Logs, Kibana, and Observability for Product Managers

A customer reports a charge without a corresponding order. Investigating that report requires finding the operation and establishing what the systems recorded. Logs, Kibana, and Observability for Product Managers introduces the information available in logs and explains how to use it when examining a product incident.

Reconstruct an operation from its records

The book starts with what a log contains, then uses Kibana and KQL to search and filter events. Identifiers such as user.id, order.id, payment.id and trace.id help follow the operation across different systems. Timestamps and comparisons with successful operations provide context for locating the first unexpected behaviour.

• Search for a specific operation and filter the surrounding events.
• Follow identifiers and traces to reconstruct what happened before, during and after a problem.
• Compare successful and failed cases and look for recurring patterns.
• Estimate affected users or segments while distinguishing facts, correlations and possible causes.

Bring the investigation to Product and Engineering

The investigation extends beyond an individual case to questions about when the problem began, whether it affects other users and how large its impact may be. The book treats an error, its consequences and a suspected cause as different parts of the analysis, so that a report can state what is known and what still needs checking.

It is written for Product Managers and Product Owners and assumes no experience with Kibana, Elasticsearch, logs or observability. Coding is not required. The material supports incident investigation and collaboration with the technical team; it does not promise that finding a log entry establishes the root cause.