Reading-path month: May 2026. Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.
Logs: start with the incident question
Event volume is not investigation capability.
Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.
Reading context
A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.
Original source ↗The architecture decision
Collecting many logs can create cost without explaining events. Observability architecture should start with investigation questions and accountability.
Practical application
Editorial proposal: choose a critical operation and identify actor, resource, decision and outcome without unnecessary sensitive content. For a hypothetical export, identifying the requested dataset may matter more than copying its records into logs.
How to verify
Reconstruct a synthetic journey using available telemetry alone. Record correlation gaps and evidence access. Include delivery failures and clock differences: investigation also depends on collection quality.