hn.today

All you need is Wide Events, not "Metrics, Logs and Traces"

isburmistrov.substack.com94 points38 comments
Screenshot of All you need is Wide Events, not "Metrics, Logs and Traces"

The argument is that observability is made unnecessarily confusing by organizing telemetry into three separate categories - metrics, logs, and traces - and teaching people a large vocabulary of related concepts. The author proposes wide events as a simpler foundation: records containing a timestamp and all context that might later help explain system behavior. Rather than deciding in advance which metrics or dashboards an incident will require, teams can preserve relevant fields and explore them when unexpected problems arise. The author draws on Meta’s Scuba system, where users investigate data by interactively filtering and grouping events.

An ad-impression example shows how this works: an abnormal overall chart is narrowed down by campaign type, operating system, OS version, and app version, revealing a likely area of responsibility without requiring investigators to know the cause beforehand. Scuba also handles sampled data transparently and makes field values easy to explore; because it queries raw events, high-cardinality fields are not a barrier. The author maps familiar telemetry onto this model: traces are events linked by trace and span identifiers, logs are events containing messages and metadata, and metrics can be recorded as periodic event snapshots. Wide events, the argument concludes, can also accommodate profiling and enable cross-correlation in one system, making incident investigation more flexible than treating the three pillars as separate kinds of data.

Read on isburmistrov.substack.com38 comments on Hacker News

Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.

More in Programming

The daily digest

Today's best Hacker News stories, summarized and screenshotted, one email a day.