Unstructured logs are where debugging time goes to die: grepping through inconsistent lines at 3 a.m. is the cost most teams pay for never having decided on a format. Structured logging — JSON with consistent field names, levels and trace context — is the unglamorous foundation that every mature observability stack in 2026 stands on.
Events, not sentences
Structured logs are key-value events with consistent fields: request ID, user ID, service, operation, duration. They enable the filters and aggregations that free text makes impossible, like finding all slow queries for one customer.
Context travels with the log
Attach trace and request context once and let it propagate through every log line in the flow. Retrospectively stitching together which lines belong to which request is the debugging tax structured context eliminates.
Log levels with intent
Debug for development, info for business milestones, warn for recoverable anomalies, error for failures needing attention. Levels set arbitrarily produce either silence during incidents or noise that buries the signal.
The schema that makes logs queryable
Start with a small, enforced field set: timestamp, level, message, service, environment, trace and span IDs, and a bounded set of domain fields — then log events rather than sentences. Consistency comes from logging through a shared library that applies the schema, adds context automatically and blocks raw string logging in review. The payoff arrives during incidents: filtering by trace ID across services in one query versus manually correlating timestamp ranges across five log files.
Volume, privacy and retention
Structured logs invite over-logging, so treat log volume as a cost center: levels with meaning (debug not enabled in production by default), sampling for high-frequency success events, and alerts on log rate anomalies as a first-class signal. The privacy half is equally important — PII belongs out of logs by construction, with the shared library applying redaction rather than trusting each call site. Retention policy follows the questions logs must answer: recent deep retention for incident response, aggregated long-term for trends.
Key takeaways
- Enforce schema via a shared logging library, not convention.
- Log events with trace context — queries beat greps every time.
- Redact PII by construction; treat log volume as a cost center.
Final thoughts
Structured logging is the prerequisite every other observability investment assumes, and teams that pay its small up-front cost discover that the 3 a.m. investigation becomes a five-minute query.