ClickHouse

4 posts about ClickHouse. Every summary links to the original.

Clickhouse · Sep 1, 2026
ClickHouse welcomes RunReveal
ClickHouse has acquired RunReveal, a company that built a security data platform on ClickHouse, and says the team’s expertise will become part of its work in security. The announcement frames security as a demanding data workload involving cloud audit logs, identity events, endpoint telemetry, and network flows, with continuous high-throughput ingest, years-long retention, and interactive query requirements. ClickHouse says the acquisition will bring sharper reference architectures, guidance on schema and retention design, and a clearer connection between customer requirements and its database roadmap, while RunReveal remains available through a bring-your-own-database model. Existing RunReveal customers will continue to receive platform support under unchanged contract terms, and the team’s work on agentic investigation is expected to inform support for analytics involving agents that hunt across sources, tune detections, and advance investigations.
Clickhouse · Sep 1, 2026
How Uken Games reduces observability costs by 87% with ClickHouse
Uken Games replaced Datadog with an open-source observability stack built around ClickHouse to monitor backend services supporting mobile games with millions of players. The migration addressed rising Datadog costs and vendor lock-in while targeting pragmatic feature parity across metrics, traces, and logs. OpenTelemetry collectors run in two layers: lightweight agents on ECS instances pre-filter traces, while an autoscaling gateway batches and buffers writes to SigNoz on ClickHouse; managed Prometheus handles metrics, CloudWatch retains logs, and Grafana provides dashboards and alerts. Uken samples ordinary traces, retains errors and high-latency requests, computes alert metrics without sampling, and limits retention to two weeks. The resulting system stores all traces on one ClickHouse node using about 170 GB, operates without migration downtime, and costs about $12,000 annually—an 87% reduction.
Ramp · Apr 16, 2026
Building a Unified Pipeline for AI Token Spend
AI token spend is volatile, consumption-based, and distributed across teams, making usage and cost difficult to monitor. Ramp's pipeline ingests LiteLLM and OpenRouter events through authenticated, tenant-scoped webhooks, Kafka, and ClickHouse, then aggregates them for REST dashboards and AI-generated forecasts. LiteLLM uses callbacks with token counts and metadata, while OpenRouter sends OTLP traces; ReplacingMergeTree deduplicates replayed events using business_id, source, and event_id. Customers can connect gateways with an API key, configure LiteLLM callbacks or OpenRouter Broadcast, and pass attribution metadata. The resulting visibility supports breakdowns by provider, model, department, user, project, and use case, and exposed phantom Gemini reasoning tokens after a LiteLLM upgrade, geo pricing premiums, runaway loops, and prompt bloat.
Kedar Thakkar, Richard Wang, Veeral Patel
Ramp · Jan 15, 2025
From RAG to Richness: How Ramp Revamped Industry Classification
Ramp's former industry classification system combined third-party data, sales-entered information, and customer self-reporting, creating inconsistent, overly broad, and unauditable categories. Precise classification was needed for compliance, portfolio monitoring, sales targeting, and product analytics, despite fuzzy boundaries, sparse data, and no ground truth. Ramp migrated to six-digit NAICS codes and built an in-house Retrieval-Augmented Generation model that embeds business data, retrieves candidate codes, and uses an LLM to select a final prediction. The system evaluates retrieval with accuracy-at-k and final predictions with a hierarchy-aware fuzzy-accuracy metric, while ClickHouse stores knowledge-base embeddings and Kafka logs intermediate results. Deployed guardrails validate output codes, and the model has improved data quality, consistency, auditability, and control over tuning and costs.
Ryne Carbone

ClickHouse has acquired RunReveal, a company that built a security data platform on ClickHouse, and says the team’s expertise will become part of its work in security. The announcement frames security as a demanding data workload involving cloud audit logs, identity events, endpoint telemetry, and network flows, with continuous high-throughput ingest, years-long retention, and interactive query requirements. ClickHouse says the acquisition will bring sharper reference architectures, guidance on schema and retention design, and a clearer connection between customer requirements and its database roadmap, while RunReveal remains available through a bring-your-own-database model. Existing RunReveal customers will continue to receive platform support under unchanged contract terms, and the team’s work on agentic investigation is expected to inform support for analytics involving agents that hunt across sources, tune detections, and advance investigations.

How Uken Games reduces observability costs by 87% with ClickHouse

Uken Games replaced Datadog with an open-source observability stack built around ClickHouse to monitor backend services supporting mobile games with millions of players. The migration addressed rising Datadog costs and vendor lock-in while targeting pragmatic feature parity across metrics, traces, and logs. OpenTelemetry collectors run in two layers: lightweight agents on ECS instances pre-filter traces, while an autoscaling gateway batches and buffers writes to SigNoz on ClickHouse; managed Prometheus handles metrics, CloudWatch retains logs, and Grafana provides dashboards and alerts. Uken samples ordinary traces, retains errors and high-latency requests, computes alert metrics without sampling, and limits retention to two weeks. The resulting system stores all traces on one ClickHouse node using about 170 GB, operates without migration downtime, and costs about $12,000 annually—an 87% reduction.

Building a Unified Pipeline for AI Token Spend

AI token spend is volatile, consumption-based, and distributed across teams, making usage and cost difficult to monitor. Ramp's pipeline ingests LiteLLM and OpenRouter events through authenticated, tenant-scoped webhooks, Kafka, and ClickHouse, then aggregates them for REST dashboards and AI-generated forecasts. LiteLLM uses callbacks with token counts and metadata, while OpenRouter sends OTLP traces; ReplacingMergeTree deduplicates replayed events using business_id, source, and event_id. Customers can connect gateways with an API key, configure LiteLLM callbacks or OpenRouter Broadcast, and pass attribution metadata. The resulting visibility supports breakdowns by provider, model, department, user, project, and use case, and exposed phantom Gemini reasoning tokens after a LiteLLM upgrade, geo pricing premiums, runaway loops, and prompt bloat.

Kedar Thakkar, Richard Wang, Veeral Patel

From RAG to Richness: How Ramp Revamped Industry Classification

Ramp's former industry classification system combined third-party data, sales-entered information, and customer self-reporting, creating inconsistent, overly broad, and unauditable categories. Precise classification was needed for compliance, portfolio monitoring, sales targeting, and product analytics, despite fuzzy boundaries, sparse data, and no ground truth. Ramp migrated to six-digit NAICS codes and built an in-house Retrieval-Augmented Generation model that embeds business data, retrieves candidate codes, and uses an LLM to select a final prediction. The system evaluates retrieval with accuracy-at-k and final predictions with a hierarchy-aware fuzzy-accuracy metric, while ClickHouse stores knowledge-base embeddings and Kafka logs intermediate results. Deployed guardrails validate output codes, and the model has improved data quality, consistency, auditability, and control over tuning and costs.

Ryne Carbone