Prasanna Vijayanathan and Renzo Sanchez-Silva, both Engineers at Netflix, presented Ontology‐Driven Observability: Building the E2E Knowledge Graph at Netflix Scale at QCon London 2026, where they discussed the design and implementation of an end-to-end knowledge graph that models the Netflix user experience as interactions of a connected graph of users, clients, services, and infrastructure.
End-to-End (E2E) Observability is the ability to monitor, understand, and debug the entire state of a complex system, from the frontend user experience on one end, through backend services, down to the underlying cloud infrastructure on the other.
Vijayanathan kicked off his part of the presentation by asking the audience to imagine a system that could: immediately detect issues; prioritize incident impact and triage; automatically identify root causes; and proactively predict.
In a recent incident investigation at Netflix, it took four hours from the initial alert of the incident to its resolution. In between, there was triage, debugging, and identification of the root cause. Resources included a total of nine teams of more than 30 engineers to resolve this incident and three related incidents.
Typical challenges to E2E observability include: numerous and siloed data sources; disconnected and non-contextual alerting; complexity with triage and troubleshooting; and inadequate detection methods.
The concept of Connectedness includes bridging gaps and breaking silos. At Netflix, connected data in its E2E observability includes: enriching data for a single source of truth; minimizing duplication of effort; the ability to triage and troubleshoot complex issues that deliver aggregated insights and root causes; and improved accuracy with diagnostics.
Vijayanathan introduced the MELT Layer (Metrics, Events, Logs, Events) as a unified observability layer for users, devices, and services that can improve the resolution time of incidents.
Sanchez-Silva then kicked off his part of the presentation by introducing the concept of Ontology, defined as a formal specification of types, properties, and relationships. Ontology is a way to encode knowledge. It's not just the data, it's about the relationships.
The ontology data structure, the Triple, is a tuple (Subject | Predicate | Object) that defines a fact in a knowledge graph that can be queried.
An example of such a triple is:
api-gateway | rdf:type | ops:Application
api-gateway | ops:ownedBy | "Team Bedrock"
INC-5377 | rdf:type | ops:Incident
INC-5377 | ops:affects | api-gateway
The 12 Operational Namespaces connect all the things in the Netflix infrastructure. These include: Slack, Alerts, Metrics, Logs, Incident, E2E, and Harvest.
Sanchez-Silva stated that incident knowledge may be scattered among the 12 operational namespaces, causing operational chaos. The ontology, however, provides order as it captures, structures, and preserves a machine-readable triple data structure.
The Knowledge Flywheel builds resiliency as one rotation features three states — Observer, Enrich, and Infer — as input for adapting. Each rotation encodes knowledge for subsequent, smarter rotations.
Using Claude as a co-developer, each harvest runs in its own git worktree. Two flywheels may "spin together" in one system. For example:
Flywheel 1: Knowledge
Slack --> Enrich --> Infer --> Adapt
Flywheel 2: Code (git worktree)
Worktree --> Claude --> PR--> Review --> Merge
Both flywheels work together so that Claude can propose a pull request (PR), and a human can review the PR and merge it.
Sanchez-Silva maintained that the ontology is the contract between chaos and understanding. The result is shown in this ontology visualization of an incident.
Moving forward, Netflix plans to: automate root cause analyses; provide auto-remediation; and create a self-healing infrastructure.