A customer reports an error at 14:32 yesterday. What must have been built for the investigation to take two minutes rather than two hours?

What is being tested

Recognition of the cheapest high-value observability mechanism, and the specific detail that makes it work for support.

Why the correlation ID

Without it, investigating means correlating nine services' logs by timestamp. At any real volume many requests share a millisecond, so you are filtering thousands of unrelated lines and guessing which belong together. This is unreliable and slow, and under load it is impossible.

With it, one query returns everything that happened for that one request across the entire estate.

The detail most implementations miss

Return the ID to the user and show it in error messages. "Something went wrong. Reference: 7f3a-91c2."

Without that, support asks the customer what time it was, in what timezone, and then filters by approximate timestamp and email address. With it, support pastes the reference and the exact request appears.

This single detail converts a two-hour investigation into a two-minute one, and it costs almost nothing to implement.

The other implementation details

• Generate at the true edge — load balancer or gateway — and accept a client-supplied one only from trusted callers, so a mobile session can be traced end to end without letting untrusted callers poison your identifier space.
• Propagate across asynchronous boundaries. The ID must travel in the message envelope onto the queue, into the batch job, into the retry an hour later. A trail that stops at the queue omits the part you most need.
• Never regenerate at an internal hop, which splits one request into two unrelated traces.
• Carry more than one identifier — a trace ID for the request and a session or causation ID linking a chain of related operations. Different investigations need different scopes.
• Include it in third-party calls where the API permits, so the provider's support can find your request in their systems.
• Do not use personal data as the identifier. An email address as a correlation ID puts personal data into every log line in the estate.

Why the other options are weaker

Longer retention helps only if you can find the right lines, which is the actual problem. More detailed logging makes the haystack larger. An error dashboard shows that errors occurred, not which one was this customer's.