What are the three pillars of observability?

The three pillars of observability are metrics, logs, and traces. Together they give operators three different lenses through which to understand system behavior.

Metrics are numeric time-series data — counters, gauges, and histograms. They are cheap to store and query at scale, making them ideal for dashboards and alerting. Tools like Prometheus scrape and store metrics; Grafana visualizes them. Metrics excel at answering questions like "What is the 99th-percentile latency over the last hour?"

Logs are discrete, timestamped records of events — structured (JSON) or unstructured (plain text). They carry rich context: request IDs, user agents, stack traces. ELK Stack (Elasticsearch, Logstash, Kibana) and Loki are popular log aggregation platforms. Logs are expensive at high volume but irreplaceable when debugging specific incidents.

Traces track a single request as it propagates across multiple services. Each hop is a span; the collection of spans for one request is a trace. Distributed tracing tools like Jaeger, Zipkin, and AWS X-Ray stitch spans together using a shared trace ID injected into request headers. Traces reveal latency bottlenecks that neither metrics nor logs can localize on their own.

Modern observability platforms — Datadog, New Relic, Grafana Cloud — correlate all three pillars so you can jump from a latency spike on a metric dashboard directly into the traces and logs for that time window.