Observability

Observability collects logs, traces and metrics from your services and serves queries over them. It is split in two, and the split matters when you are operating it:

   your services
        │  logs · traces · metrics
        ▼
   ┌──────────────┐        ┌───────────────┐        ┌──────────────┐
   │  Collector   │ ─────▶ │    Storage    │ ◀───── │   Querier    │
   │ accept,      │        │  per tenant   │        │ reads across │
   │ process,     │        │               │        │ signals      │
   │ route        │        └───────────────┘        └──────────────┘
   └──────────────┘

The collector accepts telemetry, processes it and writes it to per-tenant storage. The querier reads it back. They scale on different axes — the collector on ingest volume, the querier on how many people are looking — which is why they are separate services rather than one.

The three signals

Signal	Answers	Cost driver
Logs	What happened, in detail	Volume — the largest bill, usually
Metrics	How much, how often, how fast	Cardinality, not volume
Traces	Where the time went across services	Sampling rate

Each has a different failure mode when it grows. Logs get expensive linearly and you notice. Metrics get expensive combinatorially and you do not — one new high-cardinality label on an existing metric multiplies its series count, and nothing warns you before the bill.

Tenancy

Telemetry is collected and stored per tenant. This is a data boundary, not tidiness — a shared observability stack that mixes tenants leaks one customer’s operational detail into another’s queries.

Where to start

Deploying for the first time? Configure the collector’s processors before you turn everything on, not after the first bill. The two that matter most are metric_filter — which drops metrics by name and strips high-cardinality labels — and the collection interval, which multiplies everything else.

Investigating cost? Start with cardinality, not volume. A single unbounded label such as a user agent or a request id turns one metric into millions of series, and it is almost always the answer. Strip those labels at the collector and move them onto spans, where high cardinality belongs.

Not this block

• Usage measures business time — human, AI, idle in a process. Observability measures system behaviour.
• Audit is a tamper-evident compliance record, not a log stream.

Continue with

• Ops Blocks — the rest of the operations surface