On this page

Insights catalog

This is the full list of findings Insights can raise about your telemetry. Each finding has a severity that tells you how much it hurts: Critical findings expose data or break service identification, while lower severities cost you money, noise, or debugging time. Severity also sets how much a finding weighs on your Instrumentation Score.

Detailed pages for each finding are on the way. Until then, use the summaries below.

Critical

Finding	Signal	What it means
Missing Service Name	Resource	Telemetry arrives without `service.name`, so it can’t be grouped, searched, or alerted on per service.
Suspicious PII Leakage in Resource Attributes	Resource	Resource attributes look like they contain personal data or credentials, repeated on every signal the service emits.
Suspicious PII Leakage in Spans	Traces	Span attributes, events, or URL query parameters look like they contain personal data or credentials.
Suspicious PII Leakage in Logs	Logs	Log bodies or attributes look like they contain personal data or credentials.
Log Storm	Logs	A service repeats the same message fast enough to inflate costs and drown out useful logs.

Important

Finding	Signal	What it means
High-Cardinality Metric Attribute	Metrics	A metric label carries unbounded values like user IDs or URLs, creating a new time series for each one.
High Cardinality Span Name	Traces	Span names contain IDs or full queries, so every operation looks unique and can’t be grouped.
Stale Debug Log in Production	Logs	Debug logging was turned on and forgotten: the service has been shipping development detail to production for weeks, paying for logs nobody reads.
Client Root Span	Traces	Traces start at a client span, which usually means the server side is not instrumented or trace context is lost.
Semantic Convention Attribute Level	Resource, Traces, Logs	Attributes that describe the service (like `service.name` or `host.name`) are attached to every span, metric, or log instead of once at the resource level, repeating the same values millions of times and bloating volume.
Excessive Low-Severity Log Ratio	Logs	Low-severity logs (INFO and below) make up so much volume that warnings and errors get drowned out.

Normal

Finding	Signal	What it means
Noisy Service (Internal Spans)	Traces	Traces are stuffed with trivial internal spans that hide the critical path.
Orphaned Spans	Traces	Spans reference a parent that never arrived, a sign of broken context propagation.
Excessive Short-Duration Spans	Traces	Large volumes of sub-millisecond spans cost more to collect than they tell you.
Missing Service Instance ID	Resource	Without `service.instance.id`, you can’t tell one instance of a service from another.
Static Asset Tracing	Traces	Your server creates a trace every time a browser downloads a static file (script, stylesheet, image, font). These downloads rarely fail or need debugging, so the traces only add volume and cost.
Verbose Log Ratio	Logs	Most of the service’s log volume is DEBUG or TRACE detail meant for development. In production it buries the warnings and errors you actually need and inflates storage cost. Escalates to Important at very high ratios.
Excessive Metric Datapoint Rate	Metrics	Metric series send more than four datapoints per minute, an unusually high cadence that drives cost.

Low

Finding	Signal	What it means
Missing Log Severity	Logs	Logs have no severity level, so filtering and alerting on them doesn’t work.
Unrecommended Resource Attribute	Metrics	The telemetry carries resource attributes with no observability value (like host MAC addresses or OS descriptions): data nobody queries but everybody pays to ingest and store.