Skip to content

Telemetry Data: Signals, Resources and Log Shapes: OTCA practice questions

Telemetry is the data a system emits about itself and its behavior. OpenTelemetry groups that data into signals, and today the supported signals are traces, metrics, logs and baggage. Two more are still maturing: events, which are a specific kind of log, and profiles, whose concepts page carries an Alpha status.

By Ibrahim Yesilay · Published · Updated

Independent community practice, not affiliated with or endorsed by CNCF or The Linux Foundation.

What Telemetry Data: Signals, Resources and Log Shapes covers in OTCA

Telemetry is the data a system emits about itself and its behavior. OpenTelemetry groups that data into signals, and today the supported signals are traces, metrics, logs and baggage. Two more are still maturing: events, which are a specific kind of log, and profiles, whose concepts page carries an Alpha status. For the OTCA you should be able to say what each signal is for and how they relate to each other.

A trace records the path of one request through an application. It is built from spans, and each span is a unit of work with a name, start and end timestamps, a span context (trace ID, span ID, trace flags and trace state), attributes, events, links and a status. Spans that share a trace ID and point at a parent span ID form a hierarchy; the span without a parent is the root. A span event marks a meaningful single point in time inside a span. The rule of thumb in the docs is simple: if the timestamp matters, use an event; if it does not, use a span attribute.

A metric is a measurement captured at runtime. The moment a measurement is captured is called a metric event, and it includes the value, the capture time and associated metadata. Instruments such as Counter, UpDownCounter, Gauge and Histogram, plus asynchronous Counter, UpDownCounter and Gauge, produce measurements, and the SDK aggregates them before export.

A log is a timestamped record, structured or unstructured, with optional metadata. OpenTelemetry works with existing logging libraries through bridges instead of asking developers to switch. The docs distinguish three shapes. Structured logs have a stable schema with consistent field names and types. Semistructured logs contain key=value pairs or JSON whose fields vary between messages. Unstructured logs are free text that needs regular expressions or custom parsers. Being JSON alone does not make a log structured. An event is a log record that has an event name and a well-known structure, so every event is a log, but most logs are not events.

Baggage is a key-value store that travels with context across services. It is useful for values known at the start of a request, such as an account or user ID, that downstream services want to attach to their own telemetry. Baggage entries are not attributes; code or a Baggage Span Processor has to copy them explicitly. Because baggage is sent in headers and has no integrity checks, it should never hold credentials or other sensitive data.

Every signal is also tied to a resource, which describes the entity producing the telemetry: a service, a process, a container, a pod or a host. The resource is attached to a provider when it is created and stays fixed for everything that provider emits. Profiles complete the picture by showing which code consumes CPU, memory or other resources, and they can link back to traces and resources.

Key points

  • Traces, metrics, logs and baggage are the currently supported signals; events and profiles are still maturing, and profiles are marked Alpha.
  • A span event records a meaningful point in time within a span, while span attributes describe the operation as a whole.
  • A log is structured only when it follows a stable schema; JSON with varying fields is semistructured.
  • An event is a log record with an event name and a well-known structure.
  • Baggage is a separate key-value store and its entries become attributes only when they are copied explicitly.

Three sample questions

14 OTCA questions on Telemetry Data: Signals, Resources and Log Shapes, 14 with explanations. How practice works

Question 1

You are a developer managing a production system that currently uses unstructured logs, making it difficult to perform scalable log analysis. To improve observability, you consider switching to a different logging approach. Which option would most effectively enhance your log analysis capabilities?
  1. A.Continue using unstructured logs but implement more comprehensive regular expressions for parsing.
  2. B.Switch to structured logging using a standard logging framework.
  3. C.Store logs in plain text files for easier access.
  4. D.Reduce the volume of logs by limiting log levels to ERROR only.

Correct answer: B

The Logs concepts page says structured logs "are preferred in production because their stable schema makes them straightforward to validate, parse, correlate with traces and metrics, and analyze at scale", while unstructured logs are "much more difficult to parse and analyze at scale". Why the other options are wrong. "Continue using unstructured logs but implement mor…": more regular expressions keep the core problem: unstructured logs are hard to parse at scale. "Store logs in plain text files for easier access.": plain text files do not add structure, so analysis stays just as hard. "Reduce the volume of logs by limiting log levels t…": dropping everything below ERROR removes useful data without making the remaining logs easier to analyze.

Sources: OpenTelemetry docs: Logs, OpenTelemetry spec: Logs

Question 2

Which of the following is a key limitation of traditional logging systems in distributed environments?
  1. A.They often cannot be correlated with traces and metrics.
  2. B.They natively support distributed tracing information.
  3. C.They have standardized context propagation across services.
  4. D.They provide real-time log analysis capabilities.

Correct answer: A

The Logs spec says existing logging solutions "are currently weakly integrated with the rest of the observability signals", that the correlation they offer is fragile, and that logs have no standardized way to propagate and record the request execution context. In distributed systems this leaves logs hard to tie to traces and metrics. Why the other options are wrong. "They natively support distributed tracing informat…": traditional logging lacks trace context unless something like OpenTelemetry adds it. "They have standardized context propagation across…": the spec says logs have no standardized way to propagate context, which is the limitation. "They provide real-time log analysis capabilities.": real-time analysis is a tooling feature, not a limitation of distributed logging.

Sources: OpenTelemetry spec: Logs, OpenTelemetry docs: Logs

Question 3

In OpenTelemetry's metrics terminology, what is the "metric event"?
  1. A.A sampled measurement that carries the trace ID and span ID of the active span
  2. B.The moment a measurement is captured, consisting of the measurement, its capture time and associated metadata
  3. C.The moment a profiler records a stack-trace sample together with the time it was captured
  4. D.A timestamped annotation that is added to a span to mark one meaningful, singular point in time during that span

Correct answer: B

The Metrics concepts page defines a metric as a measurement of a service captured at runtime and says: "The moment of capturing a measurement is known as a metric event, which consists not only of the measurement itself, but also the time at which it was captured and associated metadata." Why the other options are wrong. "A sampled measurement that carries the trace ID an…": that describes an exemplar, which the metrics data model defines as a recorded value that associates OpenTelemetry context (optionally trace_id and span_id) with a metric event; it is not the metric event itself. "The moment a profiler records a stack-trace sample…": the Profiles page calls the moment of capturing a profiling sample a "sample event"; that is profiling terminology, not the metrics term. "A timestamped annotation that is added to a span t…": that is a span event, described on the Traces page as a structured log message or annotation on a span denoting a meaningful, singular point in time.

Sources: OpenTelemetry docs: Metrics, OpenTelemetry spec: Metrics data model (Exemplars)

Practice this topic

Focus mode keeps every question on Telemetry Data: Signals, Resources and Log Shapes until you leave it. 10 free guest answers, then a free account; no credit card.

Or open OTCA practice across all topics.

Sources

The explanation above was checked against these official documents.

Frequently asked questions

Is baggage automatically added to my spans?

No. Baggage is propagated alongside context but stays separate from span, metric and log attributes. You must read it and add it as attributes, or use a Baggage Span Processor where your language provides one.

Are JSON logs always structured logs?

No. The OpenTelemetry Logs page says a log is structured when it has a stable schema. JSON whose field names and types change between messages is classed as semistructured.