Logs vs metrics vs traces — when do you use each?

Deep dive

Each signal answers a different question:

• Metrics: "Is the system healthy and how is it trending?" (SLIs, alerting, capacity).
• Logs: "What exactly happened?" (error details, inputs, correlation IDs).
• Traces: "Where is the time spent across services?" (latency breakdown, dependency hops).

Use them together: metrics trigger, traces narrow the path, logs give the exact error.

Examples

A slow request investigation:

Alert fires (p95 latency) -> trace shows slow DB span -> logs show slow query + params

Common pitfalls

• Treating logs as metrics (expensive and noisy).
• No correlation IDs, so logs can’t link to traces.
• Missing RED/USE views, so you see symptoms but not cause.

Interview follow-ups

• What would you alert on for a user-facing API?
• How would you sample traces without losing critical data?
• How do you control logging costs?