Glossary

81 terms, in the sense this mechanism uses them. The platform glossary has every term across all mechanisms.

Adaptive execution: A query engine changing its plan while the query runs, using what it has just measured (for example splitting skewed partitions).
Alert fatigue: People ignoring alerts because too many are false. It is a designed-in result of large check suites.
Aliasing: Losing intermediate values because you observe a changing thing less often than it changes.If you look at something only every 15 minutes, you see its state at those moments and nothing in between. If a value changes three times between two looks, you see only the last value. Signal engineers call this aliasing.
Anomaly detection (on spend): Alerting on deviation from a learned baseline instead of a fixed threshold.
Attention constraint: The fact that human attention has a fixed rate and does not scale with money.
Auto-remediation: Automatic repair actions (such as restart) triggered by an alert.
Backpressure: A signal from a consumer, based on its actual state, that makes the producer slow down.If a slow step cannot keep up, it tells the step before it to slow down, and that step tells the one before it, until the source stops reading. We study this in Part 8.
Base rate: How often the real event happens; it decides alert precision.
Blameless review: A post-incident review that avoids punishing people, so that they share complete detail.
Blue-green tables: Two full copies of a table, one live and one new, switched by a pointer for instant rollback.
Bucket (histogram): A range of values with a count of observations inside it.
Burn rate: The speed of error-budget use relative to the sustainable pace.
Canary: A synthetic test record injected on purpose to prove that a path works.1 other meaning →
Cardinality: The number of distinct values a label can take. The series count is the product over all labels.2 other meanings →The number of distinct things in a set. "20 million files" is a statement about cardinality. Metadata size follows cardinality (how many objects), not bytes.
Change event: A marker for a deploy, config or schema change, overlaid on charts.
Chargeback: Billing teams for their own usage; can cause teams to build private copies of shared assets.
Collector: A component that receives, batches and forwards telemetry.1 other meaning →
Consumer lag: How far a queue consumer is behind the newest record, in records or time.A queue such as Kafka stores records in a topic. A topic is split into partitions, which are independent ordered logs. Every record in a partition has a number, its offset. A consumer reads records and remembers its offset. Consumer lag is how far the consumer is behind the newest record (in records, or in time).
Count-Min Sketch: A d × w table of counters that estimates item frequencies with overestimation proportional to total stream size.
Counter: A metric that only increases; survives lost scrapes.
Dataset: A service answers requests (an API). A dataset is a table or file set that a pipeline produces and other people read later. We observe both, but in different ways.
Dead-man's switch: An independent process that alerts when an expected heartbeat does not arrive.
Distributed trace: The record of one request across services, made of spans.
Early binding: Checking the format when data is written, so errors appear in the producer.Binding means fixing the structure and meaning of data. Early binding: decide at load time ("this column is the customer's region"). Late binding: store raw facts and decide at read time. Early binding makes reads simple and changes expensive. Late binding makes changes cheap and reads complex.
Error budget: The failure allowed by an SLO over its window.
Event time: When something happened in the world, stamped near the source.Every event carries a timestamp of when it happened (event time), which differs from when the job sees it (processing time). Events arrive late and out of order: a phone with no signal sends its events 5 minutes after they happened. A watermark is a marker flowing through the stream that says "no event with a timestamp earlier than T should arrive any more." It is the job's best guess of how complete the input is. When the watermark passes the end of a time period, the job may treat that period as complete. Watermarks are a guess, and late events can still violate them. The rules of when it is correct to emit a result (event time versus processing time, how late is too late) are a topic of their own. In this mechanism we need only the idea above. We study the machinery that holds data until the watermark allows an answer.
Exemplar: A trace id attached to a histogram bucket; links an aggregate to an example.
Failure domain: A set of components that can fail together.A set of components that fail together: machines in one rack share a switch and a power feed; machines in one AZ share a building; every machine running the same buggy deployment shares that bug. When we say two replicas fail "independently", we mean they are in different failure domains.
Flame graph: A chart of stack-sample counts showing where time is spent.
Freshness: now − max(event_time) in a dataset.
Gauge: A metric that moves up and down; a point sample.
Goodhart's law: A measure that becomes a target stops being a good measure.
Head-based sampling: Deciding at the start of a request whether to keep its trace.
Heavy-hitters sketch: A small structure that finds the most frequent keys approximately.
Histogram: A metric that counts observations per bucket; can be summed across instances.
Inverted index: A map from each term to the list of documents that contain it.
Label: A key-value pair attached to a metric (for example status="200").
Latency: Time one operation takes from request to response.Throughput is work finished per second. Latency is how long one operation takes. Little's Law links them to the number of operations in progress: L = λ × W, where λ is the arrival rate (per second), W is the average time one operation spends in the system, and L is how many are inside the system at the same time. Example: 1,000 requests per second, each taking 20 ms (0.02 s), means 1,000 × 0.02 = 20 requests in flight at any moment. This is an identity, not a design choice.
Lineage: The map of which assets feed which.A map of what feeds what: table A is read by job J, which writes table B. Following the map shows what would be affected if A changes.
Little's Law: L = λW: average items in a system = arrival rate × average time in the system.Throughput is work finished per second. Latency is how long one operation takes. Little's Law links them to the number of operations in progress: L = λ × W, where λ is the arrival rate (per second), W is the average time one operation spends in the system, and L is how many are inside the system at the same time. Example: 1,000 requests per second, each taking 20 ms (0.02 s), means 1,000 × 0.02 = 20 requests in flight at any moment. This is an identity, not a design choice.
Message queue: A system such as Kafka that stores records in topics split into ordered partitions. Each record has an offset; consumers track the offset they have read up to, and how far behind the newest record they are is consumer lag.A queue such as Kafka stores records in a topic. A topic is split into partitions, which are independent ordered logs. Every record in a partition has a number, its offset. A consumer reads records and remembers its offset. Consumer lag is how far the consumer is behind the newest record (in records, or in time).
MTTD: Mean time to detect and mean time to repair: how long a fault lives before you notice it, and before you fix it.
MTTD / MTTR: Mean time to detect / mean time to repair.
MTTR: MTBF (mean time between failures) is the average time a component runs before it fails. MTTR (mean time to repair) is the average time to get it working again.
Observable: A system whose internal state can be inferred from its outputs.
Off-CPU time: Wall-clock time minus CPU time: time spent blocked or waiting.
Offset: A consumer's position in a partition (one integer).An event is a small record: "order 77 placed by user 12 at 12:03:04". A log is an append-only file or service: new events are added at the end, and old events are never changed. A topic is a named log (the word comes from systems like Apache Kafka). Every event has an offset, its position in the log (0, 1, 2, …). A reader remembers "I have read up to offset 5,000", and can go back to offset 3,000 and read again. This ability to replay is the foundation of this whole mechanism. A log keeps events for a configured time (retention), for example 7 days, then deletes the oldest ones.
On-call: A person who is on call must answer alerts. A page is an alert that wakes or interrupts that person.
Page: An alert that interrupts a person.3 other meanings →A person who is on call must answer alerts. A page is an alert that wakes or interrupts that person.
Partition: One ordered slice of a topic that can be stored and read in parallel.3 other meanings →A topic is a named stream of records ("orders"). Big topics are cut into partitions: separate ordered lists that can be stored and read in parallel. Records in one partition have a fixed order. Across partitions there is no shared order.
Partition skew: Keys spread unevenly across partitions even though no key is large.When some partitions hold much more data than others, work is not shared evenly. The job ends only when the biggest partition ends.
Percentile (p50, p99, p99.9): The value below which that fraction of observations fall.p50 is the median latency, p99 is the latency that 99% of requests beat. The slowest requests are the tail. When one request needs answers from many servers (a fan-out) it must wait for the slowest one. With 100 servers that each have a 1% chance of being slow, the chance that at least one is slow is 1 − 0.99¹⁰⁰ = 63%. So the user-facing tail is much worse than any single server's tail.
Profile: A statistical record of where a program spends resources.
Projection: A partial, lossy view of a system's state.2 other meanings →
RED: Rate, Errors, Duration: request-centric metrics.
Runbook: A written, reusable procedure for a known problem.
Sampling: Keeping only a fraction of events.1 other meaning →
Schema-on-read vs. schema-on-write: Schema-on-write fixes the structure of data when you store it. Schema-on-read stores raw text and decides the structure when you query. The first costs effort early and makes queries cheap. The second is the opposite.
Scrape interval: The time between two metric collections.Many monitoring systems pull numbers from each service every N seconds (for example every 15 s). N is the scrape interval. Between two scrapes you see nothing.
Series: One distinct combination of metric name and label values.
Service: A service answers requests (an API). A dataset is a table or file set that a pipeline produces and other people read later. We observe both, but in different ways.
Shadow pipeline: A new implementation run beside the old one on the same input, with outputs compared.
Showback: Showing teams their costs without billing them.
Sketch (HyperLogLog): A small summary of a data set that answers one kind of question approximately.A quantile is a percentile: the value below which a given fraction of data falls (the median is the 50% quantile). A sketch is a small, fixed-size summary of a huge dataset that answers one kind of question approximately: for example a t-digest or KLL sketch answers quantile questions, HyperLogLog counts distinct values, and Space-Saving finds the most frequent values. A sketch is built in a single pass and uses bounded memory.
Skew: A task or partition much bigger than its peers.2 other meanings →A column is skewed when some values are far more common than others. In a Zipf distribution, the most common value is about twice as common as the second, three times as common as the third, and so on. Web data, names, products and customers are often Zipf-like. A key is hot when it has far more rows than average.
SLA: Service-level agreement: a promise, here usually about the timing or freshness of data.An SLI (service level indicator) is a measured quantity, such as "fraction of requests that succeed". An SLO (objective) is the target for it, such as "99.9% over 30 days". An SLA (agreement) is an SLO written into a contract, usually with penalties.
SLA / SLO / SLI: Contractual agreement / target / measured indicator of service quality.
SLI: Service level indicator: a measured quantity such as the fraction of requests that succeed. The SLO is its target; the SLA is an SLO written into a contract.An SLI (service level indicator) is a measured quantity, such as "fraction of requests that succeed". An SLO (objective) is the target for it, such as "99.9% over 30 days". An SLA (agreement) is an SLO written into a contract, usually with penalties.
SLO: Service level objective, for example "99% of requests under 100 ms".A service level objective is a target such as "99% of requests finish in under 100 ms."
Space-Saving: A heavy-hitter algorithm that evicts the minimum counter and adopts its count plus one.
Span: One unit of work inside a trace.
Structured logging: Writing log events as records with named fields.
Tail (a log): The slowest requests, such as those above p99.p50 is the median latency, p99 is the latency that 99% of requests beat. The slowest requests are the tail. When one request needs answers from many servers (a fan-out) it must wait for the slowest one. With 100 servers that each have a 1% chance of being slow, the chance that at least one is slow is 1 − 0.99¹⁰⁰ = 63%. So the user-facing tail is much worse than any single server's tail.
Tail-based sampling: Deciding to keep a trace after it is complete.
Telemetry: Data a system emits about itself.The data a system emits about itself: numbers, log lines, traces. "Observability" means that you can infer the inside of a system from this output. The word comes from control theory: a system is observable if its internal state can be worked out from its outputs alone.
Throughput: Work completed per unit of time.Throughput is work finished per second. Latency is how long one operation takes. Little's Law links them to the number of operations in progress: L = λ × W, where λ is the arrival rate (per second), W is the average time one operation spends in the system, and L is how many are inside the system at the same time. Example: 1,000 requests per second, each taking 20 ms (0.02 s), means 1,000 × 0.02 = 20 requests in flight at any moment. This is an identity, not a design choice.
Topic: A named stream of records.A topic is a named stream of records ("orders"). Big topics are cut into partitions: separate ordered lists that can be stored and read in parallel. Records in one partition have a fixed order. Across partitions there is no shared order.
Two-phase commit (2PC): Prepare then decide; participants give up the right to abort after voting yes.A way to make a change appear in two places atomically (all or nothing). Phase 1: every participant prepares and promises it can commit. Phase 2: when all have promised, everyone commits. If any participant says no, everyone aborts. Until phase 2, the change stays invisible.
USE: Utilization, Saturation, Errors: resource-centric metrics.
Utilization (ρ): The fraction of time a resource is busy.Utilization (ρ, "rho") is the fraction of time a server is busy. For random arrivals, average response time grows like S ÷ (1 − ρ), where S is the service time: 2×S at 50%, 5×S at 80%, 10×S at 90%, 100×S at 99%. Queues are caused by variability meeting load, and the curve has a wall at 100%. The last few percent of utilization cost more than the first eighty.
Write-Audit-Publish: Write to staging, check with assertions, then atomically publish.