Logfire

Last updated: Nov 4, 2026

---

Rationale

Fluid Attacks uses Pydantic Logfire as the observability platform for its LLM components. Thus, Fluid Attacks does not have to maintain a different provider for AI tracing on top of its general observability stack.

With Logfire, Fluid Attacks gets these results:

• It gives first-party instrumentation for Pydantic AI in one line through logfire.instrument_pydantic_ai(). The same team that maintains Pydantic AI and Pydantic built it.
• It uses OpenTelemetry as its base. Thus, the same SDK that traces the agent also traces FastAPI, the MCP server, Bedrock calls, and the GraphQL client. Fluid Attacks does not have to use a different agent or collector.
• It has a Postgres-flavored SQL interface to query stored traces and logs. Thus, engineers can build all the reports that they want without a proprietary query language.
• It supports custom dashboards with charts that use SQL. Fluid Attacks uses them to monitor agent latency, token usage, guardrail results, tool-call frequency, and throttling retries.
• It includes 10M records/month (spans, logs, and metrics) on each paid plan. It charges $2 for each million more. It also has a configurable price cap that prevents unexpected bills.
• It costs $49 each month on the Team plan (5 seats) and $249 each month on the Growth plan (unlimited seats). The current traffic volume of Fluid Attacks is inside the included 10M records.
• Its SDK has the MIT license, and the cloud service is available in EU and US data regions.

Alternatives

Fluid Attacks used or evaluated these alternatives, and replaced or rejected them for Logfire.

LangSmith

LangSmith is the LLM observability platform of the LangChain team. Fluid Attacks used it before it moved to Logfire.

• It gives tracing, online and offline evaluations, a prompt hub, a playground, and monitoring dashboards by default.
• It does not have a first-party Pydantic AI integration. The instrumentation uses the LangChain/LangSmith SDKs or a generic OpenTelemetry bridge. Because the agents of Fluid Attacks use Pydantic AI, after each SDK upgrade, Fluid Attacks had to validate the bridge again.
• It uses a proprietary trace model, and not native OpenTelemetry. Thus, it is harder to correlate agent traces with the other FastAPI and MCP traces of Fluid Attacks.
• Its query and dashboarding UIs use filters. There is no SQL interface to build custom reports. Thus, users must export the data for custom analyses.
• Its price is for each seat and for each trace: $39 for each seat each month on the Plus plan, with 10k base traces included. Each 1k traces more costs $2.50, and the default retention is 14 days. Retention of 400 days costs $5.00 more for each 1k traces.
• For the trace volume and the team size of Fluid Attacks, this model was much more expensive than the flat, record-based pricing of Logfire.
• It has a proprietary license.

Datadog LLM Observability

Datadog LLM Observability is the LLM product inside Datadog. Fluid Attacks already uses Datadog for logs, metrics, and error tracking of all the platform (read the Datadog ADR).

• It correlates LLM spans with APM and RUM traces. This is useful for teams that want one view of backend, frontend, and AI workloads.
• It gives built-in evaluations for hallucinations, prompt injection, and data leaks, and cluster visualizations for output drift.
• It does not have a first-party Pydantic AI integration. Agents must use the ddtrace LLM Observability SDK of Datadog or OpenTelemetry for instrumentation. Both add custom wiring for each agent component that is important for Fluid Attacks.
• It charges for each LLM span, and it is a premium add-on on top of the current APM costs. When an account that already sends LLM spans adds LLM Observability, it automatically gets a large daily charge. This charge does not change with the number of spans that it uses.
• Its query layer is only for Datadog (tag filters and the log search DSL). There is no SQL interface for traces.
• It has a proprietary license.

Usage

Fluid Attacks uses Pydantic Logfire as the observability platform for each component that runs Pydantic AI agents or LLM calls, for example:

• Interacts: the AI Agent of the platform (FastAPI, Pydantic AI, MCP tools)
• Matches: LLM-backed matching workflows
• Fixes: SCA and code-fix agents that run as Lambda functions
• Sifts: LLM-assisted triage flows
• Explores: exploratory agents on platform data
• Traces: LLM agents that find the user flows of each entry point
• Bridges: the MCP server of the platform
• Reviews: the merge request reviews of FluidBot

Fluid Attacks uses it for these tasks:

• Distributed tracing of Pydantic AI agents (primary and helper models), guardrail evaluations, tool calls, and downstream HTTP/GraphQL requests
• Custom dashboards for agent latency, token usage, model throttling retries, and the number of turns in each session
• SQL-based investigations of one conversation or agent run at a time, when necessary, by span attributes

Fluid Attacks continues to send error-level logs to Datadog for alerts and for correlation with the other data of the platform.