Implementing Logging Strategies
1. Using Structured Logging
| Aspect | Detail |
|---|---|
| Format | JSON (one event per line) |
| Stable keys | timestamp, level, message, service |
| Schema | OpenTelemetry Logs / ECS |
| Avoid | String concatenation; use structured fields |
Example: JSON log event
{"ts":"2026-05-15T12:00:00Z","level":"INFO","service":"orders","traceId":"abc","spanId":"def","msg":"order placed","orderId":"ord_123","userId":"u_42","total":49.95}2. Implementing Log Levels
| Level | Use |
|---|---|
| TRACE | Very fine; off in prod |
| DEBUG | Diagnostic; sampled in prod |
| INFO | Significant lifecycle events |
| WARN | Recoverable issue |
| ERROR | Operation failed |
| FATAL | Process must exit |
3. Adding Correlation IDs
| Field | Detail |
|---|---|
| traceId / spanId | From W3C trace context |
| requestId | Per-HTTP-request UUID |
| correlationId | Business workflow ID |
| MDC / context | Set per request; auto-included in logs |
4. Centralizing Logs
| Stack | Components |
|---|---|
| ELK / Elastic | Elasticsearch + Logstash + Kibana |
| EFK | Fluent Bit / Fluentd shipper |
| Loki + Grafana | Index labels not content; cheap |
| Cloud | CloudWatch, Stackdriver, Azure Monitor |
| Pattern | App → stdout → agent → backend |
5. Implementing Log Sampling
| Strategy | Detail |
|---|---|
| Probabilistic | 1% of DEBUG, 100% of ERROR |
| Rate limit | N events/sec per logger |
| Tail sampling | Keep all logs for traces with errors |
| Dedup | Suppress identical lines (Logback) |
6. Using Contextual Logging
| Mechanism | Detail |
|---|---|
| MDC (Java) / context (Go) | Per-request bag of fields |
| Auto-fields | service, env, version, host |
| Per-call fields | userId, tenantId, orderId |
| Cleanup | Clear context at request end |
7. Logging Security Events
| Event | Fields |
|---|---|
| Login success/failure | userId, IP, user-agent |
| Permission denied | resource, action |
| Privilege change | actor, target |
| Token issuance/revocation | jti, exp |
| Storage | Separate, append-only stream |
8. Handling Sensitive Data
| Practice | Detail |
|---|---|
| Never log | Passwords, secrets, full PAN, JWT contents |
| Mask | Email j***@x.com, card ****1234 |
| Allow-list serializer | Only fields explicitly marked safe |
| Compliance | GDPR, HIPAA, PCI-DSS |
9. Implementing Log Retention
| Tier | Retention |
|---|---|
| Hot (search) | 7–30 days |
| Warm | 30–90 days |
| Cold (archive) | 1–7 years (compliance) |
| Audit | Per regulation; tamper-evident |
10. Using Log Timestamps
| Practice | Detail |
|---|---|
| Format | ISO-8601 with ms + UTC |
| Source | Use NTP-synced wall clock; HLC for ordering |
| Avoid | Local time zones in logs |
11. Implementing Log Rotation
| Strategy | Detail |
|---|---|
| Container | Stream to stdout; let runtime rotate |
| VM | logrotate by size or daily |
| Compression | gzip rotated files |
| Retention | Disk: keep 7 days; ship to central earlier |
12. Using Logging Tools
| Tool | Use |
|---|---|
| Logback / Log4j 2 / Tinylog | Java |
| Pino / Winston | Node.js |
| zap / zerolog | Go |
| structlog / loguru | Python |
| Fluent Bit / Vector / Filebeat | Shippers |
| Loki / Elastic / OpenSearch | Backends |