Log aggregation
Shipping logs off every server, container, and function into one searchable place, so you stop SSH-ing into boxes to grep.
See it
What it is
Log aggregation is the pipeline: an agent or drain picks up log lines wherever they are written, ships them to a central store, parses them into fields, and gives you one query box across every service and instance. The canonical stacks are ELK and OpenSearch (Elasticsearch, Logstash, Kibana), Loki with Grafana, and hosted options like Datadog, Axiom, or Better Stack. Serverless and PaaS platforms usually hand you a log drain instead of an agent to install.
It pays for itself the moment you run more than one instance, because ephemeral compute deletes local logs the second the container dies. Two habits separate a searchable archive from an expensive pile of text: emit structured logs (JSON fields, not sentences) so filters work on real values, and stamp a correlation ID on every line so one request reassembles into a story across services.
Gotchas: cost scales with volume and with the number of distinct field values, so debug-level chatter left on in production is a genuine budget line. Retention is tiered, and the cheap archive tier is rarely searchable at the speed you want mid-incident, so decide the hot window deliberately. And logs are the easiest place to leak secrets: scrub tokens, emails, and card numbers on the way in, because after indexing they are replicated, backed up, and effectively permanent.
Ask AI for it
Set up centralized log aggregation for this app. Replace console logging with a structured JSON logger (pino or the equivalent for this runtime) that emits timestamp, level, service, environment, message, and a correlation ID pulled from request context. Write only to stdout and ship it through the platform's log drain or an OTel collector, no log files on disk. Drive log level from an env var (info in production, debug locally), drop or sample health check and static asset lines, and redact authorization headers, cookies, passwords, tokens, and email addresses before export. Set retention to 30 days searchable with cheaper archive after that.