PromQL + LogQL + TraceQL

Query languages expose raw telemetry — production investigation needs cross-signal reasoning.

Problem

Metrics, logs, and traces each have powerful query languages — but incidents span all three, and engineers pay the integration tax during every outage.

Current Practice

PromQL, LogQL, and TraceQL are mastered separately. Investigation stitches results together manually across tabs, time pickers, and label conventions.

Why It Breaks Down

Query silos optimize storage and retrieval per signal type, not investigation workflow. Label mismatches and time skew between systems produce false correlations.

Architecture

Use query languages at the evidence retrieval layer. Build investigation UX on unified identity, aligned time windows, and cross-signal evidence objects — not concatenated query results.

PromQL

Metrics retrieval

LogQL

Log retrieval

TraceQL

Trace retrieval

Unify

Shared identity + window

Investigate

Cross-signal evidence

Query languages retrieve evidence — investigation reasoning sits above the silos.

Tradeoffs

Unified investigation simplifies engineer workflow but does not replace signal-specific stores. Federated queries must respect each backend's strengths and limits.

Implementation

Normalize labels and resource identity across backends, define cross-signal investigation primitives, and expose query languages where power users need them — not as the default incident path.