ROOT
ROOT 6.42 rebuilds its Python interface on cppjit and moves Cling to LLVM 22.
Comparison · Analytics
Cortex vs NetObserv
A side-by-side editorial comparison of Cortex and NetObserv — release velocity, themes, recent moves, and the top alternatives to consider.
Cortex vs NetObserv: at a glance
What is Cortex?
Cortex 1.22 is on its fourth candidate, with sharded Parquet and years of deprecated flags removed.
Cortex 1.22.0 has been in release candidates since 12 September, reaching rc.3 on 6 October, and GitHub shows no final yet. The candidate adds sharded Parquet conversion and querying, resource-based query eviction that cancels the heaviest query when CPU or heap crosses a threshold, OCI Object Storage as a backend, and an active-series tracker per tenant. It also removes long-deprecated flags and config fields, some of which now stop Cortex from starting if left in place.
What is NetObserv?
NetObserv hit 2.0 without breaking changes, then started renaming its metrics.
NetObserv's operator reached 2.0.0 in September, labelled entirely non-breaking: BGP ASN enrichment through FRRConfiguration CRDs, DNS names in metrics, DNS port configuration in the FlowCollector API, stricter RBAC and network policies for the operator itself, and TLS settings taken from the OpenShift API server. 2.0.1 was fixes and dependency bumps. 2.0.2 fixes ASN labels and IPSec metrics, captures OpenSSL socket tuples at event time in the eBPF agent, and renames filtered_flows_total to filtered_packets_total.
Cortex vs NetObserv: editorial side-by-side
Cortex
2.5ANALYTICS
Cortex 1.22 is on its fourth candidate, with sharded Parquet and years of deprecated flags removed.
◆ Current state
Cortex 1.22.0 has been in release candidates since 12 September, reaching rc.3 on 6 October, and GitHub shows no final yet. The candidate adds sharded Parquet conversion and querying, resource-based query eviction that cancels the heaviest query when CPU or heap crosses a threshold, OCI Object Storage as a backend, and an active-series tracker per tenant. It also removes long-deprecated flags and config fields, some of which now stop Cortex from starting if left in place.
◆ Where it's heading
The storage arc toward Parquet continues: after 1.21 made Parquet a Store Gateway query mode, 1.22 shards files that exceed column limits. A second arc is protecting shared clusters from heavy tenants, through query eviction, resource-based throttling and concurrent data-byte limits on store gateways. The cleanup is the maturity arc from 1.21 carried further: no-op flags that were tolerated for releases now fail at startup.
◆ Prediction
1.22.0 final should follow rc.3, which added only two fixes. Operators should expect upgrade failures from leftover deprecated flags, and the release notes tell them to grep runtime configs before upgrading.
NetObserv
2.5ANALYTICS
NetObserv hit 2.0 without breaking changes, then started renaming its metrics.
◆ Current state
NetObserv's operator reached 2.0.0 in September, labelled entirely non-breaking: BGP ASN enrichment through FRRConfiguration CRDs, DNS names in metrics, DNS port configuration in the FlowCollector API, stricter RBAC and network policies for the operator itself, and TLS settings taken from the OpenShift API server. 2.0.1 was fixes and dependency bumps. 2.0.2 fixes ASN labels and IPSec metrics, captures OpenSSL socket tuples at event time in the eBPF agent, and renames filtered_flows_total to filtered_packets_total.
◆ Where it's heading
The 2.0 line adds routing context (BGP ASNs) and DNS identity to flows, which moves the tool from 'which pod talked to which' toward 'which network and service.' The operator's own security posture, with RBAC, network policies and TLS profiles, is getting as much attention as the data. The TLS thread continues inside the eBPF agent, with OpenSSL tracking narrowed to packet mode in 2.0.2.
◆ Prediction
Expect 2.0.x fixes around the new ASN and TLS enrichment, which both needed corrections in 2.0.2. The metric rename is a signal that dashboards built on older names may need updating in later releases too.
Alternatives to Cortex and NetObserv
Other Analytics products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Cortex or NetObserv.
Rho
Rho's feed jumped from 0.4.0 to 0.5.2, and the only note is about its release pipeline.
Countly
Countly's two LTS lines now get the same security fixes within a week of each other.
OpenMetadata
OpenMetadata reaches 2.1 rc1 after a month of repairing 2.0's connectors.
Stitch
Stitch keeps patching connectors one replication bug at a time.
Datawrapper
Datawrapper's October is touch tooltips, keyboard focus and small chart repairs.
See all Cortex alternatives → · See all NetObserv alternatives →
Recent activity from Cortex and NetObserv
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 4d agoNetObserv2.0.2 fixes ASN enrichment and renames a flow metric
- 26d agoCortex1.22 candidate 4 fixes tenant-deletion cleanup on GCS and Azure
- 1mo agoNetObserv2.0.1 adjusts DNS port defaults and bumps dependencies
- 1mo agoCortex1.22 candidate 3 fixes the ingestion-delay histogram
- 1mo agoCortex1.22 candidate 2 adds three bug fixes
- 1mo agoNetObserv2.0.0 adds BGP ASN enrichment and stricter operator RBAC
- 1mo agoCortex1.22 candidate: sharded Parquet, query eviction, OCI storage
- 3mo agoNetObserv1.12.0 adds TLS alerting, flp-informers and signed releases
- 4mo agoNetObserv1.11.5 adds TLS metrics, Kafka compression and drop events
- 5mo agoCortex1.21.1 candidate hardens gossip, ingestion and status pages
- 6mo agoCortex1.21.0-rc.1 fixes memberlist, tenant federation and a memory leak
- 7mo agoNetObservTLS tracking arrives as a feature knob with new TLS fields ⚡
Frequently asked questions
What is the difference between Cortex and NetObserv?
They serve adjacent needs but don't currently overlap on shipped themes. Cortex and NetObserv are shipping at a similar cadence (velocity 2.5 vs 2.5, both within Sparkpulse's "active" band). See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is Cortex better than NetObserv?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Cortex and NetObserv are shipping at a similar cadence (velocity 2.5 vs 2.5, both within Sparkpulse's "active" band). For your specific use case, the alternatives sections above list other Analytics products to evaluate alongside.
What are the best alternatives to Cortex?
Top Cortex alternatives in Analytics are ranked by recent ship velocity. Browse the "Cortex alternatives" section above for the current picks, or visit /alternatives/cortex-metrics for the full list with editorial commentary on each.
What are the best alternatives to NetObserv?
Top NetObserv alternatives in Analytics are ranked by recent ship velocity. Browse the "NetObserv alternatives" section above for the current picks, or visit /alternatives/netobserv for the full list with editorial commentary on each.