Observability: Logs vs Metrics vs Traces

Subtitle: Three signals, three questions, one system

Left column - LOGS:

Discrete events with full context Answers: what exactly happened? High detail, high storage cost Structured JSON beats free text Best for debugging one request

Middle column - METRICS:

Numbers aggregated over time Answers: is the system healthy? Cheap to store, cheap to query Counters, gauges, histograms Best for dashboards and alerts

Right column - TRACES:

One request across many services Answers: where did the time go? Spans linked by a trace ID Sampled, not kept for every call Best for latency in microservices

Simple difference:

LOGS = the story of one event METRICS = the shape of many events TRACES = the path through the system

Use it when - ALERT: metrics, SLO burn rate

Use it when - ROOT CAUSE: traces, then logs

Sticky note - Common beginner mistake:

Alerting on CPU spikes nobody can act on. Alert on user-visible symptoms; keep logs and traces for diagnosis.