Logs start as troubleshoot aids. Then they turn into compliance evidence, dashboards, billing shocks—and sometimes arresting officers’ homework. That weird progression is what bugs me most.
Most teams rely on downstream tools—masking pipelines, ingestion filters, “PII cleanup”—which does work, in a way. But it’s also late. The sink can scrub what it sees, but it cannot un-send sensitive fields that already escaped. That kind of cleanup is always a second chance attempt.
There’s also this quiet cost bleed. Observability vendors charge by the gigabyte. Every extra field logged—and retained—inflates storage, indexing, and retention fees. The tooling isn’t inherently expensive. We’re paying for data quality issues and developer habits that went unchecked at emission time.
Here’s the thing: governance belongs in the app, not only in the pipeline. If we can catch disallowed fields, redact PII, enforce schema consistency, and tag violations as logs are created—in process, with zero hot-path delay—it shifts the burden upstream. You keep your Serilog or MEL setup, keep shipping to Datadog or Splunk, but the noise, the risk, the cost—all that gets fewer chances to sneak in.
That’s exactly why I’ve built Cerbi: a thin governance layer that lives in-process, applies rules before logs leave, and leaves the sink to do what sinks do best. Makes audits less painful and incidents less costly—without rewriting every logger or changing dashboards.
Useful logs are good. Unsafe useful logs are still unsafe—and usually expensive.
#Observability #PlatformEngineering #Logging #DevSecOps