How do I rebuild a trace from logs?

Short answer: Collect logs around one failing request, group by request or trace ID, then order the events by timestamp to find the first error and downstream failures.

Steps

1. Paste the logs that surround one failing request or incident window.
2. Group lines by trace ID, request ID, correlation ID, or service name.
3. Sort the events by timestamp and mark the first error or warning.
4. Separate the initiating failure from retries, timeouts, and downstream symptoms.

Related tools