Roadmap
What is next, as open issues.
This page is the engine repository’s open issues labelled phase-1b and phase-2, grouped by phase and refreshed every hour. Each links to GitHub, where the discussion is. Nothing here is a promise of a date; the project is pre-release and the order changes as the work does.
The eight features the owner wants next
Written down in the repository’s TODO.md on 7 November 2026, each with an issue.
- #28
Grow disk space without losing the datastore
Add a volume to the storage policy as a JBOD disk, rebalance in the background, drain before removing one, and a Health check that forecasts when the disk fills.
- #29
Tenant configuration kept in git
Inputs, sourcetypes, dashboards, saved searches, users and roles written to a local bare repository on every change, never secrets, with an optional external remote and a history page.
- #30
10 million events per hour, measured
A load generator over syslog, HEC and JSON, measured ingest lag, buffers, inserts, CPU and memory per service and search latency under load, then tuning and a sizing table.
- #31
A library of common sourcetypes
A shipped, versioned set (nginx, Apache, syslog, journald, Linux auth, Docker and Kubernetes JSON, HAProxy, PostgreSQL, MySQL, Windows events, cloud audit logs) importable as a copy that can be changed.
- #32
A Dashboards page that sets the built-ins apart
Self-monitoring dashboards that ship with the engine in their own read-only section, and tenant dashboards with owner, last change, a thumbnail, tags, favorites and a filter.
- #33
Health page trends
Memory, disk and network over an hour, a day or a week per service, drawn from a new _metrics index so every chart is also a search anyone can run.
- #34
An Inputs page by type
Inputs grouped by type with a card per input showing state and recent events, create and edit forms that validate as the CLI does, a sample test, and an Apply that shows the Vector diff first.
- #35
RBAC with roles
readonly, user, power and admin roles made of named capabilities, per-index access enforced where the planner resolves index=, SSO group mapping, and an audited Roles page.
The live list could not be loaded: GitHub refused the site's token (HTTP 404). The full list is on GitHub.
Phase 1b
After the phase 1 command set: the features above, transaction and join, saved searches and alerts, SSO.
Phase 2
Cold storage tiering, vulnerability management on CIM data, a Sigma rule runner, metrics search, packaging.
Older issues (phase-1) and everything closed are on the issues page.