500 ms)
- WARNpgbouncerpool 26/40 in use, 0 waiting
- WARNcheckout-apipg.query SELECT items FROM carts WHERE user_id = $1 took 840 ms (slow > 500 ms)
- INFOcheckout-apiPOST /checkout 200 in 1,046 ms trace 2e77c9
- WARNpgbouncerpool 38/40 in use, 4 waiting
- WARNpgbouncerpool 40/40 in use, 12 waiting
- ERRORcheckout-apipg.query canceling statement due to statement timeout (2,000 ms) trace 7f3a2b
- ERRORcheckout-apiPOST /checkout 503 in 2,412 ms trace 7f3a2b
- ERRORcheckout-apiPOST /checkout 503 in 2,405 ms trace c018e5
- WARNautoscalercheckout-api cpu 31 %, no scale-out
- ERRORcheckout-apiPOST /checkout 503 in 2,409 ms trace 61aa0f
- WARNprom-rules5xx ratio 18 % over 60 s, CheckoutErrorRateHigh pending
- ERRORcheckout-apiPOST /checkout 503 in 2,418 ms trace e35b98
- WARNprom-rules5xx ratio 41 % over 60 s, CheckoutErrorRateHigh pending
- CRITalertsCheckoutErrorRateHigh fired, paging on-call
Tracelast request before the playhead
No request before the playhead yet.
POST /checkout200198 mstrace 5c1e04
- auth.verify12 ms
- cart.load17 ms
- pool.acquire2 ms
- pg.query carts134 ms
- payments.charge28 ms
- http.response5 ms
POST /checkout200212 mstrace 9b4d71
- auth.verify12 ms
- cart.load19 ms
- pool.acquire2 ms
- pg.query carts148 ms
- payments.charge26 ms
- http.response5 ms
POST /checkout2001,046 mstrace 2e77c9
- auth.verify12 ms
- cart.load18 ms
- pool.acquire144 ms
- pg.query carts840 ms
- payments.charge27 ms
- http.response5 ms
POST /checkout5032,412 mstrace 7f3a2b
- auth.verify12 ms
- cart.load31 ms
- pool.acquire348 ms
- pg.query carts2,004 ms, timeout
- payments.chargenot reached
- http.response17 ms
POST /checkout5032,409 mstrace 61aa0f
- auth.verify11 ms
- cart.load30 ms
- pool.acquire356 ms
- pg.query carts2,004 ms, timeout
- payments.chargenot reached
- http.response8 ms
POST /checkout5032,418 mstrace e35b98
- auth.verify12 ms
- cart.load29 ms
- pool.acquire367 ms
- pg.query carts2,005 ms, timeout
- payments.chargenot reached
- http.response5 ms
03:04:12the first row of the sample incident
What it reads, in the formats you already ship
No agent and no SDK. Every row of INC-2291 came in through one of the paths marked in the sample; the rest are planned and listed so you can see what's missing.
| First row | Source | Format or protocol | Status |
|---|---|---|---|
| 03:04:12 | checkout-api logs | Kubernetes pod logs, JSON lines | in the sample |
| 03:04:31 | checkout-api traces | OpenTelemetry, OTLP/gRPC | in the sample |
| 03:05:00 | pgbouncer | syslog, RFC 5424 | in the sample |
| 03:05:18 | deploy markers | one webhook from GitHub Actions, GitLab CI or Argo CD | in the sample |
| 03:11:07 | autoscaler | Kubernetes events | in the sample |
| 03:14:00 | alerts | Prometheus Alertmanager webhook, PagerDuty | in the sample |
| --:--:-- | other traces | OTLP/HTTP, Jaeger, Zipkin | planned |
| --:--:-- | other logs | Loki push, Fluent Bit, Vector, CloudWatch export | planned |
| --:--:-- | other alerts | Opsgenie, Grafana alerting | planned |
| --:--:-- | past windows | import from your log store | planned |
Product and vendor names are plain text; none of them endorses Beforemath, a fictional product.
+30dwhen INC-2291 leaves a Team workspace, 30 days of retention
One log line, from your collector to deletion
The same waterfall you read for a request, drawn for the row itself. What's planned says planned, and no certificate is claimed on this page.
one log linefive stages in order, not to scalethen deleted
- ingest.tlsTLS 1.3 from your collector, one token per workspace
- redactbuilt-in patterns plus your field list, before anything is written
- alignthe row joins the timeline at its own second
- storeencrypted at rest, in the region you picked: EU or US
- deleteat the end of your retention; backup window [follows]
- SOC 2 Type II
- planned
- ISO 27001
- planned
- Penetration test
- [report follows]
- Data processing agreement
- [template follows]
- Subprocessors
- [list follows]
- Data residency
- EU or US region, chosen at sign-up
- Single sign-on
- SAML on the Scale plan
- Audit log
- on the Scale plan
Placeholders in brackets are documents that don't exist yet. Ask for them in the demo request and they'll be the first thing you get.
400dthe farthest a playhead can go back
Priced by how far back you can scrub
Three plans, one difference that matters on call: retention. Prices are examples for a fictional product, per workspace, billed monthly.
retentionhow far back the playhead goes, per planlog scale, 1 to 400 days
-
Free trial
Start free trial
Trial length on the same scale, not retention: fourteen days with every Team feature, then pick a plan or export your windows. No card up front.
-
Starter
Start free trial
$49 per workspace per month, example price. 3 services, unlimited seats, deploy markers from 1 pipeline, export of every window as JSON lines, EU or US region.
-
Team
Start free trial
$190 per workspace per month, example price. 15 services, unlimited seats, deploy markers from every pipeline, shared bookmarks on a second, JSON lines export, EU or US region.
-
Scale
Request a demo
$690 per workspace per month, example price. Unlimited services and seats, SAML single sign-on, audit log, a region of your choice, JSON lines export.
day 0from sign-up to your first replay, example plan
Fourteen days, and the first one does most of the work
The trial runs fourteen days in this example. This lane is your own timeline, still empty on day 0: it fills in the order below.
-
day 0minute one
Sign up, point your collector
Work email, EU or US, one token. One OTLP target for traces, your log forwarder for logs. Rows appear on the timeline as they arrive.
-
day 3one webhook
Add deploy markers
From now on every window carries its deploy line, the one the sample incident shows at 03:05:18.
-
day 7or whenever it breaks
Replay your first real incident
Open the page's second, scrub back to the deploy, read the trace. If nothing breaks, replay a slow afternoon instead. Import of past windows: planned.
-
day 14trial ends
Keep the workspace, or take the windows
Pick a plan, or export every window as JSON lines. Nothing is deleted on day 14 without a notice on day 12.
4questions, answered before the demo
What engineers ask first
Short answers. Anything longer belongs in the demo, with your own incident on the timeline.
Do I need to install an agent?
No. Beforemath reads from the collector you already run: OTLP for traces, your log forwarder for logs, one webhook for deploy markers. Nothing is added to the services.
- INFOpgbouncerpool ready: max 40 server connectionsvia syslog
- spancheckout-api7f3a2b, 6 spansvia OTLP/gRPC
Does personal data end up in the replay?
Only what you let through. Redaction runs before storage, with built-in patterns and your own field list. A redacted row stays on the timeline with its second intact.
- INFOcheckout-apiPOST /checkout 200 in 198 ms customer=j.doe@example.com trace 5c1e04
How long does a replay stay available?
As long as your plan's retention: 7, 30 or 400 days on the example plans. After that the window is deleted, and you can export it as JSON lines any time before.
Can I replay an incident from before I signed up?
Not yet. A replay starts with the first row that arrives. Importing a past window from your log store is planned, and the demo request below is the place to say you need it.
- PLANimportpast windows from your log store: planned, not on the timeline yet
T+00:30a thirty-minute walkthrough on your own incident
Request a demo
Bring one incident, or let the sample one run. You'll leave with a replay of it and a straight answer on whether Beforemath fits.