> Why do you need logs for that though? You could also use metrics and define the alert routing based on thread holds and alerting rules there. No, you cannot.

> Why do you need logs for that though? You could also use metrics and define the alert routing based on thread holds and alerting rules there. No, you cannot. At least for most of the practical cases. Some upstream dependencies can and do throw critical/fault-level log messages which you do not control and cannot catch. This scenario is frequent enough that some cloud providers even provide services that generate metrics streams by filtering logs. Also important: the operational side of running a service. When the shit hits the fan, you do not have the luxury of redeploying production services just because you need to add a log call or emit a metric. For that, you work with what you already have in place. I was involved in a couple of SEVs where I personally created metrics filters and alarms on the fly to help troubleshoot issues and monitor relevant failure modes.