Browse
Monitoring, Logging & Tracing
The three pillars of observability, and what question each one is actually good at answering.
What it is
Observability is commonly described as three complementary pillars, each best suited to answering a different question when something goes wrong.
Key points
- Metrics: numeric time series (request rate, error rate, latency) — cheap to store and query, great for dashboards and alerting on trends, but low on detail for any single request.
- Logs: discrete timestamped events with detail — best for "what exactly happened" on a specific request or at a specific moment, at the cost of volume and query cost.
- Traces: follow a single request as it moves through multiple services — the tool for "which of these ten services is actually slow" in a distributed system, which metrics and logs alone can't easily answer.
- In practice, an incident investigation typically starts at a metrics dashboard (something's wrong), narrows via traces (where), and confirms via logs (why) — each pillar covers what the others are weak at.