What is stack-observability?

A reference guide to tools and practices for observing software systems, including services, logs, traces, performance data, and errors. It covers products such as Datadog, Grafana, Prometheus, Splunk, Sentry, and the OpenTelemetry standard.

Use it when building, deploying, or reviewing monitoring for applications and infrastructure across the listed observability platforms.

It helps developers find the right monitoring knowledge for a particular product or team role instead of treating every observability tool the same way.

stack-observability — Skill for Claude Code by e-t-y-b

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add e-t-y-b/etyb-skills --skill observability

Clone the repo

git clone --depth 1 https://github.com/e-t-y-b/etyb-skills

Made for: Claude Code.

Or install etyb, the plugin that ships this one along with the rest of its 14 skills, 5 agents, 4 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/e-t-y-b/etyb-skills/observability/github.svg)](https://agentmods.dev/skills/e-t-y-b/etyb-skills/observability)

Your own site

<a href="https://agentmods.dev/skills/e-t-y-b/etyb-skills/observability"><img src="https://agentmods.dev/badge/skills/e-t-y-b/etyb-skills/observability/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/e-t-y-b/etyb-skills/observability"><img src="https://agentmods.dev/badge/skills/e-t-y-b/etyb-skills/observability.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 275 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,734 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00275	$0.03734
Opus 5	$0.00138	$0.01867
Sonnet 5	$0.00055	$0.00747
Haiku 4.5	$0.00028	$0.00373

Measured 12d ago against content hash a80203121423, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

stack-observability scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

stacks/observability/SKILL.md · 123 lines

How it starts

The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Observability (multi-vendor) Stack — Team Briefing

This is a knowledge overlay, not a new specialist. The existing ETYB team does the work — backend-architect writes the backend code, devops-engineer wires the deploys, security-engineer enforces the boundary. This pack tells each role where the current Observability (multi-vendor) knowledge lives.

Where the full briefing lives

The full Stack briefing lives in this same folder. Per-product and per-role pages are siblings of this SKILL.md. Every page carries last_verified_on stamps and authoritative-source URLs in its frontmatter; see skills/etyb/core/knowledge-currency.md for the drift-check protocol that uses them.

Stack briefing: stacks/observability/index.md
Per-product pages: stacks/observability/<product>.md — one per entry in products_covered above
Per-role views: stacks/observability/<role>.md — one per role in applies_to_roles above

When ETYB is installed locally these are read directly from disk. For third-party agents without the install, the same content is reachable as raw markdown at https://raw.githubusercontent.com/e-t-y-b/etyb-skills/main/stacks/observability/<page>.md.

When delegate_to_skills (frontmatter above) lists a first-party vendor MCP/skill that's installed in the user's environment, ETYB defers to it first. The in-repo Stack content is the curated fallback.

What changed in 2025-2026 that older training data misses

Critical context — an LLM with a 2024 cutoff will get these wrong:

OpenTelemetry is the default instrumentation choice. As of 2025-2026, every major vendor (Datadog, New Relic, Splunk, Honeycomb, Dynatrace, Grafana, Sentry for traces, AWS, GCP, Azure) ingests OTLP first-class. Vendor proprietary SDKs (dd-trace, newrelic, signalfx) still exist but starting greenfield with OTel and shipping to your vendor over OTLP is the right default.
Semantic conventions are versioned. semconv 1.28 (mid-2024) stabilized HTTP, RPC, messaging, and DB attributes. 1.29-1.32 (2025-2026) added GenAI, Kafka, Kubernetes, and CICD conventions. If your code is on semconv 1.20-era attributes (http.method, http.status_code instead of http.request.method, http.response.status_code), your dashboards on a new vendor will look broken.
OTel Logs spec is GA. Logs are now a first-class OTel signal, not a "use Fluent Bit instead" gap. OTLP/logs ingestion is supported by every major vendor.
OTel Profiles spec landed. Continuous profiling joined the OTel signal family in 2025; SDKs and ingestion are still rolling out per language.
eBPF auto-instrumentation is real. Grafana Beyla, Datadog Universal Service Monitoring (USM), Pixie (under New Relic), and Cilium Tetragon can produce service-level RED metrics + L7 traces without changing application code.
LLM Observability is a first-class product. Datadog LLM Observability (GA 2024), New Relic AI Monitoring, Honeycomb's AI insights, Grafana AI traces + Tempo, and OSS tools (Langfuse, LangSmith, Helicone) all instrument prompts, completions, tool calls, evaluators, and cost-per-call. The OTel GenAI semantic conventions (1.30-1.32) gave us gen_ai.system, gen_ai.request.model, gen_ai.usage.input_tokens, etc.
Splunk was acquired by Cisco (March 2024 close). Roadmap convergence with Cisco AppDynamics and Cisco ThousandEyes is in motion. Splunk Observability Cloud (the ex-SignalFx surface) is the strategic forward bet; expect pricing and packaging changes through 2026-2027.
Grafana Alloy replaced Grafana Agent (Grafana Agent EOL November 2025). Alloy is an OTel-Collector-compatible distribution with River/Alloy config syntax and Prometheus pipeline support.
Prometheus 3.x brought native OTLP ingest (/api/v1/otlp/v1/metrics), UTF-8 metric names, native (exponential) histograms with order-of-magnitude cardinality reduction on latency metrics, and Remote Write 2.0.
Honeycomb Refinery for tail-based sampling became a standard pattern in 2025. With trace volumes growing 5-10x as services adopt OTel, head-based sampling at the SDK throws away the interesting traces (errors, high-latency).
Sentry Source Maps Debug IDs. Sentry deprecated the legacy "release name → source maps" association. Debug IDs (embedded in build artifacts and uploaded via sentry-cli sourcemaps inject) are the modern path.

Read the full file on GitHub · 123 lines

Files

What ships with it

60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 123 lines · 275 tokens per session scan A a80203121423

Subscribe to this mod's changes

stack-observability is a skill published in the GitHub repository e-t-y-b/etyb-skills (10 stars, last pushed 2mo ago), licensed MIT. It adds 275 tokens to every session and 3,734 once invoked, about $0.0014 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Analytics and metrics Claude Code agentskills ai-agent architecture

design-first

Guides the creation of technical design documents before writing code, producing architecture diagrams, data models, API interface definitions, implementation plans, and multi-option trade-off analyses. Use when the user asks to plan a feature, architect a system, design an API, explore implementation approaches, or…

rohitg00/skillkit · 84 tokens

qrspi-methodology

Enforces the QRSPI (Question, Research, Structure, Plan, Implement) engineering methodology. Triggers whenever starting complex features, architectural refactors, multi-file bug investigations, system migrations, or new implementations to ensure zero hallucinations, simplicity-first architecture, and surgical…

racastellanosm/agent-skills · 65 tokens

docker-and-orchestration

Enforces the Zero-Host-Dependencies engineering philosophy using Docker, Docker Compose, and a unified Makefile orchestration layer. Triggers when creating, refactoring, or containerizing applications, writing multi-stage Dockerfiles (Distroless/Scratch/Alpine), setting up split Compose topologies (base + dev…

racastellanosm/agent-skills · 82 tokens

code-review

AI-powered code review and PR analysis. Performs systematic reviews covering security vulnerabilities, code quality, style compliance, architectural integrity, test coverage, and performance considerations. Works with PR diffs, commit ranges, file changes, or raw code snippets. Primary keyword clusters: AI code review…

JPeetz/agent-skills · 137 tokens

mermaid-diagrams

Create software diagrams using Mermaid syntax. Use when users need to create, visualize, or document software through diagrams including class diagrams, sequence diagrams, flowcharts, ERDs, C4 architecture diagrams, state diagrams, git graphs, and other diagram types. Triggers include requests to diagram, visualize…

wpank/ai · 77 tokens

ops-demo

CocoOps demo mode activator — populates .cocoplus/ops/demo/ with realistic mock data and sets cocoplus.toml [demo] enabled = true. Invoked via $ops demo.

Snowflake-Labs/cocoplus · 46 tokens