Three pillars of observability
The three pillars of observability — logs, metrics, traces — are the foundational telemetry types that together let engineers reason about a system's runtime behaviour. Logs record discrete events with rich context, metrics aggregate numerical measurements over time, and traces follow a single request across distributed service boundaries.
The 'pillars' framing is contested — Charity Majors and the honeycomb.io school argue that the pillars are a vendor abstraction and the real primitive is structured wide events, with metrics and traces derivable from events. Both views agree on the substance: a production system needs the ability to answer 'what just happened?' (logs), 'how is the system trending?' (metrics), and 'where did this slow request spend its time?' (traces). OpenTelemetry has emerged as the cross-vendor instrumentation standard for all three. The pragmatic guidance: invest first in structured logs with high-cardinality context, derive metrics from those logs, and add tracing when service-graph complexity exceeds what logs alone can explain.
Related terms
- Observability
Observability is the property of a system that lets engineers understand its internal state from external outputs — answering questions about how the system is behaving without modifying it.
- OpenTelemetry
OpenTelemetry (OTel) is the CNCF observability standard for instrumenting software to emit traces, metrics, and logs in a vendor-neutral format.
- Distributed tracing
Distributed tracing records the path of a single request as it traverses multiple services, producing a tree-like view of every span — a unit of work in a single service — with timings, parent-child relationships, and metadata.