Log Aggregation
Log aggregation is the practice of collecting log output from many distributed sources — servers, containers, and services — into a single centralized system where it can be searched, analyzed, and correlated.
Definition
Log aggregation is the practice of collecting log output from many distributed sources — servers, containers, and services — into a single centralized system where it can be searched, analyzed, and correlated.
Overview
In any system with more than a handful of servers, logs scattered across individual machines are effectively useless during an incident — nobody can SSH into fifty containers one at a time while an outage is happening. Log aggregation solves this by shipping every log line to a central store as it's generated, usually via a lightweight collector agent or a sidecar pattern running next to each service, so all logs become searchable from one place regardless of which machine or container originally produced them. Common aggregation stacks include the Elastic Stack (Elasticsearch, Logstash or Logstash, and Kibana), Grafana's Grafana Loki, and managed platforms like Splunk and Datadog. These systems typically index logs for fast full-text search, support structured querying, and can trigger alerts directly on log patterns — a spike in error-level log lines, for instance, can page the on-call rotation automatically. Log aggregation is one of the three foundational pillars of observability, alongside metrics and distributed tracing, and it's often the first place engineers look during incident management to reconstruct exactly what a system was doing in the moments before and during a failure. The 'treat logs as event streams' principle from the twelve-factor app methodology directly underpins this approach — applications simply emit log events, and the platform is responsible for collecting and routing them centrally.
Key Concepts
- Centralizes logs from many distributed sources into one searchable system
- Structured, indexed storage that supports fast full-text and field-based queries
- Correlation of log lines across services during incident investigation
- Alerting rules that can trigger directly on log patterns or anomalies
- Retention policies balancing storage cost against how far back logs remain searchable
- Common backends include the Elastic Stack, Grafana Loki, Splunk, and Datadog