Tenzir review
A programmable, open-source telemetry pipeline for security-data workflows.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Tenzir is a programmable data pipeline engine for security teams that need to collect, transform, enrich, store, query, and route telemetry. It supports logs, metrics, and traces, including OpenTelemetry ingestion over OTLP/HTTP and OTLP/gRPC. Security teams can deploy locally, use the hosted platform, or choose a self-hosted platform for air-gapped or on-premises environments. The product is especially suited to open-source teams building security-data workflows across SIEM, SOAR, XDR, and related systems.
Its core strength is the depth of its pipeline model. Tenzir Query Language pipelines can parse, reshape, normalize, enrich, and route telemetry through operations such as split, fork, publish, and load balancing. Enrichment supports lookup tables, GeoIP databases, and Bloom filters, while indexed or columnar storage supports security-data querying. AI agents can generate pipelines from natural-language intents. The free Community plan includes the Platform API and community support, with limits of 1 TB/day ingress and 1 TB edge storage. Enterprise adds external secrets, RBAC, audit logs, and 24x7 support with SLAs. Sovereign adds on-premise deployment, multiple platform instances, a custom identity provider, and dedicated support.
Tenzir also fits environments with varied data destinations. Its integrations include Kafka, Amazon Kinesis, NATS, ClickHouse, Apache Iceberg, Snowflake, Splunk, OpenSearch, Elasticsearch, Amazon SQS, and Google Cloud Pub/Sub. The web platform manages nodes, pipelines, and dashboards, while web, macOS, Linux, and API access support different operating models. Teams that want strong control over telemetry processing, deployment, and routing should consider Tenzir. Organizations needing usage beyond the Community limits should evaluate the paid tiers with sales, while teams seeking a simpler, narrower pipeline tool may prefer a less programmable option.
Tenzir pros and cons
- Where it wins
- Supports OpenTelemetry logs, metrics, and traces
- TQL handles transformation, enrichment, storage, and routing
- Open-source deployment with hosted, local, and self-hosted options
- Where it doesn't
- Community ingress is limited to 1 TB/day
- Community edge storage is limited to 1 TB
- Enterprise and Sovereign pricing requires contacting sales
Tenzir fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update