There is a difference between having dashboards and having observability. Dashboards tell you a number moved. Observability lets you ask why, at three in the morning, about a request you did not anticipate. That usually means structured logs, traces that cross service boundaries, and metrics tied to user experience rather than CPU.
Alerting is where most setups fail. Too many alerts and the team stops reading them; too few and the first report comes from a customer. We alert on symptoms users would notice, route them to someone who can act, and delete anything that fires without a decision attached.
The incident process matters as much as the tooling. Runbooks for known failure modes, a clear escalation path, and blameless reviews that produce one or two real changes rather than a document nobody reopens.
