Notifications
Clear all
Topic starter
19/08/2026 3:54 pm
TL;DR: Facet-based search shifts observability from raw-text scanning to indexed field lookups, which can materially reduce query time and compute cost at petabyte scale, according to Edge Delta. The governance question is not whether facets help, but how teams structure telemetry early enough to keep search usable as data volumes and enrichment grow.
NHIMG editorial — based on content published by Edge Delta: Facets in Observability Search for Faster Querying
Questions worth separating out
Q: How should security teams structure telemetry so searches stay fast at scale?
A: Teams should extract and normalise the fields they query most often before data is indexed.
Q: Why do unstructured logs slow down incident response?
A: Unstructured logs force queries to scan more data because the system cannot jump directly to the fields analysts need.
Q: What breaks when telemetry fields are inconsistent across sources?
A: Search becomes fragmented when equivalent fields are named differently or contain mismatched formats.
Practitioner guidance
- Define high-value facet fields Identify the fields analysts repeatedly use during triage, such as service, region, status code, source IP, and workload identifiers, then promote those fields to indexed facets in the ingest path.
- Normalise field names across pipelines Create a shared schema for telemetry sources so equivalent attributes use the same field names, reducing fragmentation between cloud, application, and security logs.
- Use pipeline parsing before indexing Apply pre-built packs or custom OTTL statements before data reaches the observability store, because post-index restructuring is slower and often incomplete.
What's in the full article
Edge Delta's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step facet creation examples using pipeline packs for structured log parsing.
- Custom OTTL field extraction details for building a facet from a single attribute.
- Interface walkthroughs showing how custom facet filters appear in the observability platform.
- Examples of using facets against AWS, Docker, and Kubernetes log sources.
👉 Read Edge Delta's facet search blog for pipeline and query examples →
Facets in observability search: what it means for security teams?
Explore further
19/08/2026 4:31 pm
Facet design is a telemetry governance problem, not just a search feature. The article shows that downstream query performance depends on whether teams structure data at ingest time. That is a familiar control pattern in security operations: if metadata is inconsistent, analysts pay the cost later in slower investigations and noisier triage. For identity-adjacent telemetry such as authentication failures, service account activity, or workload access events, field consistency becomes part of operational resilience.
A question worth separating out:
Q: How can teams decide which telemetry fields deserve facet treatment?
A: Use incident history and SOC workflows to identify the attributes that appear in repeated filters, correlation steps, and escalation decisions. Those fields are the best candidates for facets because they carry the most operational value. If a field rarely drives a question, it does not need to consume indexing priority.
👉 Read our full editorial: Facet-driven telemetry search cuts query cost at petabyte scale
