Logs in Context: Unifying Logs, Metrics, and Traces in New Relic

Logs become powerful when linked to the trace and entity that produced them

Logs are where the detailed truth lives, but jumping between a logging tool and your APM during an incident wastes precious minutes. Logs in context stitches log lines directly to the traces and entities that produced them.

The Three Pillars, United

New Relic’s value compounds when metrics, traces, and logs share context:

  • A metric alert fires
  • You open the relevant trace
  • The exact log lines for that trace are one click away — no copy-pasting trace IDs

Getting Logs In

Forward logs via the infrastructure agent, a log forwarder (Fluent Bit), or APM agent auto-injection. APM agents enrich each log with trace.id and span.id automatically:

{ "message": "payment failed", "level": "error",
  "trace.id": "abc123", "span.id": "def456",
  "entity.name": "checkout-service" }

Parsing rules turn unstructured logs into queryable attributes

Parsing and Pipelines

Raw text logs are hard to query. Parsing rules (Grok patterns) extract structured attributes you can filter and aggregate:

Stage Purpose
Parse Extract fields (status, duration, user)
Enrich Add entity and trace context
Drop filters Discard noisy, low-value logs
Partition Route logs to data partitions for fast search

Controlling Cost

  1. Drop debug and health-check logs you’ll never query.
  2. Sample extremely high-volume, low-value streams.
  3. Use metrics instead of logs for things you only ever count.

The best incident review is one where the log, the trace, and the deploy marker are already on the same screen.

What to Learn Next

  • NRQL on Log events for ad-hoc investigation
  • Log obfuscation for PII compliance
  • Data partitions and retention tuning

Arivanandhan Chitheshwaran