A real incident investigation starts the moment you find the ERROR line. The ERROR is the result — the cause is usually upstream. The WARN just above it, a timeout a few seconds earlier, a config load hundreds of lines back.
Source: [Dev.to](https://dev.to/_156a59a8566fe532e165/you-found-the-error-the-cause-is-in-the-lines-before-it-1ij2)