← Back to guidesGuide

Build incident timelines with logs, metrics, and traces without making up the story

A practical flow to reconstruct incidents when the dashboard says one thing, the logs say another, and the on-call engineer trusts none of them.

Recent ecosystem signals point in the same direction: more telemetry does not automatically produce better diagnosis. This guide turns that into a repeatable method for building trustworthy timelines with Prometheus, Loki, and OpenTelemetry, while avoiding very current traps such as misleading memory metrics, noisy labels, and traces that lack useful request context.

Created: April 19, 2026

Published: April 19, 2026

Estimated time42 min

LevelIntermediate

Before you startRead-only access to Prometheus, Loki, and your tracing backend

PlatformsLinux / Docker

WhatsApp X LinkedIn

Linux

Use this when you operate separate components or local endpoints and want to pin the timeline with direct API queries.

curlHTTP access to Prometheus, Loki, and Tempo or JaegerReasonably synchronized host clocks

Anchor the error window with Prometheus

curl -G http://prometheus:9090/api/v1/query_range --data-urlencode 'query=sum(rate(http_server_requests_seconds_count{service="checkout",status=~"5.."}[5m]))' --data-urlencode 'start=2026-04-19T06:00:00Z' --data-urlencode 'end=2026-04-19T06:30:00Z' --data-urlencode 'step=30s'

Pull the matching log burst from Loki

curl -G http://loki:3100/loki/api/v1/query_range --data-urlencode 'query={service_name="checkout"} |= "timeout"' --data-urlencode 'start=1713506400000000000' --data-urlencode 'end=1713508200000000000' --data-urlencode 'limit=200'

Search slow or failing traces by service

curl -G http://tempo:3200/api/search --data-urlencode 'q={ resource.service.name = "checkout" && span.http.status_code >= 500 }'

Also available inConstruir timelines de incidentes con logs, métricas y trazas sin inventarte la película

Content locked

This guide requires both steps before full content is available.

○Click “Like” on this guide.
○Share on WhatsApp, X, LinkedIn, or copy the link.

Access is automatically unlocked as soon as both steps are completed.