starter.wiki

Observability

Application Logging

Choose how application diagnostic events are collected, routed, searched, retained, governed, and paid for.

Recommendation

Route by event volume, query model, retention, and existing telemetry estate.

No provider-independent default exists before the team models ingestion, query frequency, retention, archive, sensitive fields, and suite context.12

For: Backend, platform, and reliability teams centralizing application diagnostic logs

Main trade-off

Centralized search and retention improve diagnosis while increasing ingestion governance, sensitive-data handling, query design, and workload-shaped cost.1234

Why there is no single default: The four candidates use different collection, query, retention, archive, and suite boundaries; a flat ranking would hide the workload that determines fit and cost.

Decision criteria

Model the telemetry workload and ownership before comparing product interfaces.

  1. Ingest and event shape

    Estimate daily and burst volume, field cardinality, parsing, transformation, filtering, and sensitive-data handling.12

  2. Query and retention

    Separate hot search, infrequent query, archive, rehydration, deletion, and evidence-retention requirements.12

  3. Collection boundary

    Decide whether OpenTelemetry, agents, shippers, provider-native integrations, or application SDKs own transport.23

  4. Operating and cost model

    Model ingest, indexed or scanned data, retention, query compute, archive, seats, support, and suite coupling.2

Application logging routes

Choose the operating model that fits the telemetry workload; do not buy a suite merely to fill a comparison slot.

A developer-first operations workflow matters

Evaluate Better Stack.

Logs can sit beside traces, uptime, alerts, and incident operations in one developer-oriented workflow.

Verify: Advanced governance, provider-neutral backend ownership, or unproven high-volume behavior should move the decision.1

Query-native event analysis and spend controls matter

Evaluate Axiom.

Event datasets, query compute, retention, and explicit usage controls fit teams treating logs as queryable event data.

Verify: Issue-centric error triage or incompatible dataset, region, and query limits point elsewhere.2

Grafana and open collection are already strategic

Evaluate Grafana Cloud.

Managed Loki and Grafana workflows fit teams already using Grafana, Alloy, Prometheus, Tempo, or OpenTelemetry.

Verify: Label design, collector operation, and Loki query behavior remain team responsibilities.3

Enterprise cross-signal correlation is required

Evaluate Datadog.

Logs can share a mature suite with APM and infrastructure telemetry.

Verify: Poor volume governance or inability to model ingest, indexing, scanning, archive, and add-ons is a stop condition.4

Official resources

Verify current capabilities, collection boundaries, privacy controls, retention, and commercial terms in the official documentation before implementation.

DocumentationAxiom documentation

Sources

Official product documentation supporting the decision routes and boundaries on this page.

  1. 1
    Better Stack logging

    Better Stack · Accessed Official

  2. 2
    Axiom documentation

    Axiom · Accessed Official

  3. 3
    Send logs to Grafana Cloud

    Grafana Labs · Accessed Official

  4. 4
    Datadog Log Management

    Datadog · Accessed Official