Ontology-Driven Observability

Ontology-driven observability connects telemetry (metrics, events, logs and traces) with the other facts engineers need during an incident, such as ownership, deployments, incidents and past discussions, in a knowledge graph whose entity types and relationships are defined by an ontology. Because every tool's data is mapped to the same vocabulary, one query can follow a chain from user impact to a likely cause.

The ontology is a formal agreement about what kinds of things exist, what properties they have and how they relate. Instead of each tool calling the same thing an application, a service or a cluster, they all map to one defined type with one identity. People and software agents then read and write the same vocabulary.

According to Netflix's QCon London 2026 talk and independent summaries, Netflix built an Observability Ontology implemented as a knowledge graph using RDF, OWL, SHACL and SPARQL. Enrichment pipelines turn telemetry, incident and chat data into validated triples, a correlation engine proposes ranked causal hypotheses, and multi-agent AutoRCA reads the same vocabulary. Netflix describes it as early, with hypotheses that are sometimes wrong and no published accuracy or time-saved figures.

Semantic conventions standardise attribute names and meanings inside telemetry such as service.name or http.request.method. An ontology covers a wider scope: entity types and relations that also include incidents, deployments, teams, alerts and discussions, with validation rules. The two complement each other, and conventions are a natural source of identity for the ontology.

No. The graph supplies structured context and preserves the evidence behind a hypothesis. Temporal or statistical correlation can still point at the wrong cause, so engineers and agents should check hypotheses against actual telemetry before acting.

The W3C stack is common: RDF for the triple model, OWL for the ontology, SHACL for validation and SPARQL for queries, with Turtle for readable snapshots. Property graph databases are also used, sometimes with RDF import tools such as Neosemantics.

Designing and governing the ontology, keeping entity identity clean, integrating many systems and maintaining the graph all take sustained effort. Poor identity rules create false joins that mislead downstream agents. Start with a small set of entities that matter in your incidents and grow from there.

Links were checked in November 2026. Some sites block automated checks and may need a manual click. Netflix details come from its talk and independent summaries, since its own post could not be read by an automated checker. This page is a resource list, not engineering advice.