I'm seeing this "3 pillars of observability" framing as the main description these days, and I think it is nice breakdown of options. However, there is a common problem I am curious how others are dealing with. All metrics systems I have seen don't handle high cardinality data like Ids well. Most SASS products base their pricing on unique metrics because each unique aggregation has a cost. In the 3 pillars model, companies like Datadog are pushing those high cardinality values into the log pillar, and this article seems to imply the same. However, logs are often unstructured. There are often tools to search through logs, find values within those logs, and I can even do aggregations on them. However, when you know ahead of time what you want to aggregate on, text logs are more brittle than simply defining an event in json or another structured format. This log tier quickly becomes an ad-hoc version of a data warehouse and I feel like there is a missing tier here where you would send structured data to a datastore to do aggregations on for observability purposes only. I know datadog supports parsing structured data in this way, but I'm curious what is a common solution to this.

Is sending structured data through the "log" tier common, or are there structured event and reporting systems that are part of another system that is seldom discussed in this topic.