chapter six

6 Marking up and enriching telemetry

 

This chapter covers

  • The difference between markup and enrichment
  • Where markup and enrichment happen
  • How each telemetry style handles markup and enrichment
Figure 6.1 Telemetry Pipeline Stages. Telemetry markup happens during the Emitting and Shipping stages, where telemetry enrichment happens during the Shipping and Presentation stages. Markup and enrichment happen in all pipeline stages, which is the focus of this chapter.

Much of the power of a telemetry pipeline derives from the transformation of telemetry between when the Emitting Stage receives it from the production systems and when telemetry is displayed to a human by the Presentation Stage. Each of the three stages of the telemetry pipeline — Emitting (chapter 2), Shipping (chapters 3 and 4), and Presentation (chapter 5) — has the opportunity to enhance telemetry. The two biggest forms of added value are:

6.1       Markup in the Emitting Stage

6.2       Markup and enrichment in the Shipping Stage

6.2.1   Applying context-related telemetry in the Shipping Stage

6.2.2   Extracting and enriching telemetry in-flight

6.2.3   Converting field types during the Shipping Stage

6.3       Enrichment in the Presentation Stage

6.4       How telemetry style affects markup and enrichment

6.4.1   Markup and enrichment with centralized logging

6.4.2   Markup and enrichment with SIEM systems

6.4.3   Markup and enrichment with metrics

6.4.4   Markup and enrichment with distributed tracing systems

6.5       Summary