Observability and tracing · Lesson 8 of 15 · 6 min

Connect logs and traces

Logs and traces correlate through stable identifiers, not approximate timestamps alone. Keep the relevant request and span identifiers in diagnostic events.

Open the lab Course map

Mastery 0/3Run itExplain itApply it

learner@clairos:~ $

↑ history · Tab complete · Ctrl+C cancel · Esc, Tab to leaveExit 0

Your objectives

Hints are always available. Wrong turns never cost XP.

1
Read the case evidence
Read /opt/ai-lab/cases/aiops-observability-tracing-008.json. Separate the recorded facts from your assumptions.
Hint & worked example
Logs and traces correlate through stable identifiers, not approximate timestamps alone. Keep the relevant request and span identifiers in diagnostic events.
The complete case JSON is read successfully.
```
cat /opt/ai-lab/cases/aiops-observability-tracing-008.json
```
Common mistake to avoid: Timestamp proximity is enough to join every log to a trace.
2
Isolate the deciding signal
Select the log_request_id field from the case JSON. What does it establish—and what does it not establish?
Hint & worked example
Join the log and trace for req-14 rather than the unrelated req-99 event.
A successful JSON query isolates log_request_id.
```
jq .log_request_id /opt/ai-lab/cases/aiops-observability-tracing-008.json
```
Common mistake to avoid: Using a different case or an unrelated signal as the justification.
3
Record your operational decision
Choose the justified code: join-req-14, change-without-evidence, or ignore-the-signal. Save that one code followed by a newline in /home/learner/lab/aiops-observability-tracing-008-decision.txt.
Hint & worked example
Join the log and trace for req-14 rather than the unrelated req-99 event.
The decision artifact contains the correct code, not just a matching command in history.
```
printf '%s\n' 'join-req-14' > /home/learner/lab/aiops-observability-tracing-008-decision.txt
```
Common mistake to avoid: Timestamp proximity is enough to join every log to a trace.

Understand the pattern

Logs and traces correlate through stable identifiers, not approximate timestamps alone. Keep the relevant request and span identifiers in diagnostic events.

Interpret the evidence

Join the log and trace for req-14 rather than the unrelated req-99 event.

A tempting mistake

Timestamp proximity is enough to join every log to a trace.

All names, measurements, prices, versions, and thresholds in this exercise are fictional training data. The evidence supports this bounded scenario, not a claim about a live provider.

Worked example and expected result

$ cat /opt/ai-lab/cases/aiops-observability-tracing-008.json

{
  "fixture": "Fictional training data; not a live measurement.",
  "log_request_id": "req-14",
  "trace_request_id": "req-14",
  "other_log_id": "req-99"
}

Exit status: 0. The command completed successfully in the training fixture.

$ jq .log_request_id /opt/ai-lab/cases/aiops-observability-tracing-008.json

"req-14"

Exit status: 0. The command completed successfully in the training fixture.

$ printf '%s\n' 'join-req-14' > /home/learner/lab/aiops-observability-tracing-008-decision.txt

(no output; exit 0)

Exit status: 0. The command completed successfully in the training fixture.

Try a variation

Name the assumption that would have to change for “join-req-14” to stop being the justified action. Do not silently replace missing evidence with a guess.

Explain it

What does the evidence in “Connect logs and traces” justify?Make the change now and gather the missing evidence afterward.Join the log and trace for req-14 rather than the unrelated req-99 event.Timestamp proximity is enough to join every log to a trace.

Apply it elsewhere

A colleague concludes: “Timestamp proximity is enough to join every log to a trace.” What should you do?Reject that conclusion; return to the case evidence and its stated limits.Accept it because the training command completed.Treat this fixture as a live measurement.

Keep the momentum.

Complete the lab, then explain and apply the pattern.

Next: Inspect token metrics Try an incident drill

Anonymous lesson and mastery progress lasts for this session. Sign in to keep synced lesson XP between sessions; mastery stays device-local. No speed bonus, lost lives, or hint penalties.

Keep learning

Case methodology: evidence, limits, decision