,
8 tweets,
2 min read
Read on Twitter
Traces and events should just be two sides of the same coin.
Events + traces = observability.
Events + traces = observability.
This shows exactly how silly the whole three pillars is. You arrive at three pillars by starting with what you've got -- metrics and logs, probably -- and going "hm, but I can't understand my systems -- let's shove more shit in til I can!"
Metrics have their place: they're a solid tool for monitoring, alerting, and capacity planning. They're completely useless for debugging systems or user visible problems.
They are not necessary, and often not even /usable/, for observability.
They are not necessary, and often not even /usable/, for observability.
Logs I'll be harder on. Unstructured string vomit has no place in a modern software system.
Whip that shit into shape with some structure and ordering already. Again, orthogonal to observability unless you turn them into events and gather lots more context.
Whip that shit into shape with some structure and ordering already. Again, orthogonal to observability unless you turn them into events and gather lots more context.
But if you were starting from scratch, you would never go "oh shit I need me some metrics and logs"
Literally nobody.
We have metrics and logs for legacy reasons. Solid, real, true reasons -- but all of them legacy.
Literally nobody.
We have metrics and logs for legacy reasons. Solid, real, true reasons -- but all of them legacy.
The reason you need events and traces is because it all comes down to empathizing with your users.
So you need to be able to slice and dice by user requests, with as much context and descriptive detail as possible. (Traces are just derived from ordering fields in your events.)
So you need to be able to slice and dice by user requests, with as much context and descriptive detail as possible. (Traces are just derived from ordering fields in your events.)
Metrics are orthogonal to this because you have discarded the connective tissue of the event. You cannot correlate this counter value with that gauge value, etc.
To say nothing of all the ways they fuck you by preaggregating on aggregates at write time.
To say nothing of all the ways they fuck you by preaggregating on aggregates at write time.
But I'm not gonna get started on that rant right now or I will get too steamed and wound up to sleep. 😛
NOT THIS TIME
NOT THIS TIME
