diff --git a/tutorial/content/labs/instrumentation/manual/logs/images/log_aggregator.drawio.xml b/tutorial/content/labs/instrumentation/manual/logs/images/log_aggregator.drawio.xml
new file mode 100644
index 0000000..9be6ff4
--- /dev/null
+++ b/tutorial/content/labs/instrumentation/manual/logs/images/log_aggregator.drawio.xml
@@ -0,0 +1,63 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tutorial/content/labs/instrumentation/manual/logs/images/logs_after_otel.drawio.png b/tutorial/content/labs/instrumentation/manual/logs/images/logs_after_otel.drawio.png
new file mode 100644
index 0000000..0a69a6c
Binary files /dev/null and b/tutorial/content/labs/instrumentation/manual/logs/images/logs_after_otel.drawio.png differ
diff --git a/tutorial/content/labs/instrumentation/manual/logs/images/logs_after_otel.drawio.xml b/tutorial/content/labs/instrumentation/manual/logs/images/logs_after_otel.drawio.xml
new file mode 100644
index 0000000..4f8bb44
--- /dev/null
+++ b/tutorial/content/labs/instrumentation/manual/logs/images/logs_after_otel.drawio.xml
@@ -0,0 +1,127 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tutorial/content/labs/instrumentation/manual/logs/images/logs_before_otel.drawio.png b/tutorial/content/labs/instrumentation/manual/logs/images/logs_before_otel.drawio.png
new file mode 100644
index 0000000..823d3d5
Binary files /dev/null and b/tutorial/content/labs/instrumentation/manual/logs/images/logs_before_otel.drawio.png differ
diff --git a/tutorial/content/labs/instrumentation/manual/logs/images/logs_before_otel.drawio.xml b/tutorial/content/labs/instrumentation/manual/logs/images/logs_before_otel.drawio.xml
new file mode 100644
index 0000000..d2f2874
--- /dev/null
+++ b/tutorial/content/labs/instrumentation/manual/logs/images/logs_before_otel.drawio.xml
@@ -0,0 +1,134 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tutorial/content/labs/instrumentation/manual/logs/logs.md b/tutorial/content/labs/instrumentation/manual/logs/index.md
similarity index 97%
rename from tutorial/content/labs/instrumentation/manual/logs/logs.md
rename to tutorial/content/labs/instrumentation/manual/logs/index.md
index 55f4cb0..189785b 100644
--- a/tutorial/content/labs/instrumentation/manual/logs/logs.md
+++ b/tutorial/content/labs/instrumentation/manual/logs/index.md
@@ -46,11 +46,11 @@ This log entry adds metadata like the service name (Docker), a timestamp when th
With the rise of distributed systems and microservices, collecting the log entries just on the machine where the services were running has turned out to be impractical. So there was the need for log aggregation tools like fluentd, the ELK stack (Elasticsearch, Logstash, Kibana) or Grafana Loki. These tools can aggregate log entries from multiple sources to store these entries in a centralized solution. In the example, there are multiple containers deployed that run a log collector agent that sends log entries to a Grafana Loki instance. Loki stores the entries, indexes them and makes them queryable via LogQL. With LogQL logs, entries can then be explored with Grafana, where dashboards or alerts can be configured for the entries.
-
+{{< figure src="images/log_aggregator.drawio.png" width=650 caption="TODO" >}}
This enabled developers to perform indexing and searching to find failures and problems faster, run log analysis to find patterns or trends, monitor log entries to find anomalies or even trigger alerts or generate reports. This was a giant leap forward with using log entries in observability, but it still wasn't perfect. If you tried to get more context like the call stack or other services, developers still needed to find the corresponding traces and spans by correlating the timestamp or IDs. Besides that, there are multiple formats for logs and multiple aggregators to collect the entries. Nothing is unified, and not every aggregator can read every logging format. This would lead to fragmentation and additional effort to integrate logging into the observability stack of an application.
-
+{{< figure src="images/logs_before_otel.drawio.png" width=650 caption="TODO" >}}
This is where the idea of OpenTelemetry Logging was born.
@@ -60,7 +60,7 @@ Logging in OpenTelemetry differs a little from the other signals. Logging is not
The data model of OpenTelemetry logging is designed in such a way that existing data models can be mapped to the OpenTelemetry data model. Translating logging data from an arbitrary logging format into the data model and then translating it into another logging format should not be worse than translating the initial logging format directly to the other format. The data model aims to represent multiple types of logs, like system formats that are generated by the operating system like syslog, third-party applications like logs that generate Apache log files and first-party applications where developers can modify the logging format. OpenTelemetry defines in the specs which fields map to which type, and for some logging formats and libraries mappings are already defined. With the OpenTelemetry stack, a unified way to collect telemetry data is created. Since logs provide additional metadata, all the collected telemetry data can be correlated to each other. In the following chapter, this will be further demonstrated.
-
+{{< figure src="images/logs_after_otel.drawio.png" width=650 caption="TODO" >}}
### Hands-on
Now let's start with some hand-on experience. The goal of this little demo-app is to show how to incorporate OpenTelemetry Logging into applications. To follow along the following steps, please open the course repository on the side and checkout to the tag `log-lab-initial`. The session will start from there.