Mastering the ELK Stack

Checking logs via SSH or text files is impossible with 100 containers. You need a Centralized Logging Engine that indexes every line for instant search.

1. The Stack Components

• Elasticsearch: The search engine where logs are stored. It's incredibly fast at 'Full-Text Search'.
• Logstash / Fluent Bit: The 'Collector'. It gathers logs from your containers, parses them into JSON, and sends them to Elasticsearch.
• Kibana: The UI. This is where you write queries like `level: "Error" AND service: "order-service"` to find bugs in seconds.

2. Structured Logging with Serilog

Don't just log text. Log **Structured Data**. - **Bad:** `Log.Information("User " + userId + " logged in");` - **Good:** `Log.Information("User {UserId} logged in", userId);` In Elasticsearch, `UserId` becomes a searchable field. You can then instantly see: 'Show me every error that happened to User 123 across the whole system over the last 7 days.'

4. Interview Mastery

Q: "How do you prevent logging from slowing down your application performance?"

Architect Answer: "**Asynchronous Sinks**. We use Serilog with an Async Sink so that the main thread doesn't wait for the log to be written to the network or disk. We also use **Sampling** for high-volume logs (info/debug) and 'Conditional Logging' to ensure that we only log high-detail data when an error actually occurs."