Which log lines deserve a seat at the incident table

Collectors in a busy Bangkok operations room can emit tens of thousands of lines in an hour. Observability signal analysis asks which lines would change a decision if they disappeared. That is a different question from which lines are the most frequent.

In the triage workshop we hand out a printed hour of logs with timestamps, request ids, and a mix of Thai and English messages. Pairs must keep ten lines and strike the rest. Then they must read the ten aloud and say what action each line supports: page a person, wait, or write a ticket for daylight.

Learners often keep stack traces that look dramatic and discard a single “queue depth 0 after retry budget exhausted” line. The exhausted budget is usually the better signal. We spend the last hour reversing those instincts with a shared ranking sheet.