Prasanna Vijayanathan and Renzo Sanchez-Silva, both Engineers at Netflix, presented Ontology‐Driven Observability: Building the E2E Knowledge Graph at Netflix Scale at QCon London 2026, where they discussed the design and implementation of an end-to-end knowledge graph that models the Netflix user experience as interactions of a connected graph of users, clients, services and infrastructure.
End-to-End (E2E) Observability is defined as the ability to monitor, understand, and debug an entire state of a complex system from the frontend user experience on one end, through backend services, down to the underlying cloud infrastructure on the opposite end.
Vijayanathan kicked off his part of the presentation by asking the audience to imagine a system that could: immediately detect issues; prioritize the impact and triage of an incident; automatically provide a root cause; and proactively predict.
In a recent incident investigation at Netflix, it took four hours from the initial alert of the incident to its resolution. In between, there was triage, debugging and identification of the root cause. Resources included a total of nine teams of more than 30 engineers to resolve this incident and three related incidents.
Typical challenges to E2E observability include: numerous and siloed data sources; disconnected and non-contextual alerting; complexity with triage and troubleshooting; and inadequate detection methods.
The concept of Connectedness includes bridging gaps and breaking silos. At Netflix, connected data in its E2E observability includes: enriching data for a single source of truth; minimizing duplication of effort; the ability to triage and troubleshoot complex issues that deliver aggregated insights and root causes; and improved accuracy with diagnostics.
Vijayanathan introduced the MELT Layer (Metrics, Events, Logs, Events), as a unified observability layer for users, devices and services that can improve resolution time of incidents.
Sanchez-Silva then kicked off his part of the presentation by introducing the concept of Ontology, defined as a formal specification of types, properties and relationships. Ontology is a way to encode knowledge. It’s not just the data, it’s about the relationships.
The ontology data structure, The Triple, is a tuple (Subject | Predicate | Object) that defines one fact in a knowledge graph that may be queried.
An example of such a triple is:
api-gateway | rdf:type | ops:Application
api-gateway | ops:ownedBy | "Team Bedrock"
INC-5377 | rdf:type | ops:Incident
INC-5377 | ops:affects | api-gateway
The 12 Operational Namespaces connect all the things in the Netflix infrastructure. These include: Slack, Alerts, Metrics, Logs, Incident, E2E and Harvest.
Sanchez-Silva stated that incident knowledge may be scattered among the 12 operational namespaces causing operational chaos. The ontology, however, provides order as it captures, structures and preserves a machine-readable triple data structure.
The Knowledge Flywheel builds resiliency as one rotation features three states – Observer, Enrich and Infer – as input for adapting. Each rotation encodes knowledge for subsequent, smarter rotations.
Using Claude as a co-developer, each harvest runs in its own git worktree. Two flywheels may “spin together” in one system. For example:
Flywheel 1: Knowledge
Slack –> Enrich –> Infer –> Adapt
Flywheel 2: Code (git worktree)
Worktree –> Claude –> PR–> Review –> Merge
Both flywheels work together such that Claude can propose a pull request (PR) and a human can review the PR and merge the request.
Sanchez-Silva maintained that the ontology is the contract between chaos and understanding. The result is shown in this ontology visualization of an incident.
Moving forward, Netflix plans to: automate root cause analyses; provide auto-remediation; and create a self-healing infrastructure.
