A customer sent us a screenshot of a 500 error with a timestamp. That was all we had. The request had passed through an API gateway, an auth service, an orders service, and a payments service, and each of them logged beautifully in its own format, into its own index, with no shared identifier anywhere. Finding that one request meant grepping four log stores by timestamp window and guessing which lines belonged together. We got it eventually, about ninety minutes later, by correlating on a use...