Observability Correlation

Connect signals to investigate systems

Correlation connects telemetry through shared identifiers, resource attributes, dependencies, and time. It helps you move from an aggregate symptom to the records and changes that explain it.

Correlation is evidence, not proof of causation. Test competing explanations before concluding that a change caused an incident.

Choose an investigation path

For the foundations, read What is Observability?. For delivery outcomes, read DORA Metrics Explained.

Implementation guides

OpenTelemetry: Logs to Traces in Python

Emit structured logs with the active trace and span identifiers, then verify the join against a recorded span.

Grafana: Metrics to Traces with Exemplars

Attach a sampled trace identifier to a histogram observation and configure Grafana to open the corresponding trace.

Deployments: Compare Error Rate by Version

Record release identity and compare errors per request across old and new versions during a rollout.

OpenTelemetry: Queue Context, Retries and Batches

Inject context into message metadata and link each processing attempt to its message creation span.

Troubleshoot: Log Trace ID Not Found

Locate the broken step between an identifier in a log and a retained trace in the backend.

Troubleshoot: Exemplars Missing in Grafana

Check exemplar generation, transport, storage and display separately before changing instrumentation.

Investigation patterns

Trace to Logs

Connect an individual trace or span to the log records emitted during its execution.

Metrics to Traces

Move from a metric trend to selected recorded requests using exemplars or a scoped trace search.

Deployments to Error Rate

Compare release cohorts and rollout timing with changes in error rate to test a deployment-related hypothesis.

Alerts to Incidents

Associate related alerts with an incident while retaining the evidence and identity of each symptom.

Services to Dependencies

Relate a service symptom to observed downstream calls and the dependencies that may contribute to it.

Infrastructure to Applications

Relate host, container, or orchestration behavior to application telemetry using resource identity and aligned time windows.

Trace to Profiles

Connect a recorded trace span with compatible profiling data to investigate which code paths consumed resources during the operation.

Service to Database

Relate an application request to database calls and database-side evidence while separating connection acquisition, query execution, and other waiting.

User Session to Backend Trace

Follow a browser session action to its network request and the associated backend trace when frontend and server instrumentation preserve compatible context.

Queue Producer to Consumer

Connect message publication with delivery and processing observations using preserved message context, identities, and recorded span relationships.

Signals

Logs

Logs are timestamped records of discrete activity, carrying messages and structured fields for an investigation.

Metrics

Metrics summarize numerical observations over time, such as request counts, latency distributions, and resource usage.

Traces

Traces describe recorded distributed operations as spans with execution relationships, duration, and attributes.

Events

Events record discrete operational occurrences, such as restarts, configuration changes, failovers, and rollouts.

Profiles

Profiles sample or measure resource use by code paths, such as CPU activity or allocated memory, over a defined interval.

Alerts

Alerts are notifications that a monitored condition matched a rule or detector; they describe symptoms that need triage.

Tool support

Check which connections are documented and what configuration they require.

Explore documented tool support