Experience the Power of Event Data Structures during Incident Triage

Due to the evolving Coronavirus/COVID-19 situation, SREcon20 Americas West has been rescheduled to June 2–4, 2020.
More information is available here.

Wednesday, March 25, 2020 - 9:30 am1:00 pm

Abby Bangser, MOO Print; Charity Majors, Honeycomb.io


The observability community is currently arguing over some foundational tenets, such as whether observability has "three pillars" of data (metrics, logs, and traces) or a single data structure of arbitrarily-wide events, from which multiple visualizations (including metric graphs, log lines, and trace waterfalls) can be derived.

The paradigm shift between highly detailed and highly structured logs and emitting a single event per service per request is nuanced enough to confuse many people, yet powerful enough to justify the shift. This workshop will let us get based theory and ground these debates in hands-on experience with both formats.

You will have the chance to work with any of the tool stacks (Elasticsearch/Kibana, Loki/Grafana, Honeycomb) to triage two different Game Day scenarios. In one scenario you will be provided high-quality structured logs whereas in the other you will triage using arbitrarily-wide events.

Note: Participants will be most successful if they have experience triaging issues with logs, but this is not required. All activities will be done via websites and do not require local installs of anything.


  • Experience running queries with event data structures to visualize the data in metric, log, and tracing views
  • Contextualised comparison of high-quality structured logs vs. events based on debugging a single application with different outputs
  • Ability to explain the unique selling point of events above highly contextualized and structured logs

Abby Bangser, MOO Print

Abby Bangser is a software tester with a keen interest in working on products where fellow engineers are the users. Abby brings the techniques of analyzing and testing customer-facing products to tools like delivery pipelines and logging so as to generate clearer feedback and greater value. Currently, Abby is a Test Engineer on the Platform Engineering team at MOO which supports the shared infrastructure and tooling needs of the organization.

Outside of work Abby is active in the community by co-leading Speak Easy which mentors new and diverse speakers, co-hosting the London free testing meetup Essentials which brings together mentors and new joiners to the software testing industry, and hosting #CoffeeOps London.

Charity Majors, Honeycomb.io

Charity Majors is the cofounder and CTO of Honeycomb.io, a provider of tools for engineering teams to debug production systems faster and smarter. Previously Charity ran infrastructure at Parse and was an engineering manager at Facebook, where she ran next-generation distributed systems at scale. Charity is the co-author of Database Reliability Engineering (O'Reilly) and is devoted to a world where every engineer is on call and nobody thinks on call sucks.

@conference {247249,
author = {Abby Bangser and Charity Majors},
title = {Experience the Power of Event Data Structures during Incident Triage},
year = {2020},
address = {Santa Clara, CA},
publisher = {{USENIX} Association},
month = mar,