Logs

Logs are most effective when used to explain a metric anomaly, not replace it.

Logging standards

• Use structured logs with consistent fields.
• Include request IDs, tenant/workload identifiers, and severity.
• Avoid logging secrets or sensitive payloads.

Investigation workflow

1. Start from metric anomaly timeframe.
2. Filter logs by namespace/workload.
3. Correlate error spikes with deploys/events.
4. Confirm the first clear causal error.

High-signal fields

• level
• service
• namespace
• trace_id or request correlation ID
• stable error code/class