Centralized logging across microservices

WHAT THIS TESTS This evaluates whether you can centralize logs from many independent services and, critically, correlate them so one request is traceable end to end.

A GOOD ANSWER COVERS The key components are: structured logging in each service emitting JSON with consistent fields; a collection agent or sidecar that ships logs off the host; a transport and processing pipeline that parses, enriches, and buffers; a central storage and indexing layer; and a query and visualization frontend with alerting. A common stack is Fluent Bit or Fluentd shipping into Elasticsearch or Loki, viewed in Kibana or Grafana, or a managed service such as CloudWatch or Datadog. The decisive part is correlation: generate a unique correlation ID, or a full trace ID, at the entry point such as the API gateway, and propagate it through HTTP headers and message metadata to every downstream service. Each service includes that ID on every log line. To investigate a request you filter the central store by that one ID and see every service's logs in order. Add consistent log levels, sensible retention and indexing to control cost, and access controls so logs with sensitive data are protected.

COMMON WRONG ANSWERS Leaving logs as files on each host and SSHing in to grep, which is impossible across many ephemeral instances. Emitting unstructured free text that cannot be queried reliably. Forgetting the correlation ID, so logs cannot be tied to one request. Logging sensitive data with no redaction. Setting no retention policy, ballooning storage cost.

LIKELY FOLLOW-UPS How does the correlation ID propagate through async messages? How does this relate to distributed tracing? How do you control log volume and cost? How do you redact PII before storage?

ONE CONCRETE EXAMPLE A checkout fails. You search the central store for correlation ID abc-123 and see the gateway, cart, payment, and inventory service logs interleaved by timestamp, revealing the payment service threw a timeout. The per-service logs in isolation would never have shown that the failure originated downstream of the cart service.