Log mana saja yang berasal dari satu request gagal?
Dependency call mana yang menyebabkan timeout?
Command mana yang menghasilkan audit rejection ini?
Trace mana yang berkaitan dengan error response client?
Tenant mana yang terdampak?

Dalam 20 jam latihan, kamu harus bisa mengambil satu request end-to-end,
melacaknya dari HTTP ingress, service method, repository/dependency call,
async task, log event, trace span, error response, dan audit event.

Correlation = kemampuan menghubungkan beberapa evidence sebagai bagian dari operasi yang sama.
Context = data runtime yang dibawa selama operasi agar correlation dan decision bisa dilakukan.

@Component
public final class RequestContextFilter extends OncePerRequestFilter {
    private static final String CORRELATION_HEADER = "X-Correlation-Id";

    @Override
    protected void doFilterInternal(
            HttpServletRequest request,
            HttpServletResponse response,
            FilterChain chain
    ) throws ServletException, IOException {
        String correlationId = resolveOrCreateCorrelationId(request);
        String requestId = UUID.randomUUID().toString();
        String tenantId = resolveTenantIdSafely(request);

        try {
            MDC.put("correlationId", correlationId);
            MDC.put("requestId", requestId);
            MDC.put("tenantId", tenantId);
            MDC.put("http.method", request.getMethod());
            MDC.put("http.route", resolveRoutePattern(request));

            response.setHeader(CORRELATION_HEADER, correlationId);
            chain.doFilter(request, response);
        } finally {
            MDC.clear();
        }
    }

    private String resolveOrCreateCorrelationId(HttpServletRequest request) {
        String incoming = request.getHeader(CORRELATION_HEADER);
        if (incoming == null || incoming.isBlank() || incoming.length() > 128) {
            return UUID.randomUUID().toString();
        }
        return incoming;
    }

    private String resolveTenantIdSafely(HttpServletRequest request) {
        // Resolve from authenticated principal/tenant resolver, not from arbitrary user input.
        return "unknown";
    }
}

{
  "type": "https://errors.example.com/case/CASE_NOT_ESCALATABLE",
  "title": "Case cannot be escalated",
  "status": 409,
  "detail": "The case is not in a state that allows escalation.",
  "instance": "/cases/CASE-123/escalations/requests/REQ-789",
  "errorCode": "CASE_NOT_ESCALATABLE",
  "correlationId": "c-2026-06-28-abc123"
}

log.atInfo()
   .setMessage("case escalation rejected")
   .addKeyValue("event", "case.escalation.rejected")
   .addKeyValue("error.code", "CASE_NOT_ESCALATABLE")
   .addKeyValue("correlationId", correlationId)
   .addKeyValue("caseId", caseId)
   .addKeyValue("outcome", "rejected")
   .log();

Client reports correlationId -> search logs -> inspect trace -> inspect audit event -> explain outcome.

Use trace_id for telemetry correlation.
Use correlationId for operational/business support correlation.
Carry both when possible.

{
  "trace_id": "same-trace",
  "span_id": "current-span",
  "correlationId": "same-correlation",
  "service.name": "case-service"
}

Active Span -> OpenTelemetry Context -> MDC copy -> Log Event -> JSON field

logging.pattern.level=trace_id=%mdc{trace_id} span_id=%mdc{span_id} trace_flags=%mdc{trace_flags} %5p

public record OperationContext(
    String correlationId,
    String requestId,
    String tenantId,
    String actorId,
    String operation,
    Instant deadline
) {
    public Map<String, String> logFields() {
        return Map.of(
            "correlationId", correlationId,
            "requestId", requestId,
            "tenantId", tenantId,
            "actorId", actorId,
            "operation", operation
        );
    }
}

OperationContext is explicit for business/domain decisions.
MDC is derived from OperationContext for logging.
OpenTelemetry Context is used for trace propagation.

public final class LoggingContextScope implements AutoCloseable {
    private final Map<String, String> previous = new HashMap<>();
    private final Set<String> keys;

    private LoggingContextScope(Map<String, String> fields) {
        this.keys = Set.copyOf(fields.keySet());
        for (var entry : fields.entrySet()) {
            previous.put(entry.getKey(), MDC.get(entry.getKey()));
            MDC.put(entry.getKey(), entry.getValue());
        }
    }

    public static LoggingContextScope with(Map<String, String> fields) {
        return new LoggingContextScope(fields);
    }

    @Override
    public void close() {
        for (String key : keys) {
            String old = previous.get(key);
            if (old == null) {
                MDC.remove(key);
            } else {
                MDC.put(key, old);
            }
        }
    }
}

try (var ignored = LoggingContextScope.with(context.logFields())) {
    log.info("case command started");
    handler.handle(command, context);
}

MDC.put("correlationId", correlationId);
executor.submit(() -> {
    log.info("async audit event published"); // correlationId mungkin tidak ada
});

public final class ContextAwareExecutor implements Executor {
    private final Executor delegate;

    public ContextAwareExecutor(Executor delegate) {
        this.delegate = delegate;
    }

    @Override
    public void execute(Runnable command) {
        Map<String, String> captured = MDC.getCopyOfContextMap();
        delegate.execute(() -> {
            Map<String, String> previous = MDC.getCopyOfContextMap();
            try {
                if (captured == null) {
                    MDC.clear();
                } else {
                    MDC.setContextMap(captured);
                }
                command.run();
            } finally {
                if (previous == null) {
                    MDC.clear();
                } else {
                    MDC.setContextMap(previous);
                }
            }
        });
    }
}

return CompletableFuture.supplyAsync(() -> riskClient.score(caseId))
    .thenApply(score -> decision(score));

Executor contextAwareExecutor = new ContextAwareExecutor(baseExecutor);

return CompletableFuture
    .supplyAsync(() -> riskClient.score(caseId), contextAwareExecutor)
    .thenApplyAsync(score -> decision(score), contextAwareExecutor);

MDC = thread-local diagnostic context.
Reactor Context = subscriber-context propagated through reactive chain.
OpenTelemetry Context = tracing context propagated through instrumentation.

Mono.deferContextual(ctx -> {
        String correlationId = ctx.get("correlationId");
        return service.process(correlationId);
    })
    .contextWrite(ctx -> ctx.put("correlationId", correlationId));

MDC.put("correlationId", correlationId);
return mono.flatMap(...); // context mungkin tidak valid saat dieksekusi

try (var executor = Executors.newVirtualThreadPerTaskExecutor()) {
    Map<String, String> captured = MDC.getCopyOfContextMap();

    Future<RiskScore> future = executor.submit(() -> {
        try {
            if (captured != null) MDC.setContextMap(captured);
            return riskClient.score(caseId);
        } finally {
            MDC.clear();
        }
    });

    return future.get();
}

if (!caseRecord.tenantId().equals(context.tenantId())) {
    log.atWarn()
       .setMessage("tenant context mismatch")
       .addKeyValue("event", "security.tenant.mismatch")
       .addKeyValue("outcome", "rejected")
       .addKeyValue("tenantId", context.tenantId())
       .addKeyValue("caseId", caseRecord.caseId())
       .addKeyValue("error.code", "TENANT_CONTEXT_MISMATCH")
       .log();

    throw new AccessDeniedException("Tenant mismatch");
}

Operational log: enough to investigate.
Audit record: enough to prove decision.
Security log: enough to detect abuse.

log.atInfo()
   .setMessage("case decision recorded")
   .addKeyValue("event", "case.decision.recorded")
   .addKeyValue("caseId", caseId)
   .addKeyValue("decisionId", decisionId)
   .addKeyValue("decisionType", decisionType)
   .addKeyValue("decisionOutcome", outcome)
   .addKeyValue("policyVersion", policyVersion)
   .log();

MessageHeaders headers = MessageHeaders.builder()
    .put("correlationId", context.correlationId())
    .put("causationId", command.commandId())
    .put("tenantId", context.tenantId())
    .put("traceparent", currentTraceParent())
    .build();

publisher.publish(event, headers);

public void consume(Message<CaseEscalated> message) {
    OperationContext context = contextFromHeaders(message.headers());

    try (var ignored = LoggingContextScope.with(context.logFields())) {
        log.atInfo()
           .setMessage("case escalated event consumed")
           .addKeyValue("event", "message.case_escalated.consumed")
           .addKeyValue("messageId", message.id())
           .addKeyValue("causationId", message.header("causationId"))
           .log();

        handler.handle(message.payload(), context);
    }
}

public record JobContext(
    String jobName,
    String jobRunId,
    Instant startedAt,
    String triggerType
) {}

log.atInfo()
   .setMessage("job started")
   .addKeyValue("event", "job.started")
   .addKeyValue("jobName", job.jobName())
   .addKeyValue("jobRunId", job.jobRunId())
   .addKeyValue("triggerType", job.triggerType())
   .log();

log.atWarn()
   .setMessage("job item rejected")
   .addKeyValue("event", "job.item.rejected")
   .addKeyValue("jobRunId", jobRunId)
   .addKeyValue("itemId", item.id())
   .addKeyValue("error.code", "ITEM_INVALID_STATE")
   .log();

log.atInfo()
   .setMessage("job completed")
   .addKeyValue("event", "job.completed")
   .addKeyValue("jobRunId", jobRunId)
   .addKeyValue("processed", processed)
   .addKeyValue("rejected", rejected)
   .addKeyValue("failed", failed)
   .addKeyValue("durationMs", durationMs)
   .log();

registry.counter("case.command.failed", "caseId", caseId).increment();

registry.counter(
    "case.command.failed",
    "operation", "case.submit",
    "error.code", "CASE_PERSISTENCE_FAILED",
    "tenant.tier", tenantTier
).increment();

Metrics answer: how many/how often/how slow?
Logs answer: what happened in this instance?
Traces answer: where time/failure flowed?

Span.current()
    .setAttribute("app.operation", "case.escalate")
    .setAttribute("app.case.type", caseType)
    .setAttribute("app.error.code", errorCode)
    .setAttribute("app.outcome", "rejected");

Request A tenant=t-001 selesai tanpa MDC.clear()
Thread dipakai Request B tenant=t-002
Log Request B berisi tenant=t-001
Incident investigation salah tenant

@Test
void clearsMdcAfterRequest() throws Exception {
    filter.doFilterInternal(request, response, chain);
    assertThat(MDC.getCopyOfContextMap()).isNullOrEmpty();
}

@Test
void restoresPreviousMdcAfterAsyncTask() {
    MDC.put("correlationId", "outer");

    executor.execute(() -> {
        assertThat(MDC.get("correlationId")).isEqualTo("outer");
        MDC.put("caseId", "CASE-1");
    });

    assertThat(MDC.get("caseId")).isNull();
    assertThat(MDC.get("correlationId")).isEqualTo("outer");
}

@AfterEach
void noMdcLeak() {
    assertThat(MDC.getCopyOfContextMap()).isNullOrEmpty();
}

required_context:
  http:
    - correlationId
    - requestId
    - trace_id
    - span_id
    - route
    - method
  domain_command:
    - correlationId
    - tenantId
    - actorId
    - operation
  case_operation:
    - caseId
    - caseType
    - operation
  async_message:
    - correlationId
    - messageId
    - causationId
    - tenantId

forbidden_context:
  - authorization
  - cookie
  - password
  - access_token
  - refresh_token
  - raw_jwt
  - raw_request_body

Given one failed request,
when given only the client-facing correlationId,
then engineer can find all relevant logs, trace, domain ID, error code, and audit event within minutes.

1. Every externally visible failure must have a supportable reference ID.
2. Every important log must be linkable to request/trace/domain context.
3. Trace ID is not the same as business correlation ID.
4. MDC is a logging transport, not a domain context model.
5. Context must be propagated intentionally across async boundaries.
6. Context must be cleaned deterministically.
7. High-cardinality correlation belongs in logs/traces, not metrics tags.
8. Tenant and actor context are security-sensitive.