Services and log streams

A log stream begins with a name, a source endpoint and a service. The Log Operator records the source that the team intends to examine; the Service Owner keeps the linked service current. That connection gives an incoming alert a business context before an incident is opened. If a stream supports a customer-facing service, the owner can see the service’s criticality and current status while deciding who should investigate.

The stream record also carries retention days. Agree the number with the service owner and the team that operates the underlying log system. Entering a period here gives the operations team a clear setting to check when configuring storage. The source endpoint identifies where data originates. Keep its spelling stable so an alert can be traced back to the stream the operator expected.

• Service context. A service has a name, criticality, status and owner, so the stream is connected to an accountable operation.
• Source registration. The stream keeps its name, endpoint and retention setting together.
• Response path. An alert references the stream, which points the responder to the affected service.

Start with the service register. Assign an owner to each service that will receive streams, then record the endpoint and retention period for one representative source. Open the stream beside its service before creating an alert. If the owner changes, update the service record so later alerts still lead to the right person.

Decide who is allowed to register a stream and who can change its retention days. The Service Owner should know whether a service in maintenance is still expected to produce alerts. Establish a naming pattern that distinguishes production sources from other environments without relying on a freeform explanation in every alert.

Treat the source endpoint as an operational handoff. The person configuring the observability system needs to know which endpoint the record names and who verifies the connection. Inspect the processing receipt created during stream registration. Its external event identifier and outcome help the responsible reviewer confirm the registration result.

Suppose a checkout service has an application stream. The Log Operator records its endpoint and retention days under that service. The Service Owner checks the service’s criticality and owner, then asks the operator to capture an alert for a known query window. The operator opens the alert and confirms the stream reference points back to checkout. The responder can then use that service and its assigned assets when opening an incident. The operator also reviews the registration receipt by its external event identifier.

• Registered streams — Review the stream name, source endpoint, retention period and linked service.
• Open log alerts — Follow active query matches back to their stream.
• Processing receipts — Inspect registration processing outcomes by external event identifier.

Use stream registration and alert capture to rehearse the connection, then incident response when the alert needs investigation.