Exercise 2: The Correlation-ID Technique Across a Multi-Service Failure — Possible Solution
====================================================================

The scenario: a failing request touches a load balancer, two
application servers, and a database -- each of which, per `cloud1-8`,
potentially logs to a DIFFERENT aggregation location entirely.

The correlation-ID technique:

If the application assigns a shared correlation ID (a request ID or
trace ID) to this request when it first arrives, and that same ID is
included in every log line written by EVERY service the request
touches along its journey -- the load balancer, whichever application
server actually handled it, and the database query layer -- then an
investigator can search each of those separate log sources for that
ONE specific ID value.

This immediately filters each service's logs down to ONLY the entries
relevant to this one specific failing request, cutting out all the
unrelated traffic those same services were also handling at the same
time. Rather than manually scanning potentially thousands of unrelated
log lines across four different log sources trying to spot the
relevant ones, the correlation ID turns the search into a precise,
targeted lookup in each source -- dramatically faster, and far less
error-prone than manual scanning.

What to fall back on if no correlation ID exists:

Per the chapter, narrow by TIME WINDOW plus the likely SOURCE
IP or RESOURCE IDENTIFIER instead. This is a less precise substitute
-- it can still return log lines from OTHER requests that happened to
occur in the same narrow window from the same source -- but it's the
next-best approach when no shared identifier ties the request's
footprint together across services directly.

WHY THIS WORKS AS AN ANSWER
------------------------------
This explains not just WHAT a correlation ID is, but WHY it works --
turning a broad manual-scanning problem across multiple disconnected
log sources into a precise, targeted lookup -- and gives the chapter's
own explicitly named fallback (time window + source identifier) for
when no correlation ID is available, rather than leaving that case
unaddressed.