← Graph

Alerts on logs vs metrics at scale

question 1 connections

Audience asks at what volume logs become too slow to power 1-minute or 5-minute alerts, forcing a switch to metrics. Callaghan replies that even at BiggerPockets scale (3M members, hundreds of thousands of logs for anything commonly used) he hasn't hit that wall — he runs aggregations over the last few minutes and thresholds them. He also pushes back on the premise: he's reticent to add alerts at all because noisy alerts are worse than none, and prefers ad-hoc exploration with alerts used sparingly for truly critical thresholds.

answer_summary
He hasn't hit a log-volume ceiling for alerting at 3M-member scale; runs rolling aggregations with thresholds. Bigger point: be reticent about alerts entirely — prefer exploration, because noisy alerts train teams to ignore them.
question Alerts on logs vs metrics at scale
asked_at
Audience asked at what log volume metrics become necessary for alerts.

Provenance

Read by
2 extractions