Back to roadmap
Module 9 · Protocols, Security, ObservabilityDay 08825 min

Logs, Metrics, Traces

The three pillars of observability.

Day 088

Logs, Metrics, Traces

Logs
datastore
Metrics
datastore
Traces
datastore
Memory hook

Logs, Metrics, Traces: the three pillars of observability

Mental model

design for the day something breaks

Design lens

Logs grow fast — sample or sample-by-route.

Recall anchors
LogsMetricsTraces

Why it matters

Logs are events, metrics are measurements, traces follow a request through services. You need all three; each answers different questions.

Deep dive

Logs: 'what happened' — searchable, structured.

Metrics: 'how often / how much' — cheap, time-series.

Traces: 'where time went in this request' — sampled.

Correlate via trace_id/span_id propagated through headers (W3C trace-context).

Demo / scenario

User reports 'sometimes slow'.

  1. Metric: p99 spikes 14:00–14:10.
  2. Logs: filter for slow requests in window — find pattern.
  3. Traces: open one — DB query took 800ms.
  4. Root cause: missing index on a new query.

Tradeoffs

  • Logs grow fast — sample or sample-by-route.
  • Metric cardinality explodes with too many labels.
  • Traces sample at 1–10% to control cost.

Diagram

Logs
Metrics
Traces
Three pillars correlated by trace ID.

Mind map

Check yourself

Loading quiz…

Sources & further reading