All lessons · 44
LLM Observability
Why AI features need monitoring beyond normal logs: tracing every request — prompt, model, tools, tokens, cost, latency — plus production monitoring and the tools that do it.
Logs are not enough
A traditional web app fails loudly: a 500 error, a stack trace, an alert. An LLM app fails quietly. The request returns 200, the user gets an answer — a wrong, made-up, or ten-times-too-expensive answer. Nothing crashes; quality just slips. That is why AI features need observability beyond normal logs.
Three questions you must be able to answer for every request:
- What exactly did the model see? The full prompt, system message, retrieved chunks, tool results. When output is bad, the input usually explains it.
- What did it cost and how long did it take? Tokens in, tokens out, which model, total latency — how long the user waited. Costs hide in retries and long contexts.
- Did it work? A user thumbs-down, a retry, an abandoned session — signals that something went wrong.
Why you should care
Without this, every bug report sounds the same: “the bot said something stupid.” You cannot debug a sentence you never saw. With traces, that same report becomes a ticket with a link: here is the question, here is what we retrieved, here is the exact prompt, here is why it answered that way. Ten seconds instead of three days of guessing.
Words you will see
| Word | What it means here |
|---|---|
| Log | One dated line the program writes about something that happened. |
| Span | One step inside a request: a retrieval, a model call, a tool call. |
| Trace | All the spans of one request, in order, under a single ID. |
| Trace ID | The number that ties every span of one request together — req_8f3a. |
| Metric | A number you count over time: error rate, cost per request, thumbs-down share. |
| Percentile (p95) | “95% of requests were faster than this.” Better than an average, which one slow outlier ruins. |
| Dashboard | One screen with your metrics as charts. Your smoke alarm. |
| Drift | Quality slowly getting worse while nothing crashes — a retriever rotting, a provider quietly changing a model. |
| RAG | Retrieval-augmented generation: looking up your documents first, then answering with them in hand. |
One request, step by step
Click through a request to a support assistant with a RAG lookup and a tool call, and see what to log at each step:
User question arrives at your API.
Log: request ID, user ID, timestamp, raw question. This ID is the thread you follow through every later log line.
Each step gets its own log line or span, and every span carries the same trace ID. Put together, those spans are a trace.
In plain language: a trace is one request’s diary. Every step, in order, filed under a single number — like the tracking page for a parcel, except instead of “arrived at the depot” you get “found 3 documents”, “sent 1 240 tokens to gpt-4o-mini”, “called the refund API”, “answered in 2.4 s for $0.0031”. When a user complains, you do not guess: you open the trace and see the whole request — what was retrieved, what was prompted, what came back, what it cost.
A concrete case
A customer writes: “your bot told me refunds take 30 days, your policy
page says 14.” Without a trace you argue with a stranger. With a trace
you open request req_8f3a and see in ten seconds that the retrieval
step pulled a chunk from the old 2023 pricing page, the model
faithfully repeated it, and the same request was retried twice — so it
also cost three times what it should have. One look, three answers: what
broke, why, and what to fix.
Tracing, monitoring, cost watch
Tracing is the detailed record above: every request decomposed into steps — prompt, model, tools, tokens, cost, latency — stitched together by a trace ID. It is your debugging tool: one request at a time, in full detail. When quality drops, you look at traces from bad sessions and find the pattern: the retriever started returning irrelevant chunks, or a prompt edit doubled the token count.
Production monitoring is the aggregated view — all your traces at once, turned into charts: error rates, latency percentiles, thumbs-down share, output length anomalies. It is your smoke alarm. It is also the difference between a user telling you “your bot got worse” and you noticing it three days earlier on a chart.
Cost and latency monitoring deserves its own line on the dashboard because LLM economics are unforgiving: a prompt that quietly grew from 800 to 8 000 tokens multiplies your bill, and a model switch can double latency. Track cost per request, per feature, per user cohort.
The tools
LangSmith — from the LangChain team. Deep tracing with dataset runs and eval features built in. The most complete option if you are in the LangChain ecosystem; works standalone too, but its mental model is LangChain-shaped.
Langfuse — open source, self-hostable, model-agnostic. Tracing, cost tracking, prompt management, evals. The default pick if you want your telemetry data to stay yours and do not want a LangChain tie-in.
Helicone — sits as a proxy between your app and the model API. Logging is nearly free to add: change one URL. Great for cost analytics and caching; less deep on application-level tracing than Langfuse.
Arize AI — the heavyweight, ML-observability heritage: drift detection, embedding analysis, online evals at scale. Worth it for large teams treating LLMs as part of a broader ML platform; overkill for a first AI feature.
Pick one, not four
They all trace; they differ in hosting, price and depth. Practical rule: want self-hosting and open source — Langfuse. Want zero code changes — Helicone. Already deep in LangChain — LangSmith. Choose one, wire it into every request from day one, and move on. Instrumentation added after an incident is always too late.
What to instrument on day one
You do not need all of it at once. In order of value per minute of work:
- One trace ID per request, threaded through every step. Without it you have logs, not a trace.
- The full prompt and the full output. The two things you will look for in every single incident.
- Model name and version, token counts, cost, latency. Four numbers that turn “it feels slow and expensive” into an argument with a chart.
- Retrieval details — which documents were used and their scores. Most quality bugs are retrieval bugs wearing a costume.
- Feedback — thumbs up, thumbs down, escalations. This is what turns traces into evals.
Log the words, protect the people
Traces contain the real text users typed — which sometimes means names, addresses and passwords. Redact secrets and personal data before storing, decide how long traces live, and never paste raw production traces into a public chatbot when debugging.
Try it: instrument one request
You do not have to write the plumbing by hand. Paste this into your coding agent — it will wire tracing into one endpoint and show you where to look:
Add tracing to the LLM call in this project, one endpoint only.
WHAT I NEED LOGGED, for every single request:
1. A trace ID that is created at the start and attached to every step.
2. The final prompt we sent (full text) and the full output we got back.
3. The model name and version.
4. Input tokens, output tokens, cost in cents, latency in milliseconds.
5. Any tool calls: name, arguments, raw response.
RULES:
- Do not log API keys, passwords, or anything that looks like personal data.
Redact them before writing.
- Explain in plain language where I can see the traces when I run this
locally, and give me one command to open them.
- Keep the change as small as possible: one endpoint, one file if you can.
- After you finish, tell me in two sentences what is logged and what is not.Check yourself
Why are ordinary logs and error alerts not enough for an LLM feature?
What is a "trace"?
You open a trace and see the retrieval step returned three chunks — all from a 2023 pricing page. What does that tell you?
Tracing and production monitoring — what is the difference?
Your takeaway
Four moves, in this order:
- Pick one tool and instrument one request today. Not the whole app — one endpoint. You want to see a single trace on a screen before lunch.
- Make sure the trace ID threads through every step. No ID, no trace, no debugging.
- Put cost and latency on a dashboard from day one. These are the two numbers that quietly double.
- Connect feedback to traces. A thumbs-down with a trace ID is the seed of your first golden dataset.
The habit: when something looks wrong, open the trace before you change the prompt. Guessing is more expensive than looking.