What are logs, metrics and traces? Which question does each answer best?

Logs record single events. Metrics count and measure things over time. Traces follow one request across services.

Logs are timestamped records of single events. Ideally they are structured as JSON, with fields like level, message, user id and request id. They answer "what exactly happened in this case?". They hold the detail you need for debugging. But at high volume, they cost the most to store and to search.

Metrics are numbers collected and combined over time. Examples:

• request rate
• error count
• latency histograms (how many requests fell into each time range)
• CPU use

Metrics are cheap to store and fast to query. They drive dashboards and alerts. They answer "is something wrong, and how much?". But they don't have the detail of each single request.

Traces follow one request across services. A trace is a tree of spans. A span is one piece of work, with its timing and attributes. Traces answer "where did the time go, and which service failed?" in a distributed system.

They work best when linked. For example:

• a metric fires an alert
• a trace shows which service is slow
• logs with the same trace id explain why