engineering
Observability without the enterprise price tag
Structured logs, three golden metrics, and a couple of tracing spans — enough to debug production at 2am.
You don't need a six-figure vendor contract to run a SaaS responsibly. You need structured logs, a handful of metrics, and enough tracing to follow one request end-to-end. Most of the rest is expensive noise.
Structured logs, every line#
JSON over text. logger.info("user.signup", { userId, email }) over console.log("user signed up: " + email). Every log event becomes queryable, every field is a filter. The moment you have structured logs, "find all failed logins from this IP in the last hour" is one query instead of a grep pipeline.
Dot-notation event names#
user.signup, payment.failed, webhook.delivery.attempted. This lets you filter hierarchically — user.* catches everything auth-related. Readable to humans, grep-friendly, queryable in every log backend.
Three golden metrics#
Google's SRE book distilled monitoring to four signals; in practice three carry the load:
- Latency — request duration percentiles (p50, p95, p99)
- Errors — error rate as a percentage of total requests
- Saturation — how close to capacity (CPU, memory, queue depth, DB connections)
Everything else is nice-to-have.
Tracing the critical path#
Full distributed tracing is overkill for most SaaS. What you actually need is a traceId that flows from the incoming request through the DB query and the webhook dispatch, so you can reconstruct one bad request from the logs. AsyncLocalStorage carries the traceId, every log line includes it, done.
No secrets in logs#
Filter passwords, tokens, API keys, session IDs, and PII at the logger layer. Once a secret lands in a log file, it's in backups, metrics exports, and probably already on someone's laptop.