Agent skill

Observability Patterns

by softspark in softspark/ai-toolkit

Observability: structured logs, metrics (RED/USE), tracing, SLO/SLI.

Apache-2.0Auto-check passedDevOps & Cloud

Install Observability Patterns

skills CLI
$ npx skills add softspark/ai-toolkit --skill observability-patterns -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install softspark/ai-toolkit observability-patterns --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/softspark/ai-toolkit.git skills-src && mkdir -p .claude/skills && cp -r skills-src/app/skills/observability-patterns .claude/skills/observability-patterns && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
observability-patterns
GitHub stars
179
Token cost
~2.2k tokens
SKILL.md length
562 words
Files
1
Skills in repo
112
Repo updated
First seen
Licence
Apache-2.0

At a glance

Observability: structured logs, metrics (RED/USE), tracing, SLO/SLI.

  • Tasks that involve Observability
  • SKILL.md covers Structured Logging, OpenTelemetry, Prometheus Metrics and Health Check Endpoints, plus 6 more sections
  • Reaches sentry.io
  • Tasks that involve Site reliability engineering

What it does

Observability Patterns is an agent skill from softspark/ai-toolkit. Observability: structured logs, metrics (RED/USE), tracing, SLO/SLI. Triggers: logging, metrics, Prometheus, Grafana, OpenTelemetry, trace, monitoring.

Its SKILL.md is about 2.2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud, covering Observability, Site reliability engineering and Monitoring and alerting. It works with Prometheus, OpenTelemetry and Grafana. The repository describes itself as: Professional-grade AI coding toolkit: 94 skills, 44 agents, multi-platform (Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, Augment, Antigravity, Codex CLI… The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Observability
  • Tasks that involve Site reliability engineering
  • Tasks that involve Monitoring and alerting

Example prompts

  • “/observability-patterns”

Requirements

  • Python 3
  • Node.js
  • Pre-approved tools (allowed-tools): Read

What it can do on your machine

Read from SKILL.md and the folder at commit d64db2b. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are python, typescript and yaml).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • sentry.io

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Observability Patterns loads about 2.2k tokens when it runs. Until then it costs about 44 tokens; SKILL.md has 562 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~44
When it runs · the whole SKILL.md, loaded when a task matches
~2.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from softspark/ai-toolkit at commit d64db2b, republished under its Apache-2.0 licence (© softspark). 562 words, ~2,163 tokens.

Download SKILL.mdSave it as .claude/skills/observability-patterns/SKILL.md (or your agent's skills folder).
name
observability-patterns
description
Observability: structured logs, metrics (RED/USE), tracing, SLO/SLI. Triggers: logging, metrics, Prometheus, Grafana, OpenTelemetry, trace, monitoring.
allowed-tools
Read
effort
medium
user-invocable
false

Observability Patterns

Structured Logging

Python (structlog)
python
import structlog

logger = structlog.get_logger()

logger.info("user_created", user_id=user.id, email=user.email, source="api")
logger.error("payment_failed", order_id=order.id, error=str(e), amount=amount)
Node.js (Pino)
typescript
import pino from "pino";

const logger = pino({ level: "info", transport: { target: "pino-pretty" } });

logger.info({ userId: user.id, action: "login" }, "User logged in");
logger.error({ err, orderId: order.id }, "Payment processing failed");
Log Levels
LevelUse For
errorFailures requiring attention
warnUnexpected but handled situations
infoBusiness events, state transitions
debugDevelopment diagnostics
Rules
  • Always use structured key-value pairs, not string interpolation
  • Include correlation IDs for request tracing
  • Never log sensitive data (passwords, tokens, PII)
  • Log at boundaries: API entry/exit, external calls, state changes

OpenTelemetry

Python Setup
python
from opentelemetry import trace, metrics
from opentelemetry.sdk.trace import TracerProvider
from opentelemetry.sdk.metrics import MeterProvider
from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter

trace.set_tracer_provider(TracerProvider())
trace.get_tracer_provider().add_span_processor(
    BatchSpanProcessor(OTLPSpanExporter(endpoint="http://otel-collector:4317"))
)

tracer = trace.get_tracer(__name__)
meter = metrics.get_meter(__name__)

request_counter = meter.create_counter("http_requests_total", description="Total HTTP requests")
request_duration = meter.create_histogram("http_request_duration_seconds")

@tracer.start_as_current_span("process_order")
def process_order(order_id: str):
    request_counter.add(1, {"method": "POST", "endpoint": "/orders"})
    with tracer.start_as_current_span("validate_order"):
        validate(order_id)
    with tracer.start_as_current_span("charge_payment"):
        charge(order_id)
Node.js Setup
typescript
import { NodeSDK } from "@opentelemetry/sdk-node";
import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-grpc";

const sdk = new NodeSDK({
  traceExporter: new OTLPTraceExporter({ url: "http://otel-collector:4317" }),
  instrumentations: [getNodeAutoInstrumentations()],
});
sdk.start();

Prometheus Metrics

Metric Types
python
# Counter - monotonically increasing (requests, errors)
http_requests_total = Counter("http_requests_total", "Total requests", ["method", "status", "path"])

# Histogram - distribution (latency, sizes)
request_duration = Histogram("request_duration_seconds", "Request latency",
    buckets=[0.01, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0])

# Gauge - current value (connections, queue size)
active_connections = Gauge("active_connections", "Current active connections")
Key Metrics (RED Method)
MetricTypePurpose
Request RateCounterTraffic volume
Request ErrorsCounterError rate
Request DurationHistogramLatency distribution
Key Metrics (USE Method - Infrastructure)
MetricTypePurpose
UtilizationGauge% resource used
SaturationGaugeQueue depth
ErrorsCounterError count

Health Check Endpoints

python
# FastAPI example
@app.get("/health")
async def health():
    checks = {
        "database": await check_db(),
        "redis": await check_redis(),
        "disk": check_disk_space(),
    }
    status = "healthy" if all(checks.values()) else "degraded"
    code = 200 if status == "healthy" else 503
    return JSONResponse({"status": status, "checks": checks}, status_code=code)

@app.get("/ready")
async def readiness():
    """Kubernetes readiness probe - can this instance serve traffic?"""
    return {"ready": True}

@app.get("/live")
async def liveness():
    """Kubernetes liveness probe - is the process alive?"""
    return {"alive": True}

Error Tracking (Sentry)

python
import sentry_sdk

sentry_sdk.init(
    dsn="https://key@sentry.io/project",
    traces_sample_rate=0.1,
    profiles_sample_rate=0.1,
    environment="production",
)

# Automatic exception capture + manual context
with sentry_sdk.push_scope() as scope:
    scope.set_tag("order_id", order.id)
    scope.set_context("payment", {"amount": amount, "currency": "USD"})
    sentry_sdk.capture_exception(e)

SLI/SLO Definition

Example SLOs
ServiceSLISLOWindow
APIAvailability (2xx / total)99.9%30 days
APILatency p99< 500ms30 days
SearchResult relevance> 80%7 days
IngestProcessing success rate99.5%30 days
Error Budget
Error Budget = 1 - SLO = 1 - 0.999 = 0.1%
Monthly budget = 30 days * 24h * 60min * 0.001 = 43.2 minutes

Alerting Rules

Prometheus Alert Examples
yaml
groups:
  - name: api-alerts
    rules:
      - alert: HighErrorRate
        expr: rate(http_requests_total{status=~"5.."}[5m]) / rate(http_requests_total[5m]) > 0.05
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Error rate above 5% for 5 minutes"

      - alert: HighLatency
        expr: histogram_quantile(0.99, rate(request_duration_seconds_bucket[5m])) > 1
        for: 10m
        labels:
          severity: warning
Alert Best Practices
  • Alert on symptoms (high latency), not causes (high CPU)
  • Include runbook links in annotations
  • Set appropriate severity: page only for user-impacting issues
  • Use for duration to avoid flapping

Rules

  • MUST emit logs as structured JSON with a trace_id (or correlation ID) propagated across service boundaries — unstructured logs are unsearchable at scale
  • MUST alert on symptoms (user-visible latency/errors), not causes (high CPU, queue depth) — causes change, symptoms are stable
  • NEVER log PII, PHI, or credentials — even at debug level. Logs leak to aggregation systems, backups, and disk snapshots.
  • NEVER use histograms without explicit buckets tuned to the expected range — default buckets either miss the p99 or waste cardinality
  • CRITICAL: SLOs define alerts, not metrics. An SLO of "99.9% of requests under 200ms" produces one alert ("burn rate exceeded") — not six alerts on each constituent metric.
  • MANDATORY: every alert includes a runbook link in its annotations. An alert without a runbook pages someone who then has to invent a response at 3am.
Show full SKILL.md (240 more words)Show less

Gotchas

  • trace_id must propagate via headers (traceparent / X-Correlation-ID) AND be added to every log line AND span. Partial propagation produces broken traces — one missing middleware and the span disappears from the UI.
  • OpenTelemetry SDK defaults to otlp/grpc on port 4317. Many corporate networks block it; otlp/http on 4318 with traces path works through proxies. Check connectivity before debugging app-level issues.
  • High-cardinality labels (user IDs, request IDs) on Prometheus metrics explode the time-series database. Prefer exemplars or traces for per-request data; keep metric labels to bounded categorical values.
  • for: 5m in Prometheus delays alerts by 5 minutes AND requires the condition to hold throughout — a 4m59s spike does not alert, even if it re-occurs. Use shorter for on critical alerts with a higher severity threshold.
  • Log-based metrics (counting log lines matching a regex) are expensive and brittle. A log format change silently breaks the metric; prefer direct instrumentation from the code.
  • Sampled traces (probability = 0.1) miss rare errors by design. For error-path visibility, use "always-sample on error" (tail sampling or head-based with error flag).

When NOT to Load

  • For implementing an alert rule or log aggregator — use the tool's docs (Prometheus, Grafana, Datadog); this skill is pattern-level
  • For performance tuning (profiling, flame graphs) — use /performance-profiling
  • For incident response mechanics during an outage — use /workflow incident-response
  • For generic logging library choice in a new project — use /app-builder which handles scaffolding
  • For security auditing of log content (PII leaks) — use /security-patterns and /hipaa-validate

© softspark, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in app/skills/observability-patterns of softspark/ai-toolkit.

Open the folder on GitHubat commit d64db2b

Compare with similar skills

Observability Patterns next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Observability Patterns compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Observability Patterns this skillsoftspark/ai-toolkit179—~2.2kAutomated safety check: PassApache-2.0
Monitoring Observabilityahmedasmar/devops-claude-skills203—~3.9kAutomated safety check: PassNone
Observability MonitoringAnastasiyaW/codex-claude-code-config154—~4.1kAutomated safety check: PassMIT
Telemetrymagnus919/agent-skills111—~3.9kAutomated safety check: PassMIT
Observability Sremajiayu000/spellbook286—~3.3kAutomated safety check: PassMIT
Monitoring EngineerFerroxLabs/wayland608—~3.9kAutomated safety check: PassApache-2.0

Similar skills

  • Monitoring Observability

    ahmedasmar/devops-claude-skills

    Monitoring and observability strategy, implementation, and troubleshooting.

    203 GitHub stars~3.9k tokensUpdated 5 mo ago
    DevOps & CloudAuto-check passed
  • Observability Monitoring

    AnastasiyaW/codex-claude-code-config

    Design, audit, and troubleshoot production monitoring and observability using user-impact checks, layered telemetry, USE/RED, SLI/SLO/SLA, error budgets, cardinality controls, actionable alerting…

    154 GitHub stars~4.1k tokensUpdated 5 days ago
    DevOps & CloudAuto-check passed
  • Telemetry

    magnus919/agent-skills

    Operate the observability stack that deploys as one unit: Prometheus scrape configuration, recording and alerting rules, relabeling, retention, and high availability; OpenTelemetry Collector…

    111 GitHub stars~3.9k tokensUpdated yesterday
    DevOps & CloudAuto-check passed
  • Observability Sre

    majiayu000/spellbook

    Observability and SRE expert. An agent skill from majiayu000/spellbook.

    286 GitHub stars~3.3k tokensUpdated yesterday
    DevOps & CloudAuto-check passed
  • Monitoring Engineer

    FerroxLabs/wayland

    Observability and monitoring. An agent skill from FerroxLabs/wayland.

    608 GitHub stars~3.9k tokensUpdated yesterday
    DevOps & CloudAuto-check passed
  • Archestra Dev Observability

    archestra-ai/archestra

    A skill your agent uses when changing Archestra tracing, metrics, OpenTelemetry, Tempo, Grafana, Prometheus, LLM/MCP spans, observability labels, or local observability setup.

    4.3k GitHub stars~1.2k tokensUpdated today
    DevOps & CloudAuto-check passed

More from softspark/ai-toolkit

All 112 skills in this repo
  • Prepare Test Env

    softspark/ai-toolkit

    Prepare or verify a project QA environment with source identity, readiness, browser access, evidence paths and owned cleanup.

    179 GitHub stars~1.8k tokensUpdated today
    Auto-check: notes
  • A11y Validate

    softspark/ai-toolkit

    Accessibility validator: WCAG 2.1 AA, EN 301 549, EAA. An agent skill from softspark/ai-toolkit.

    179 GitHub stars~3.8k tokensUpdated today
    Auto-check: notes
  • Analyze

    softspark/ai-toolkit

    Analyzes code quality, complexity, patterns across codebase.

    179 GitHub stars~1k tokensUpdated today
    Auto-check passed
  • Autonomous Dev

    softspark/ai-toolkit

    Drives a brief, specification, issue or existing PR through implementation, review, tests and QA to a ready PR.

    179 GitHub stars~2.6k tokensUpdated today
    Auto-check: notes
  • Brand Voice

    softspark/ai-toolkit

    Direct technical voice for docs, README, user-facing text. An agent skill from softspark/ai-toolkit.

    179 GitHub stars~2.1k tokensUpdated today
    Auto-check passed
  • CI

    softspark/ai-toolkit

    Detect/generate/debug CI pipeline config (GitHub Actions, GitLab CI).

    179 GitHub stars~1.1k tokensUpdated today
    Auto-check: notes

Categories

Questions about Observability Patterns

What does Observability Patterns do?

Observability: structured logs, metrics (RED/USE), tracing, SLO/SLI. Observability Patterns is an agent skill from softspark/ai-toolkit. Observability: structured logs, metrics (RED/USE), tracing, SLO/SLI.

When should I use Observability Patterns?

Observability Patterns fits situations like: tasks that involve Observability; tasks that involve Site reliability engineering; tasks that involve Monitoring and alerting.

How do I install Observability Patterns in Claude Code?

Run `npx skills add softspark/ai-toolkit --skill observability-patterns -a claude-code`. Or copy the skill folder (app/skills/observability-patterns in softspark/ai-toolkit) into .claude/skills/observability-patterns in your project. Claude Code loads it when a task matches its description.

How do I install Observability Patterns in Codex?

Run `npx skills add softspark/ai-toolkit --skill observability-patterns -a codex`. Or copy the skill folder (app/skills/observability-patterns in softspark/ai-toolkit) into .agents/skills/observability-patterns in your project. Codex loads it when a task matches its description.

Can I use Observability Patterns in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add softspark/ai-toolkit --skill observability-patterns -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/observability-patterns, .gemini/skills/observability-patterns, .github/skills/observability-patterns and .opencode/skills/observability-patterns in your project.

What does Observability Patterns need to run?

SKILL.md names no scripts, command-line tools or credentials: Observability Patterns is instructions for the agent only. Our summary lists: Python 3; Node.js. Its frontmatter pre-approves these tools: Read.

Does Observability Patterns access the network?

SKILL.md names 1 domain. In commands or code: sentry.io; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is Observability Patterns safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Observability Patterns use?

Observability Patterns is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Observability Patterns use?

About 2.2k tokens (SKILL.md is roughly 8.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Observability Patterns?

Skills that share tags, products or a category with Observability Patterns: Monitoring Observability (ahmedasmar/devops-claude-skills, 203 stars), Observability Monitoring (AnastasiyaW/codex-claude-code-config, 154 stars), Telemetry (magnus919/agent-skills, 111 stars) and Observability Sre (majiayu000/spellbook, 286 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Observability Patterns?

softspark (a GitHub user) maintains it in softspark/ai-toolkit, which has 179 GitHub stars. The repository holds 112 skills in this directory. The repository was last updated on October 7, 2026.

Source: softspark/ai-toolkit on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.