Ship logs from day one. Bake the agent into the VM template so every host reports from birth; retrofitting later is painful.
Pick tools that fit your scale. Loki indexing labels (not full text) is what keeps it light enough for a lab.
Labels are the product. Host, service, namespace, container, severity — the query experience is entirely down to how well you labelled.
Let the network be part of the boundary. Loki runs auth-free because it's private-only and never edge-exposed — a defensible simplification, but one you'd revisit the moment its exposure changed.
One Grafana for logs and metrics keeps investigation in a single place (see Monitoring).
No comments to display
No comments to display