The Three Pillars: Complementary System State Representations¶

System behavior requires three distinct data types: aggregated measurements (metrics), discrete events (logs), and request flow paths (traces) - each answers different questions and none is sufficient alone.

Tension Addressed¶

Coverage vs. Cost - the pillars represent different cost/information trade-offs

Recognizable As¶

Any system with separate numerical time-series, event streams, and correlation/flow tracking; the distinction between "what is the aggregate behavior" vs "what happened" vs "how did it flow"

Canonical Sources¶

Sridharan, "Distributed Systems Observability" (2018); Google SRE Book, Chapter 6 (2016)

Transfers To¶

Scientific measurement (different instrument types), Business intelligence (operational vs analytical queries), Network analysis (flow vs aggregate statistics)

Sub-concepts: - Metrics: Pre-aggregated numerical values sampled over time; answer "what is happening on average" - Logs: Discrete events with context; answer "what specifically happened" - Traces: Causal chains linking operations; answer "how did this request flow"