What is the difference between logs, metrics and traces, and when do you reach for each?

Metrics are aggregated numbers over time, cheap to store, and what you alert on. Logs are discrete events with detail, what you read once you know roughly where to look. Traces follow one request across services and show where the time went. In an incident you typically go metrics to notice, traces to localize, logs to understand, so a system missing any one of the three makes debugging slower than it needs to be.

Metrics are counters and histograms rolled up over time. They are cheap, they are what I put alerts on, and they tell me something is wrong but never why. Logs are individual events with context, expensive at volume, and what I read once I know where to look. Traces stitch one request across every service it touched and show the time in each span, which is the fastest way to answer whether the problem is us or a dependency. In an incident the workflow is basically metrics to notice, traces to localize, logs to understand. The thing that makes them work together is a correlation id propagated through every call and included in every structured log line, so from a slow trace I can jump straight to the exact log entries. The mistake I have made is cardinality: I once added user id as a metric label and the time series count exploded, which got expensive fast. High cardinality belongs in traces and logs, not in metric labels.