Netflix Builds Ontology-Driven Knowledge Graph to Streamline Incident Context Assembly

Netflix engineers face a "needle in a haystack" problem when debugging issues across a system handling 2 billion requests and 38 million logging events per second. Traditional observability tools (MELT: Metrics, Events, Logs, Traces) provide raw data but lack the semantic relationships needed to quickly identify root causes, often leading to four-hour investigation timelines dominated by manual context assembly.

The Observability Ontology

To solve this, Netflix built The Observability Ontology, a machine-readable agreement on entity types and relationships using the W3C stack (RDF, OWL, SHACL, SPARQL). This layer standardizes how disparate systems like Atlas, Radar, incident.io, and Spinnaker refer to applications, services, and incidents. The data is stored in QuipuDB, a distributed quad store based on redb, allowing complex queries like "Which incidents affected applications owned by Team Bedrock in us-east-1?" to be answered in a single step.

Determinism from Non-Determinism

The system uses LLMs and fuzzy matching to process unstructured data, such as Slack incident channels, but enforces determinism through a strict type system. A five-layer pipeline reduces entropy, ensuring that stochastic outputs from agents are constrained into valid, typed triples. Key design decisions include:

• Strict Validation: Every ops:Application is validated against a catalog of 49,000 entries.
• Sequential Enrichment: Enrichers run in order to prevent race conditions, prioritizing accuracy over speed.
• Correlation Engine: Identifies causal chains from 13 signal types (e.g., deployments, log errors) within a 10-minute window, discarding hypotheses with confidence below 0.6.

Impact and Future Work

The graph powers AutoRCA, an agentic AI solution that provides ranked, evidence-backed hypotheses to engineers. While the alert and fix processes remain human-led, the ontology absorbs the time-consuming task of reconstructing system context. Netflix plans to integrate this ontology with Upper, its domain-modeling language, to create a broader semantic layer for automated remediation and self-healing infrastructure.