Lightstep (now ServiceNow Cloud Observability): product and architecture
This Lightstep review examines one of the most significant observability platforms to emerge from the distributed tracing movement. Founded by Ben Sigelman, co-creator of Google's Dapper tracing system, Lightstep built its reputation on deep OpenTelemetry integration and change intelligence capabilities before being acquired by ServiceNow in 2023. Now operating as ServiceNow Cloud Observability, the platform continues to serve engineering teams that need production-grade distributed tracing, metrics analysis, and real-time incident correlation. For organizations already invested in OpenTelemetry instrumentation, Lightstep remains a compelling option worth evaluating against the broader observability market.
Overview
Lightstep launched in 2015 with a singular focus: make distributed tracing practical for large-scale microservices architectures. The platform was purpose-built around the OpenTelemetry standard from its earliest days, giving it a natural advantage as OTel became the industry-standard instrumentation framework. Unlike legacy APM tools that rely on proprietary agents, Lightstep ingests telemetry directly from OpenTelemetry collectors and SDKs, which means teams avoid vendor lock-in at the instrumentation layer.
The ServiceNow acquisition brought enterprise distribution muscle and deeper ITSM integration, though it also introduced questions about the product's long-term independent identity. Today, the platform sits within ServiceNow's broader IT Operations portfolio, connecting observability data to incident management, change management, and service mapping workflows. The core technology still revolves around three pillars: distributed tracing with full-fidelity span analysis, metrics correlation through its Change Intelligence engine, and service-level objective (SLO) monitoring that ties reliability targets to business outcomes.
Key Features and Architecture
Lightstep's architecture is built on a streaming analytics engine that processes 100% of trace data without sampling at ingest time. This is a critical differentiator. Many competing platforms sample traces before storage, which means rare but important errors can be lost. Lightstep's approach captures every span, analyzes it in real-time, and stores representative exemplars along with full statistical aggregations. The result is that engineers get accurate latency percentiles and error rates without the blind spots that sampling introduces.
Change Intelligence is the platform's flagship analytical capability. When a deployment, configuration change, or infrastructure event occurs, Change Intelligence automatically correlates performance regressions to the specific change that caused them. It does this by comparing pre-change and post-change trace data across multiple dimensions: service, operation, deployment version, and infrastructure attributes. This capability dramatically reduces mean time to resolution for incidents triggered by deployments.
Service Health and SLO Monitoring lets teams define service-level objectives tied to specific operations and then track error budgets over rolling time windows. The SLO views are not just dashboards; they connect directly to alerting policies and can trigger PagerDuty or Slack notifications when burn rates indicate an objective is at risk.
Unified Query Language (UQL) provides a single syntax for querying traces, metrics, and spans. Engineers can pivot from a high-level service map view down to individual traces, filter by arbitrary span attributes, and construct complex aggregations without switching tools or learning multiple query languages. UQL supports grouping, filtering, rate calculations, and percentile functions.
OpenTelemetry-Native Ingest means no proprietary agent installation. Teams instrument their services with standard OTel SDKs (available in Go, Java, Python, Node.js, .
NET, Ruby, and more) and point the OTel Collector at Lightstep's ingest endpoint. This architecture also makes it straightforward to send the same telemetry to multiple backends simultaneously.
Notebooks and Collaboration features allow engineers to save and share investigative workflows. During an incident, an engineer can assemble a notebook with relevant traces, metrics correlations, and annotations, then share it with the team for post-incident review.
Ideal Use Cases
Lightstep fits organizations running distributed microservices at meaningful scale, typically 50+ services, where tracing is not optional but a daily operational necessity. Platform engineering teams that have already standardized on OpenTelemetry will find the migration path to Lightstep straightforward, since there are no proprietary agents to deploy or manage.
The Change Intelligence feature makes Lightstep particularly strong for organizations with high deployment velocity. Teams shipping dozens of changes per day benefit from automated correlation between deployments and performance regressions. This is harder to achieve with general-purpose observability tools that lack built-in change awareness.
ServiceNow shops gain additional value from native ITSM integration. If your organization already uses ServiceNow for incident management, change management, or CMDB, Lightstep's telemetry data flows directly into those workflows without custom integration work. This makes it a natural fit for enterprises consolidating their IT operations toolchain under the ServiceNow umbrella.
Smaller teams or startups with fewer than 20 services may find the platform over-engineered for their needs, and the ServiceNow sales process adds friction for quick evaluations.
Pros and Cons
Pros:
- Full-fidelity trace analysis without destructive sampling at ingest
- Change Intelligence automates deployment-to-regression correlation
- Native OpenTelemetry support eliminates proprietary agent dependencies
- SLO monitoring with error budget tracking and burn rate alerting
- Deep ServiceNow ITSM and CMDB integration for enterprise workflows
- UQL provides a single query language across traces, metrics, and spans
Cons:
- Pricing is no longer publicly listed; requires ServiceNow sales engagement
- The acquisition introduced branding confusion (Lightstep vs. ServiceNow Cloud Observability)
- Log management capabilities lag behind dedicated logging platforms
- Smaller teams face a steep procurement process compared to self-serve competitors