Structured logs, always

Log JSON objects, not formatted strings. Every log management system (Datadog, Loki, CloudWatch Logs Insights) can filter and aggregate on JSON fields. Text strings require fragile regex.

// BAD
logger.info("User 4821 created order 993 for $45.00");

// GOOD
logger.info({ user_id: 4821, order_id: 993, amount: 45.00, event: "order.created" });

Log levels

  • ERROR — something broke and requires action. Page on-call.
  • WARN — something unexpected but recoverable. Monitor for trends.
  • INFO — normal business events (order created, user logged in). Searchable history.
  • DEBUG — detailed internal state. Off in production; enable per-service for debugging.

Correlation IDs

Generate a unique request_id at the edge (API gateway or first service). Propagate it in headers and include it in every log line. Searching by request_id reconstructs the complete flow across all services.

What not to log

Passwords, tokens, credit card numbers, PII. Logs are often aggregated in systems with broader access than the application database.