Search docs
Jump to a page or section

Effective Investigation

The order in which to look at Telemetry Machine data when something is wrong.

Open in Claude

When something is wrong, look in this order. Writing Effective Queries covers the queries themselves.

  1. Check alerting first. What already fired tells you where to look.
  2. Check SLOs. An SLO that is burning its error budget names the service and the kind of failure.
  3. Find what the bad events have in common. Compare the failing or slow events with the rest: a route, a host, a customer, or a version that shows up much more often among them is a lead.
  4. Check deploy impact. Group the bad events by resource.service.version over a window that covers the deploy.