Structured logging best practices

Unstructured log messages are hard to search, filter, and aggregate in production systems.

Use structured (JSON) logging with consistent fields:

# Python with structlog
import structlog

log = structlog.get_logger()

log.info('user_login', 
    user_id='u123',
    ip_address='10.0.0.1',
    method='oauth',
    duration_ms=142)
# Output: {"event": "user_login", "user_id": "u123", "ip_address": "10.0.0.1", ...}

// Node.js with pino
const pino = require('pino');
const log = pino();

log.info({ userId: 'u123', orderId: 'o456', amount: 29.99 }, 'order_placed');

Standard fields to always include:

• timestamp (ISO 8601)
• level (info, warn, error)
• service / component
• request_id / trace_id (for distributed tracing)
• event (machine-readable event name)

Guidelines:

• Use snake_case for field names consistently
• Log at boundaries: incoming requests, outgoing calls, errors
• Include context (user_id, request_id) but never secrets
• Use log levels meaningfully: ERROR = needs attention, WARN = degraded, INFO = business events, DEBUG = developer details

Structured logs enable querying (find all errors for user X), aggregation (count logins per hour), and alerting in log management systems.

Production services needing searchable, analyzable logs