Glossary · Monitoring

Log Aggregation

Log aggregation collects logs from many servers and services into one central, searchable store so they can be queried and correlated in one place.

Updated October 6, 2026

Log aggregation, or centralized logging, is the practice of shipping log data from every host, container and application to a shared system. An agent or forwarder on each machine reads log files or streams, optionally parses and enriches them, and sends them to a store with search and retention features.

Why it matters

With dozens of servers or short-lived containers, logging in to each machine is impractical, and logs are lost when a container is deleted or a server dies. Central storage allows one query to follow a request through several services, supports alerts on log patterns and provides evidence for audits and postmortems. Access can also be controlled in one place.

Example

A simple pipeline:

app -> JSON log lines -> forwarder (Fluent Bit/Filebeat/Vector)
    -> storage and search (Loki/Elasticsearch/other)
    -> query: level=error AND service=checkout AND request_id=a91f3c

Adding service, environment and request_id fields makes the logs useful across systems.

Common mistakes

  • Logging unstructured text that is hard to parse.
  • Keeping everything forever. Set retention by value and legal requirements.
  • Sending sensitive data to a third-party service without checking policy.
  • Not alerting when log shipping itself stops.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · MonitoringAPM (Application Performance Monitoring)APM tools instrument application code to measure response times, errors and dependencies so teams can find slow transactions and failing code paths.Glossary · MonitoringBlack-Box MonitoringBlack-box monitoring tests a system from the outside, the way a user would, to detect symptoms like errors and slowness without inspecting internals.Glossary · MonitoringBulkhead PatternThe bulkhead pattern isolates resources into separate pools so a failure or overload in one part of a system cannot exhaust capacity for the rest.Guide · MonitoringAlert Fatigue and On-Call Basics for Small TeamsSet severity levels, escalation paths, alert thresholds and runbooks so a small team gets paged for real problems only and still sleeps through the night.8 min readGuide · MonitoringCron Job Heartbeat Monitoring to Catch Silent Failures EarlyLearn how heartbeat monitoring catches silent cron failures, with copy-ready examples for crontab, systemd, GitHub Actions, Docker, WP-Cron, Laravel and more.9 min readGuide · MonitoringHow Often Should You Monitor a Website? Choosing Check IntervalsPick the right uptime check interval for each part of your site. See how interval, retries and alert delay combine into real detection time, and what to avoid.8 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.