Glossary

100 terms, plain English.

The vocabulary of observability, search, security data, and vector infrastructure — defined by engineers who’ve shipped the systems, not by a marketing team.

No matching terms. Try a different keyword.

40 terms

Observability

Observability: The ability to answer new questions about a running system from the data it emits, without shipping new code.
Logs: Immutable, timestamped records of discrete events emitted by a service.
Metrics: Numeric measurements sampled over time, stored in a time-series database and identified by name plus labels.
Traces: End-to-end records of a single request as it flows across services, made up of parent/child spans.
Span: One unit of work inside a trace, with a start time, duration, attributes, and a parent.
OpenTelemetry (OTel): A vendor-neutral CNCF specification and set of SDKs/collectors for producing and shipping logs, metrics, and traces.
OTLP: OpenTelemetry Protocol — the wire format services and collectors use to exchange telemetry.
OTel Collector: A pipeline binary that receives, processes (batch, filter, redact), and exports telemetry to one or more backends.
Prometheus: A CNCF pull-based time-series database and monitoring system that scrapes metrics from HTTP endpoints.
PromQL: The query language used to select, aggregate, and alert on Prometheus time series.
Grafana: An open-source dashboarding and alerting front end that queries many backends (Prometheus, Loki, Tempo, Elasticsearch, more).
Loki: Grafana’s log aggregation system, indexed by labels rather than by full-text tokens.
Tempo: Grafana’s high-scale distributed-tracing backend, storing traces in object storage.
Mimir: Grafana’s horizontally scalable, long-term Prometheus-compatible metrics backend.
Elastic Observability: Elastic’s unified logs / metrics / APM / synthetics offering built on the Elasticsearch engine.
APM: Application Performance Monitoring — instrumentation that captures per-request latency, throughput, and errors, typically with distributed traces.
Datadog: A commercial SaaS observability platform covering metrics, logs, APM, RUM, and security signals.
Dynatrace: A commercial observability platform known for its OneAgent, automatic topology mapping, and AI-driven root-cause analysis (Davis).
New Relic: A commercial observability platform with a unified telemetry data platform (NRDB) and usage-based pricing.
Honeycomb: An observability tool built around wide, high-cardinality events and interactive exploration of production traces.
Cribl: An observability and security data pipeline (Cribl Stream) that routes, reduces, enriches, and replays data before it reaches its destination.
SLO: Service Level Objective — a target for a specific reliability metric (e.g. 99.9% success over 30 days).
SLI: Service Level Indicator — the actual measured signal (e.g. good requests / total requests) that an SLO evaluates against.
Error budget: The permitted amount of unreliability inside an SLO window; a lever for balancing feature velocity vs. reliability work.
MTTR / MTTD: Mean Time To Recover / Detect — how long incidents last and how quickly they are noticed.
Golden signals: Latency, traffic, errors, and saturation — Google SRE’s four baseline signals for a user-facing service.
RED method: Rate, Errors, Duration — a request-centric monitoring pattern used across microservices.
USE method: Utilization, Saturation, Errors — a resource-centric pattern used to diagnose infrastructure bottlenecks.
Cardinality: The number of unique label-value combinations for a metric; the dominant driver of TSDB cost.
High-cardinality data: Telemetry with many unique dimensions (user IDs, request IDs) — cheap to store as logs/traces, expensive as metrics.
Sampling (traces): Recording only a subset of traces to control cost; done head-based (at ingress) or tail-based (after the trace completes).
eBPF: A Linux kernel technology that runs sandboxed programs to collect telemetry (system calls, network, syscalls) with near-zero overhead.
Continuous profiling: Always-on CPU / memory profiling in production, giving code-level flame graphs alongside metrics and traces.
RUM: Real User Monitoring — telemetry collected from real browsers / mobile apps in the field.
Synthetics: Scripted checks that hit endpoints from known locations to measure availability and performance.
Alertmanager: The Prometheus component that deduplicates, groups, silences, and routes alerts to sending receivers (PagerDuty, Slack, email).
Runbook: A written procedure an on-call engineer follows to diagnose and mitigate a known alert.
Blast radius: The scope of impact of a change or failure; minimizing blast radius is a core reliability pattern.
Chaos engineering: The practice of deliberately injecting faults into production-like systems to verify resilience.
Ingest pipeline: A processor chain (parse, enrich, drop) applied to events between the source and the storage backend.

25 terms

Search & retrieval

Elasticsearch: A distributed, Lucene-based search and analytics engine used for full-text search, logs, and vector retrieval.
OpenSearch: An Apache 2.0-licensed fork of Elasticsearch and Kibana, maintained by the OpenSearch community.
Kibana: The default visualization and management UI for Elasticsearch.
OpenSearch Dashboards: The OpenSearch equivalent of Kibana.
Lucene: The Java library that provides the underlying inverted-index engine for Elasticsearch, OpenSearch, and Solr.
Algolia: A hosted search-as-a-service focused on instant, typo-tolerant, front-end search for e-commerce and SaaS.
Inverted index: A data structure mapping each term to the list of documents that contain it — the core of classical search engines.
BM25: The default relevance-scoring function in Lucene-based engines, a probabilistic term-frequency model.
TF-IDF: Term Frequency–Inverse Document Frequency, an older weighting scheme that BM25 largely replaced.
Analyzer: The pipeline that turns raw text into indexable tokens (tokenizer + character/token filters like lowercase, stemming, stopwords).
Tokenizer: The stage of an analyzer that splits text into terms (whitespace, standard, edge_ngram, kuromoji, etc.).
Mapping (Elastic): The schema definition for a field’s type, analyzer, and indexing options.
Shard: A single Lucene index; an Elasticsearch/OpenSearch index is composed of one or more primary shards plus replicas.
Replica: A copy of a shard used for high availability and read scaling.
Refresh interval: How often newly indexed documents are made searchable; higher values reduce indexing overhead.
ILM: Index Lifecycle Management — automated rollover, shrink, freeze, and delete of time-series indices.
Frozen tier: An Elastic storage tier where indices are queried directly from object storage at low cost.
Data stream: An Elastic abstraction for append-only, time-series data backed by a rolling set of indices.
Aggregations: Elasticsearch’s server-side analytics primitives (bucketing, metrics, pipeline) — used heavily in Kibana.
Relevance tuning: The engineering discipline of designing analyzers, boosts, function scores, and rerankers to improve search quality.
NDCG: Normalized Discounted Cumulative Gain — a standard offline metric for ranked-search quality.
Learning to rank: Training an ML model to reorder search results based on features and judged relevance labels.
Autocomplete: Type-ahead suggestions, typically powered by edge_ngram, completion suggesters, or dedicated services (Algolia).
Faceted search: Filters presented alongside results (category, price, brand) that let users refine a query interactively.
ClickHouse: A columnar OLAP database used for search-adjacent analytics, log warehousing, and real-time dashboards at massive scale.

25 terms

Security data & SecOps

SIEM: Security Information and Event Management — centralised collection, correlation, and alerting on security-relevant events.
SOAR: Security Orchestration, Automation, and Response — playbook-driven automation over SIEM detections.
XDR: Extended Detection and Response — a SIEM-adjacent category that correlates endpoint, network, identity, and cloud telemetry.
EDR: Endpoint Detection and Response — telemetry and containment on user endpoints and servers (CrowdStrike, SentinelOne).
MITRE ATT&CK: A public knowledge base of adversary tactics, techniques, and procedures used to structure detections and reporting.
Detection engineering: Treating detection content (rules, queries, hunts) as versioned code with tests, reviews, and change management.
Splunk: A leading SIEM and machine-data platform with SPL, indexers, search heads, and Enterprise Security.
SPL: Splunk’s Search Processing Language, used to query and transform events in Splunk.
Elastic Security: Elastic’s SIEM/XDR offering built on the Elasticsearch engine, with Fleet, Endpoint Security, and prebuilt ATT&CK detections.
CrowdStrike Falcon: A leading cloud-native EDR/XDR platform with agent-based telemetry and cloud-side detections.
Data lake (security): Long-retention, low-cost storage for security telemetry, typically object storage plus a query engine.
Detection as code: Storing SIEM rules in git with CI/CD, unit tests, and code review.
IOC: Indicator of Compromise — an atomic artefact (hash, IP, domain) associated with malicious activity.
TTP: Tactics, Techniques, and Procedures — behavioural patterns of adversaries as classified by MITRE ATT&CK.
Threat hunting: Proactive, hypothesis-driven search through telemetry for adversary behaviour that automated detections would miss.
UEBA: User and Entity Behaviour Analytics — anomaly detection over user/host baselines.
Log reduction: Filtering, sampling, or summarising events before indexing to control SIEM cost without losing detection value.
Data routing: Sending each event to the destination that fits it (SIEM, data lake, cheap archive) — the core Cribl use case.
Replay (Cribl): Re-sending archived data back into a SIEM or analytics tool on demand — e.g. during an investigation.
CIM / ECS: Common Information Model (Splunk) and Elastic Common Schema — normalised field names for cross-source correlation.
Sigma rule: A vendor-neutral YAML format for detection rules, convertable to SPL, KQL, EQL, and others.
EQL: Event Query Language — Elastic’s sequence-oriented query language for correlated detections.
KQL (Kibana): Kibana Query Language — the interactive filter syntax in Kibana / Elastic Security.
SOC: Security Operations Center — the team (and often the room) that watches SIEM alerts and drives incident response.
Playbook: A documented response procedure for a specific alert or incident type; often automated in SOAR.

10 terms

Vector & AI infrastructure

Embedding: A fixed-length numeric vector produced by a model that represents the semantic content of text, image, or code.
Vector database: A store optimised for approximate-nearest-neighbour (ANN) search over embeddings (Qdrant, Pinecone, Weaviate, Milvus).
ANN: Approximate Nearest Neighbour — sub-linear algorithms (HNSW, IVF, PQ) that trade a little recall for large speed gains.
HNSW: Hierarchical Navigable Small World — the most widely used ANN index, with tunable recall/latency trade-offs.
Hybrid search: Combining lexical (BM25) and vector (ANN) retrieval, often with a reranker on top, for both precision and semantic recall.
RAG: Retrieval-Augmented Generation — feeding retrieved documents into an LLM prompt to ground its answers.
Reranker: A second-stage model (typically a cross-encoder) that reorders the top-k results from a first-stage retriever.
pgvector: A PostgreSQL extension that adds a vector column type and ANN indexes — the simplest path to vector search inside an existing DB.
Qdrant: An open-source vector database written in Rust, with payload filtering, gRPC/REST APIs, and managed cloud.
LangChain: An orchestration library for LLM applications — retrievers, chains, agents, and vector-store integrations.

Missing a term you’d want defined?

Suggest one