Gabriel Gomez

Case studies

• Parsing

  When the pipeline dropped fields

  Ingest was trustworthy again after remapping indexes and fixing grok, key-value, and Sawmill rules — including a 21k+ SpanMetrics cardinality case and the 2000-field ceiling.

  DevOps would ship logs that looked fine in the agent and vanished or mapped wrong in the index — _grokparsefailure, JSON strings where objects should be, timestamps in the wrong field, the 2000-field ceiling. I authored and debugged grok, key-value, and Sawmill rules, remapped indexes, and tuned a 21k+ SpanMetrics cardinality case so ingest was trustworthy again.

  • ELK
  • Grok / Sawmill
  • OTEL / Filebeat

• Identity

  SSO that worked in staging, not production

  Production SSO started completing after the same SAML setup that worked in staging failed in prod — the mismatch was on the service-provider side (sign-in URL and .pem/.cert), not a broken customer IdP.

  The surface I own is reading the error and finding the cause. We consume the customer’s IdP through the product UI (SAML or OAuth via Auth0) — we don’t architect their identity tenant. I compared the failed assertion and the Sign-in URL / certificate against staging, found the prod values didn’t match, and wrote that check down so the next identical failure wasn’t a black box.

  • SAML
  • OAuth
  • Auth0

• Incident

  A silent upgrade that took down metrics

  Turned a two-account config ticket into a platform incident and got metrics restored the same day — root cause was a Prometheus 3.0 upgrade that broke a query the accounts API depended on.

  Two accounts suddenly saw a “Get started” page and 500s instead of their metrics plan. I escalated with errors and screenshots, then found the same failure on a second unrelated account — which turned a “customer config” ticket into a platform incident. A Prometheus 3.0 upgrade had broken a query the accounts API used. Incident channel opened; restored the same day.

  • Metrics
  • Incident response
  • Cross-team

• Search

  Two equivalent queries, two different counts

  Got two logically equivalent searches returning matching counts the same day — a cost-saving index-template change had altered free-text mapping. A second regression the next morning was caught in the incident channel.

  One customer’s logically equivalent searches against the same field returned wildly different volumes. I packaged both queries and request IDs side by side after the first theories failed. Root cause: a cost-saving index-template change had altered free-text mapping. Fixed the same day; a second regression the next morning was caught in the incident channel.

  • Elasticsearch
  • Index mapping
  • Reproduction

• Deadline

  Unblocking a proof of concept

  Feature enabled and verified before the POC deadline after an enrichment-permissioning block and a broken AWS credential.

  A prospect’s POC depended on an enrichment feature that needed backend permissioning. I escalated with account and token context already gathered, then stayed through a second blocker when the AWS credential powering the feature broke. Feature enabled and verified before the deadline — the kind of work that sits next to the account team, not just the ticket queue.

  • Integrations
  • Account team
  • AWS