All guides

Filter by category, difficulty, or free text to find the right material for your team.

Logs~45 min

Debug Vector backpressure without losing incident searches

Created: August 24, 2026 · Published: August 24, 2026

Learn how to diagnose Vector pipelines when logs arrive late, malformed, or never show up, using internal metrics, VRL, disk buffers, canaries, and search validation.

LinuxDocker
Intermediate
Read guide
OpenTelemetry~45 min

Reduce duplicate logs with the OpenTelemetry Collector without hiding incident errors

Created: August 21, 2026 · Published: August 21, 2026

Learn how to roll out OpenTelemetry log deduplication with explicit guardrails, backend search parity, and rollback before changing the whole logging pipeline.

Linux
Advanced
Read guide
Logs~45 min

Scale OpenSearch shards online without spiking search latency

Created: August 19, 2026 · Published: August 19, 2026

Learn how to diagnose hot shards, decide whether primary shard scaling is justified, and run an online OpenSearch migration without losing writes or breaking searches.

LinuxDocker
Advanced
Read guide
Logs~40 min

Build incident timelines with OpenTelemetry entity events without guessing the cause

Created: August 15, 2026 · Published: August 15, 2026

A practical guide to reconstructing incidents with OpenTelemetry entity events, request context, traces, logs, and Prometheus without relying on human memory or disconnected dashboards.

LinuxDocker
Intermediate
Read guide
Logs~45 min

Protect Loki incident searches from cardinality and query fairness before logs disappear

Created: August 14, 2026 · Published: August 14, 2026

A practical guide to reducing Loki cardinality, tuning query and ingestion limits, and proving critical incident searches still work.

LinuxDocker
Advanced
Read guide
Logs~40 min

Investigate log spikes with OpenSearch PPL without hot shards misleading you

Created: August 10, 2026 · Published: August 10, 2026

Combine PPL, Dev Tools, and cluster metrics to investigate error spikes without confusing an application issue with shard skew or search pressure.

LinuxDocker
Advanced
Read guide
Logs~35 min

Debug Vector pipeline backpressure without losing logs in transit

Created: August 4, 2026 · Published: August 4, 2026

Learn how to find where Vector events are delayed or dropped, separate parsing failures from sink pressure, and use a safe checklist before production changes.

LinuxDocker
Intermediate
Read guide
Logs~45 min

Validate KEDA signals from OpenSearch before hot shards make autoscaling lie

Created: August 3, 2026 · Published: August 3, 2026

A practical guide to validating KEDA external metrics backed by OpenSearch before scaling services from signals biased by hot shards, noisy windows, or a saturated signal backend.

Advanced
Read guide
Logs~45 min

Redact PII in Vector pipelines without losing incident forensics

Created: July 27, 2026 · Published: July 27, 2026

Learn how to validate Vector VRL redaction rules, measure PII leaks, and protect incident investigation before shipping logs to OpenSearch or Loki.

LinuxDocker
Advanced
Read guide
OpenTelemetry~35 min

Enable logdedup in OpenTelemetry Collector without hiding incidents

Created: July 26, 2026 · Published: July 26, 2026

A practical guide to using the OpenTelemetry Collector logdedup processor without turning volume reduction into lost incident evidence.

LinuxDocker
Advanced
Read guide
Logs~35 min

Build Kubernetes incident timelines from OTel signals without inventing the root cause

Created: July 24, 2026 · Published: July 24, 2026

Learn how to reconstruct an operational timeline with OpenTelemetry, Prometheus, logs, and Kubernetes events so you can separate cause, symptom, and mitigation without relying on intuition.

Linux
Intermediate
Read guide
Logs~35 min

Fix Loki label cardinality before incident logs disappear

Created: July 12, 2026 · Published: July 12, 2026

Learn how to detect explosive Loki labels, move volatile context out of the index, and validate that critical logs remain available during incidents.

LinuxDocker
Advanced
Read guide
Logs~45 min

Debug Vector pipelines when logs arrive late, broken, or never arrive

Created: July 9, 2026 · Published: July 9, 2026

Validate a Vector pipeline with evidence: config, VRL, tap, internal metrics, backpressure, canaries, and rollback criteria.

LinuxDocker
Intermediate
Read guide
Logs~45 min

Diagnose OpenSearch vector-search hot shards before RAG latency spikes

Created: July 6, 2026 · Published: July 6, 2026

Learn how to detect hot shards in OpenSearch vector indices, prove whether they affect RAG retrieval, and apply safe mitigations with Dev Tools, metrics, and canaries.

LinuxDocker
Advanced
Read guide
Logs~45 min

Reconstruct AI search incident timelines without making up the story

Created: July 1, 2026 · Published: July 1, 2026

Turn scattered telemetry into a verifiable timeline: incident window, falsifiable hypotheses, trace anchors, correlated logs, saturation metrics, and mitigation validation.

LinuxDocker
Intermediate
Read guide
Logs~45 min

Deduplicate OpenTelemetry logs before Loki limits hide incident evidence

Created: June 30, 2026 · Published: June 30, 2026

Learn how to detect duplicates, apply a safe OpenTelemetry Collector deduplication policy, and prove Loki stops discarding samples without losing incident evidence.

Linux
Advanced
Read guide
Logs~45 min

Diagnose OpenSearch hot shards before indexing queues spiral

Created: June 27, 2026 · Published: June 27, 2026

Learn how to find OpenSearch hot shards with Dev Tools, queue metrics, and canary validation before search latency or bulk rejections ruin the morning.

Linux
Advanced
Read guide
Logs~45 min

Debug Vector pipeline backpressure before buffers become log loss

Created: June 25, 2026 · Published: June 25, 2026

Learn how to diagnose delayed and dropped logs in Vector with internal metrics, `vector top`, PromQL rules, disk buffers, and a safe canary before changing production.

LinuxDocker
Advanced
Read guide
Logs~40 min

Troubleshoot Loki ingest limits and label policies before tenant rate limits drop logs

Created: June 20, 2026 · Published: June 20, 2026

Learn how to investigate Loki drops caused by label policies, rate limits, and excessive streams, then clean volatile labels and validate that critical searches still work.

Linux
Advanced
Read guide
Logs~45 min

Control Vector cardinality before remote write and sinks backpressure

Created: June 19, 2026 · Published: June 19, 2026

A practical guide to contain explosive tags in Vector 0.56, separate cardinality from retries and buffers, and prove that Prometheus, logs, and SLOs still tell the truth.

Linux
Advanced
Read guide
Logs~42 min

Stop log bursts from turning OpenSearch rollover into hot shards

Created: June 15, 2026 · Published: June 15, 2026

Learn how to detect when OpenSearch log indices create hot shards during ingestion bursts, fix rollover with aliases and ISM, and validate recovery with real signals.

LinuxDocker
Advanced
Read guide
OpenTelemetry~40 min

Deduplicate logs in the OpenTelemetry Collector before queues start dropping telemetry

Created: June 13, 2026 · Published: June 13, 2026

Learn how to detect log pipeline pressure in the OpenTelemetry Collector, apply logdedup with safe conditions, and validate that queues, memory, and exporters stabilize without breaking audit streams or alerts.

LinuxDocker
Advanced
Read guide
Logs~40 min

Build incident timelines from logs, metrics, and traces without making up the missing parts

Created: May 2, 2026 · Published: May 2, 2026

Learn how to reconstruct a real incident from Prometheus, Loki, and distributed traces without getting lost in noise, clock skew, or confident storytelling.

LinuxDocker
Intermediate
Read guide
Logs~40 min

Debug Vector pipelines before retries and buffers hide the real bottleneck

Created: May 1, 2026 · Published: May 1, 2026

A practical guide to using Vector internal metrics, config validation, and isolation tests when logs arrive late, get retried too often, or vanish.

LinuxDocker
Intermediate
Read guide
Logs~40 min

Fix Loki label explosion without breaking the searches that actually matter

Created: April 29, 2026 · Published: April 29, 2026

A practical guide to spotting high-cardinality labels in Loki, taking them out of the hot path, and proving your searches still work.

LinuxDocker
Advanced
Read guide
Logs~40 min

Diagnose hot shards in OpenSearch before latency and indexing queues spiral

Created: April 27, 2026 · Published: April 27, 2026

Learn how to confirm an OpenSearch hot shard, find the affected index and node, fix the actual cause, and validate that recovery is real.

LinuxDocker
Advanced
Read guide
Logs~42 min

Build incident timelines with logs, metrics, and traces without making up the story

Created: April 19, 2026 · Published: April 19, 2026

Recent ecosystem signals point in the same direction: more telemetry does not automatically produce better diagnosis. This guide turns that into a repeatable method for building trustworthy timelines with Prometheus, Loki, and OpenTelemetry, while avoiding very current traps such as misleading memory metrics, noisy labels, and traces that lack useful request context.

LinuxDocker
Intermediate
Read guide
Logs~55 min

Resolve hot shards in OpenSearch before the cluster starts melting

Created: April 19, 2026 · Published: April 19, 2026

An advanced guide to isolating hot shards in OpenSearch with node, shard, and ingest signals, then applying reversible mitigations before queues, timeouts, and backlogs take over.

LinuxDocker
Advanced
Read guide
Logs~24 min

Debug Vector pipelines when logs arrive late, broken, or not at all

Created: April 17, 2026 · Published: April 17, 2026

When a Vector pipeline starts delaying, duplicating, or dropping events, random tuning is usually the expensive path. This guide shows how to use internal metrics, config validation, and sink-side signals to find the real bottleneck and fix it with reversible changes.

DockerLinux
Intermediate
Read guide
Logs~60 min

What to do when Loki sinks from label cardinality explosion

Created: April 13, 2026 · Published: April 13, 2026

Actionable guide to detect and fix high-cardinality labels that degrade or crash Loki: symptoms, metrics and logs to inspect, safe Promtail/ingest changes and validation steps.

DockerLinux
Advanced
Read guide
Logs~28 min

Size OpenSearch shards from real ingestion

Created: April 9, 2026 · Published: April 9, 2026

Advanced guide for choosing `number_of_shards` and `max_size` from the real ingestion rate of an index.

Advanced
Read guide
Logs~18 min

OpenSearch for centralized logs (cross-platform)

Created: April 6, 2026 · Published: April 6, 2026

Configure OpenSearch and Dashboards, load initial documents, and validate operational log-search workflows on any platform.

Docker
Beginner
Read guide