2025-09-09 · Elliot Park
Structured logs that support desks actually search
Field vocabulary matters more than shiny dashboards when midnight pages arrive.
Observability vendors love to promise single-pane answers, yet most incidents still begin with a support analyst pasting log fragments into chat.
We ask cohort members to pair each log field with a question someone outside engineering might ask. If a field cannot answer a question, it becomes a candidate for deletion rather than another pretty column.
The second segment of the workshop replays anonymized snippets from past incidents. Teams annotate which fields helped, which misled, and which were never referenced.
We close with a short writing exercise: draft the three sentences an on-call engineer should add to the ticket after mitigation. The sentences matter because they become the institutional memory that the next rotation inherits.