--- # Observability Ontology # # Domain pack for observability-platform research. Types form an explicit IS-A tree # (subtype_of) rooted in the inherited generic/engineering supertypes, so the hierarchy # is generic -> intermediate -> leaf, e.g.: # # technology (mif-generic) -> observability-resource -> observability-service # technology (mif-generic) -> observability-resource -> service-ownership-registry # concept (mif-generic) -> observability-assessment -> capability-comparison # concept (mif-generic) -> observability-assessment -> market-position # concept (mif-generic) -> observability-assessment -> roadmap-signal # delivery-metric (engineering-base) -> telemetry-signal # design-pattern (engineering-base) -> migration-pattern # # Extends BOTH engineering-base (component, delivery-metric, design-pattern, …) and # mif-generic (technology, concept, organization) so every subtype_of / relationship # endpoint resolves through the extends chain at concordance time. # # Version: 0.1.0 # Last Updated: 2026-06-26 ontology: id: observability version: "0.4.0" description: "Observability-platform domain ontology — services, telemetry signals, capability comparisons, service-ownership registries, migration patterns, market positioning, and roadmap signals, organized as an IS-A tree rooted in generic types" schema_url: >- https://mif-spec.dev/schema/ontology/ontology.schema.json extends: - engineering-base - mif-generic # Namespace Hierarchy (Cognitive Triad) namespaces: _semantic: description: "Facts, concepts, comparisons" type_hint: semantic children: services: description: "Observability services and the signals/registries they provide" type_hint: semantic analysis: description: "Capability comparisons and market positioning" type_hint: semantic _episodic: description: "Time-stamped product and roadmap signals" type_hint: episodic children: roadmap: description: "GA dates, launches, deprecations, predictions" type_hint: episodic _procedural: description: "Migration approaches and patterns" type_hint: procedural children: migrations: description: "Datadog-to-AWS-native migration patterns and case studies" type_hint: procedural # Entity Types — abstract intermediate supertypes first, then concrete leaves. entity_types: # ----- Abstract intermediate supertypes (the "x" layer; not stamped on findings) ----- - name: observability-resource description: "Abstract supertype: a deployable observability capability/system (specializes the generic technology)" base: semantic abstract: true subtype_of: - technology schema: required: - name properties: name: type: string - name: observability-assessment description: "Abstract supertype: an analytical judgment about observability (specializes the generic concept)" base: semantic abstract: true subtype_of: - concept schema: required: - name properties: name: type: string # ----- Concrete leaf types ----- - name: observability-service description: "An observability service or product (CloudWatch, X-Ray, ADOT, Amazon Managed Prometheus/Grafana, Datadog) and the pillars it serves" negative_examples: - "This decision record explains why the organization is standardizing on a single vendor-neutral instrumentation or log-backend choice, citing cost-of-query-pattern or vendor-lock-in rationale, and names the migration cost accepted as a consequence of the switch." - "A narrowly-scoped piece of a larger observability stack that performs exactly one function relative to a neighboring piece, for example converting Kubernetes object state into metrics without reporting live resource usage itself, or only deduplicating and routing alerts that another process already evaluated." - "Amazon Managed Grafana and Grafana Cloud run the same open-source Grafana engine, but Grafana Cloud bundles managed Loki, Tempo, and Mimir while Amazon Managed Grafana is visualization-only." - "Prometheus Remote Write 2.0 adds native exemplar and histogram support, while a competing APM auto-instrumentation capability announced at re:Invent in late 2023 reached GA after seven months in preview." - "Prometheus Remote Write is the shared protocol underlying every managed-Prometheus-compatible offering, while PromQL remains the de facto standard query language for time series regardless of backend." - "Elastic was named a Leader in Gartner's 2025 Magic Quadrant for Observability Platforms for a second straight year, rooted in Elasticsearch and Kibana's search-and-log-analytics origins rather than a metrics-first design." - "Because Amazon Managed Service for Prometheus speaks standard remote_write and PromQL, migrating off self-hosted Prometheus federation or Thanos/Cortex requires only repointing remote_write and adding IAM SigV4 signing." - "The CNCF, under the Linux Foundation, hosts graduated projects Prometheus, Jaeger, Fluentd, and Fluent Bit alongside still-incubating OpenTelemetry, and its annual survey is a widely cited adoption data source." - "Vizceral is a WebGL-based traffic-visualization tool Netflix open-sourced in 2016, rendering live request volume as an animated node-and-edge graph for what Netflix called 'intuition engineering.'" - "The RED method, proposed by Tom Wilkie at Weaveworks, instruments services with Rate, Errors, and Duration metrics as a request-driven complement to the host-centric USE method." base: semantic subtype_of: - observability-resource schema: required: - name - provider - pillars properties: name: type: string provider: type: string description: "Vendor/platform that ships the service" enum: - aws - datadog - grafana - other pillars: type: array description: "Observability pillars the service serves" items: type: string enum: - metrics - logs - traces - apm - rum - synthetics - dashboards - profiling - aiops maturity: type: string enum: - ga - preview - maintenance - end-of-support aws_service_name: type: string description: "Canonical AWS service name when provider is aws" - name: service-ownership-registry description: "A service catalog, resource registry, service map, or internal developer portal that tracks service ownership/topology" aliases: - "service catalog" - "ownership registry" - "application registry" - "developer portal catalog" exemplars: - "A telemetry-driven service catalog auto-populates ownership metadata from live tracing data rather than requiring manual registration" - "A cloud provider's application-registry capability evolved from an API-first tool toward a console-first, more discoverable successor" - "No single native service replaces a telemetry-driven service catalog; a composite of several separate registries is required instead" negative_examples: - "Distributed trace context propagation across service boundaries maintains correlation identity through W3C standard headers and message metadata." base: semantic subtype_of: - observability-resource schema: required: - name - registry_kind properties: name: type: string registry_kind: type: string enum: - telemetry-catalog - resource-registry - service-map - idp provider: type: string features: type: array items: type: string - name: telemetry-signal description: "A class of telemetry data (a signal/pillar) produced and consumed across observability services" negative_examples: - "A correlation ID propagation technique embedded in service calls to track a request across multiple services and correlate logged events to a single logical transaction." - "One governance rule assigns sensitivity tiers to telemetry carrying customer PII, such as session replays, enforced automatically at ingestion, while a companion rule requires security and legal sign-off before onboarding new observability vendor destinations." - "An eBPF-based, zero-instrumentation monitoring agent was adopted to give every service an immediate baseline visibility floor, explicitly scoped as a stopgap ahead of manual OpenTelemetry instrumentation as the eventual end state." - "The OpenTelemetry Collector is a standalone binary between instrumented apps and observability backends, accepting OTLP, Prometheus remote_write, Jaeger, and Zipkin, so switching backends becomes an exporter config change." - "A control enforces that observability data is retained for a maximum of 90 days before purging, implemented as a data-retention policy applied to all metric backends to balance storage costs against the need to investigate historical incidents." - "A telemetry onboarding checklist discipline lists the required steps when adding a new metric or trace to the observability infrastructure, including name/unit definition, dashboard link, alert thresholds, and retention policies." - "Alert fatigue, studied in clinical alarm-fatigue research before adaptation to on-call practice, relates to Charity Majors's argument that the 'three pillars' metrics/logs/traces model is itself a tooling-problem symptom, not a foundational unit." - "The OpenTelemetry Semantic Conventions document specifies standard attribute names, such as an HTTP request's status code or a Kubernetes pod's namespace, so differently-authored instrumentation lands under consistent field names." - "Migrating from a proprietary APM agent to OpenTelemetry is de-risked via incremental, service-by-service rollout, since mismatched trace-context propagation between migrated and unmigrated services can fragment a request into two disconnected traces." - "The OpenTelemetry Protocol (OTLP) efficiently encodes and transmits metrics, logs, and trace data to backend systems with built-in compression and automatic retry." base: semantic subtype_of: - delivery-metric schema: required: - metric_name - signal_type properties: metric_name: type: string description: "Renamed from name to match engineering-base.ontology.yaml's delivery-metric field name directly" signal_type: type: string enum: - metric - log - trace - rum - synthetic - profile - event producers: type: array items: type: string backends: type: array items: type: string - name: capability-comparison description: "A capability or gap comparison between an observability subject and a baseline (e.g. AWS-native vs Datadog for a pillar)" aliases: - "feature comparison" - "capability gap analysis" - "vendor capability comparison" - "platform comparison" exemplars: - "A commercial observability platform has no official plugin for a given developer portal, requiring a proxy-based integration workaround instead" - "An incumbent monitoring vendor retains capability leads in integrated security and multi-cloud breadth that a challenger has not yet matched" negative_examples: - "This decision favors a single vendor's unified observability platform over best-of-breed, valuing one-UI pivoting from a trace span to correlated logs and RUM sessions, while still requiring OpenTelemetry instrumentation over a proprietary SDK." - "A canary analysis pattern detects when a percentage of production traffic is automatically rolled back to the previous version if post-deployment metrics diverge beyond configured thresholds, eliminating manual approval delays for low-risk changes." - "An incident severity classification discipline defines distinct severity levels (critical, high, medium, low) based on impact (number of users affected, revenue impact, data loss risk) and provides decision rules for which level different types of issues map to." - "A parallel-run cutover strategy shadows all production telemetry through both monitoring systems simultaneously before switching primary collection, minimizing data loss." base: semantic subtype_of: - observability-assessment schema: required: - name - subject - baseline - parity properties: name: type: string subject: type: string description: "The capability under evaluation (e.g. AWS-native APM)" baseline: type: string description: "The comparator it is measured against (e.g. Datadog APM)" parity: type: string enum: - parity - partial - gap - superior gaps: type: array items: type: string - name: market-position description: "A vendor's positioning in the observability market per an analyst or market source" aliases: - "competitive market position" - "market standing" - "vendor market share" - "analyst market ranking" exemplars: - "An analyst firm's quadrant places an incumbent vendor as a market leader and a cloud-native challenger a tier below" - "A discipline has reached near-universal enterprise adoption within a few years, according to an annual research report" negative_examples: - "Gartner's 2025 Magic Quadrant for Observability Platforms is a published report, released July 2025, that evaluates approximately 20 vendors against defined Ability to Execute and Completeness of Vision criteria." - "Gartner is the analyst firm that publishes the annual Magic Quadrant for Observability Platforms, applying a consistent published evaluation methodology across roughly 20 vendors each report cycle." base: semantic subtype_of: - observability-assessment schema: required: - name - vendor properties: name: type: string vendor: type: string source: type: string description: "The market/analyst source (e.g. Gartner Magic Quadrant 2025)" placement: type: string enum: - leader - challenger - visionary - niche - unranked - name: roadmap-signal description: "A time-stamped product or roadmap signal: a GA date, launch, deprecation/maintenance move, or near-term prediction" aliases: - "product roadmap signal" - "vendor trajectory signal" - "future-direction signal" - "platform roadmap indicator" exemplars: - "A community-governed open-source project's roadmap points toward AI-native tooling as the next integration direction" - "Vendor-announced launches over the past year or two indicate which competing platform capabilities are likely to close within that window" - "A generative-AI incident-investigation feature reaching general availability signals a broader shift toward AI-driven root-cause analysis" negative_examples: - "Cardinality growth rate measures the number of distinct values in a time-series metric over time; a rapid growth in cardinality can indicate unbounded tag explosion in an instrumentation library, increasing storage and query costs." - "An SLO review cadence discipline schedules quarterly reviews where teams revisit their service-level objectives, adjusting targets based on actual performance trends and changing business priorities." - "Splunk, acquired by Cisco in 2024, was named a Leader in Gartner's 2025 Magic Quadrant for Observability Platforms for a third consecutive year, its trace/metrics capability rooted in the 2021 SignalFx acquisition." - "Continuous profiling samples a running process's stack traces to build always-on flame graphs, and OpenTelemetry has adopted it as a fourth core signal, entering public alpha with a pprof-compatible data model." base: episodic subtype_of: - observability-assessment schema: required: - name - signal_kind properties: name: type: string signal_kind: type: string enum: - ga - preview - launch - maintenance - end-of-support - prediction date: type: string description: "Signal date (ISO date or month/quarter as published)" capability_area: type: string description: "The pillar/capability the signal advances" - name: migration-pattern description: "An approach, case study, or community pattern for migrating between observability platforms" aliases: - "platform migration pattern" - "cloud migration pattern" - "vendor migration playbook" - "transition pattern" exemplars: - "A phased rollout plan for a new internal platform begins with a small pilot before scaling to organization-wide adoption waves" - "Documented real-world migrations from one observability vendor to another report meaningful cost reduction alongside a multi-month timeline" - "Automated migration tooling is reducing a historically months-long platform migration down to a matter of weeks" negative_examples: - "Treating dashboard definitions as version-controlled, PR-reviewed source code has become standard practice, alongside chaos engineering framed as observability validation itself: an injected failure surfacing on no dashboard is a first-class monitoring-gap finding." base: procedural subtype_of: - design-pattern schema: required: - pattern_name - from_platform - to_platform - context - solution properties: pattern_name: type: string description: "Renamed from name to match engineering-base.ontology.yaml's design-pattern field name directly" from_platform: type: string to_platform: type: string context: type: string description: "Inherited from design-pattern: when to use this migration pattern (genuinely new field, no prior equivalent existed on migration-pattern)" solution: type: string description: "Renamed from approach to match engineering-base.ontology.yaml's design-pattern field name directly (how the pattern accomplishes the migration)" evidence_type: type: string enum: - case-study - community-pattern - vendor-report - reference-architecture # Traits (reusable mixins) — available for future enrichment. traits: sourced: description: "Adds a primary-source reference" fields: source_url: type: string format: uri source_title: type: string # Relationships — observability edges beyond the subtype_of IS-A tree. Endpoints naming # inherited supertypes (technology, component) resolve via the extends chain. relationships: emits: description: "A service produces a telemetry signal" from: - observability-service to: - telemetry-signal symmetric: false compares: description: "A comparison evaluates a service/technology against a baseline" from: - capability-comparison to: - observability-service - technology symmetric: false positions: description: "A market position situates a vendor/technology" from: - market-position to: - technology symmetric: false advances: description: "A roadmap signal advances a service's capability" from: - roadmap-signal to: - observability-service symmetric: false catalogs: description: "A registry catalogs services/components" from: - service-ownership-registry to: - observability-service - component symmetric: false # Discovery Patterns discovery: enabled: true confidence_threshold: 0.8 patterns: - content_pattern: "\\b(CloudWatch|X-Ray|ADOT|OpenTelemetry|Managed Prometheus|Managed Grafana|Application Signals)\\b" suggest_entity: observability-service suggest_namespace: _semantic/services - content_pattern: "\\b(service catalog|service ownership|AppRegistry|myApplications|developer portal|IDP|service map)\\b" suggest_entity: service-ownership-registry suggest_namespace: _semantic/services - content_pattern: "\\b(parity|capability gap|pillar-by-pillar|vs\\.?\\s+Datadog)\\b" suggest_entity: capability-comparison suggest_namespace: _semantic/analysis - content_pattern: "\\b(migration|migrate)\\b.*\\b(case study|pattern|Datadog)\\b" suggest_entity: migration-pattern suggest_namespace: _procedural/migrations - content_pattern: "\\b(Gartner|Magic Quadrant|market (leader|position)|challenger)\\b" suggest_entity: market-position suggest_namespace: _semantic/analysis - content_pattern: "\\b(GA|generally available|re:Invent|end-of-support|maintenance mode|roadmap)\\b" suggest_entity: roadmap-signal suggest_namespace: _episodic/roadmap