All guides

Filter by category, difficulty, or free text to find the right material for your team.

Logs~35 min

Fix Loki label cardinality before incident logs disappear

Created: July 12, 2026 · Published: July 12, 2026

Learn how to detect explosive Loki labels, move volatile context out of the index, and validate that critical logs remain available during incidents.

LinuxDocker
Advanced
Read guide
Logs~45 min

Debug Vector pipelines when logs arrive late, broken, or never arrive

Created: July 9, 2026 · Published: July 9, 2026

Validate a Vector pipeline with evidence: config, VRL, tap, internal metrics, backpressure, canaries, and rollback criteria.

LinuxDocker
Intermediate
Read guide
Logs~45 min

Diagnose OpenSearch vector-search hot shards before RAG latency spikes

Created: July 6, 2026 · Published: July 6, 2026

Learn how to detect hot shards in OpenSearch vector indices, prove whether they affect RAG retrieval, and apply safe mitigations with Dev Tools, metrics, and canaries.

LinuxDocker
Advanced
Read guide
Logs~45 min

Reconstruct AI search incident timelines without making up the story

Created: July 1, 2026 · Published: July 1, 2026

Turn scattered telemetry into a verifiable timeline: incident window, falsifiable hypotheses, trace anchors, correlated logs, saturation metrics, and mitigation validation.

LinuxDocker
Intermediate
Read guide
Logs~45 min

Deduplicate OpenTelemetry logs before Loki limits hide incident evidence

Created: June 30, 2026 · Published: June 30, 2026

Learn how to detect duplicates, apply a safe OpenTelemetry Collector deduplication policy, and prove Loki stops discarding samples without losing incident evidence.

Linux
Advanced
Read guide
Logs~45 min

Diagnose OpenSearch hot shards before indexing queues spiral

Created: June 27, 2026 · Published: June 27, 2026

Learn how to find OpenSearch hot shards with Dev Tools, queue metrics, and canary validation before search latency or bulk rejections ruin the morning.

Linux
Advanced
Read guide
Logs~45 min

Debug Vector pipeline backpressure before buffers become log loss

Created: June 25, 2026 · Published: June 25, 2026

Learn how to diagnose delayed and dropped logs in Vector with internal metrics, `vector top`, PromQL rules, disk buffers, and a safe canary before changing production.

LinuxDocker
Advanced
Read guide
Logs~40 min

Troubleshoot Loki ingest limits and label policies before tenant rate limits drop logs

Created: June 20, 2026 · Published: June 20, 2026

Learn how to investigate Loki drops caused by label policies, rate limits, and excessive streams, then clean volatile labels and validate that critical searches still work.

Linux
Advanced
Read guide
Logs~45 min

Control Vector cardinality before remote write and sinks backpressure

Created: June 19, 2026 · Published: June 19, 2026

A practical guide to contain explosive tags in Vector 0.56, separate cardinality from retries and buffers, and prove that Prometheus, logs, and SLOs still tell the truth.

Linux
Advanced
Read guide
Logs~42 min

Stop log bursts from turning OpenSearch rollover into hot shards

Created: June 15, 2026 · Published: June 15, 2026

Learn how to detect when OpenSearch log indices create hot shards during ingestion bursts, fix rollover with aliases and ISM, and validate recovery with real signals.

LinuxDocker
Advanced
Read guide
OpenTelemetry~40 min

Deduplicate logs in the OpenTelemetry Collector before queues start dropping telemetry

Created: June 13, 2026 · Published: June 13, 2026

Learn how to detect log pipeline pressure in the OpenTelemetry Collector, apply logdedup with safe conditions, and validate that queues, memory, and exporters stabilize without breaking audit streams or alerts.

LinuxDocker
Advanced
Read guide
Logs~40 min

Build incident timelines from logs, metrics, and traces without making up the missing parts

Created: May 2, 2026 · Published: May 2, 2026

Learn how to reconstruct a real incident from Prometheus, Loki, and distributed traces without getting lost in noise, clock skew, or confident storytelling.

LinuxDocker
Intermediate
Read guide
Logs~40 min

Debug Vector pipelines before retries and buffers hide the real bottleneck

Created: May 1, 2026 · Published: May 1, 2026

A practical guide to using Vector internal metrics, config validation, and isolation tests when logs arrive late, get retried too often, or vanish.

LinuxDocker
Intermediate
Read guide
Logs~40 min

Fix Loki label explosion without breaking the searches that actually matter

Created: April 29, 2026 · Published: April 29, 2026

A practical guide to spotting high-cardinality labels in Loki, taking them out of the hot path, and proving your searches still work.

LinuxDocker
Advanced
Read guide
Logs~40 min

Diagnose hot shards in OpenSearch before latency and indexing queues spiral

Created: April 27, 2026 · Published: April 27, 2026

Learn how to confirm an OpenSearch hot shard, find the affected index and node, fix the actual cause, and validate that recovery is real.

LinuxDocker
Advanced
Read guide
Logs~42 min

Build incident timelines with logs, metrics, and traces without making up the story

Created: April 19, 2026 · Published: April 19, 2026

Recent ecosystem signals point in the same direction: more telemetry does not automatically produce better diagnosis. This guide turns that into a repeatable method for building trustworthy timelines with Prometheus, Loki, and OpenTelemetry, while avoiding very current traps such as misleading memory metrics, noisy labels, and traces that lack useful request context.

LinuxDocker
Intermediate
Read guide
Logs~55 min

Resolve hot shards in OpenSearch before the cluster starts melting

Created: April 19, 2026 · Published: April 19, 2026

An advanced guide to isolating hot shards in OpenSearch with node, shard, and ingest signals, then applying reversible mitigations before queues, timeouts, and backlogs take over.

LinuxDocker
Advanced
Read guide
Logs~24 min

Debug Vector pipelines when logs arrive late, broken, or not at all

Created: April 17, 2026 · Published: April 17, 2026

When a Vector pipeline starts delaying, duplicating, or dropping events, random tuning is usually the expensive path. This guide shows how to use internal metrics, config validation, and sink-side signals to find the real bottleneck and fix it with reversible changes.

DockerLinux
Intermediate
Read guide
Logs~60 min

What to do when Loki sinks from label cardinality explosion

Created: April 13, 2026 · Published: April 13, 2026

Actionable guide to detect and fix high-cardinality labels that degrade or crash Loki: symptoms, metrics and logs to inspect, safe Promtail/ingest changes and validation steps.

DockerLinux
Advanced
Read guide
Logs~28 min

Size OpenSearch shards from real ingestion

Created: April 9, 2026 · Published: April 9, 2026

Advanced guide for choosing `number_of_shards` and `max_size` from the real ingestion rate of an index.

Advanced
Read guide
Logs~18 min

OpenSearch for centralized logs (cross-platform)

Created: April 6, 2026 · Published: April 6, 2026

Configure OpenSearch and Dashboards, load initial documents, and validate operational log-search workflows on any platform.

Docker
Beginner
Read guide