Send a representative stream of application and infrastructure logs to Graylog, including a known error and a request identifier. Build a query and alert that would have helped during a past incident, then check ingestion delay, parsing quality, and whether the on-call person can find the relevant events.
Logs may contain secrets or personal data. Redact before ingestion and define retention and access rules. Test backup and index recovery as well as search speed. An observability platform is useful when it shortens diagnosis without creating a data exposure problem.
Akousa