We use cookies or similar technologies to personalize your online experience and tailor marketing to you. Many of our product features require cookies to function properly. Your use of this site and online product constitutes your consent to these personalization technologies. Read our Privacy Policy to find out more.

X

Thinking about events, metrics and logs

Events

An event is a collection of information about what it took to complete a unit of work. For example, accepting an HTTP request and doing the required work and then passing back a response.

Logs

A log is a message, or a collection of messages. They usually have a timestamp attached. Individual logs may or may not be related to each other.

Metrics

Metrics are a single measurement, often used to track and assess something over a period of time.

Events vs. Metrics

(Code examples: events, metrics)

Events vs. Metrics

In this example, the left side is instrumented with events, the right, with metrics. Both capture the duration, but the output is quite different. Events are built up over time, gaining context as they go, whereas metrics are updated individually, and don’t carry that same context.

The output from this example is quite different when looking at events versus metrics.

Events output

In this example, Honeycomb was used for events, and although a graph was rendered we are showing the raw data for a more equal comparison.

Events Output

Metrics output

In this example, StatsD was used for metrics.

Metrics Output

Comparison of outputs

Both of these examples capture the duration in milliseconds as well as how many times the example app was run. At first glance, the metrics output appears to have more data, but all of those can be calculated from the data output from events. Metrics tools need to do this calculation before write time. We can calculate all of the same metrics in Honeycomb, but we also gain further context. Events let us add the richer information of input and output and the timestamp when they occurred. The metrics output is meant to be passed into a machine for consumption and translation. The events can be as well, but they’re human readable as well.

Events vs. Logs

(Code examples: events, logs)

Events vs. Logs The example on the left is instrumented with events, the one on the right is instrumented with logs. Both events and logs capture the duration in milliseconds. Using events, we simply add it as a field to the event that will eventually be returned. With logs, we can log it. In this example, we’ve included the timestamp for each log statement, which can be parsed out with regex. The log then includes a string describing the data, and then finally the data itself (in this case, the duration in milliseconds). This is very readable for people, but machines could easily struggle with this. If there are many engineers working on your system, you might end up with many different log statement formats.

Events output

In this example, Honeycomb was used for events, and although a graph was rendered we are showing the raw data for a more equal comparison.

Events Output

Logs output

In this example, we logged the output to the terminal:

Logss Output

Comparison of outputs:

All the information is included in both outputs, but events allow you to see patterns in your data much faster. For example, we can see that one event was much slower than the other in both cases. We can see this at a glance with the events output, but when using logs, we have to read through the entire output to find the two duration lines and which input and output is tied to which.

Events, Metrics and Logs

All three of these implementations take about the same amount of time, effort and lines of code. The events and metrics were a little more effort to get set up initially, because they required some configuration to an outside service (though if you’re doing more than outputting logs to the terminal, logs will require the same amount of setup).

Events provide both human and computer readable information, are not aggregated at write time, and allow us to ask more questions and combine the data in different ways. They provide all the information of metrics and logs combined plus more.