[Middleware docs]: if you cannot find logs by service, include service.name consistently: attribute names are case-sensitive. If event times are wrong, ensure time_unix_nano is correct and the sender's clock is synced with NTP. 401 or 403 or no data verify the Authorization header, workspace URL, and mw.account_key. Avoid sending secrets in body or attributes: redact in your log pipeline. Batch multiple log_records in one request to cut throughput overhead.

Context: Log search misses are attribute or timestamp problems.