Structured Logging
Structured logging records log entries as machine-readable key-value or JSON data rather than plain text, making logs searchable, filterable, and analyzable at scale.
Structured logging is the practice of writing log entries as machine-readable data, usually as JSON objects or key-value pairs, instead of unstructured free-form text. Each entry carries explicit fields rather than embedding information in a sentence.
How It Works
Instead of logging a line like "user 42 failed login from 10.0.0.5", a structured logger emits an object with discrete fields: event, user_id, source_ip, and so on, plus standard fields like timestamp, level, and service. These entries are shipped to a log aggregation system where they can be indexed and queried by field. Including correlation identifiers, such as a trace ID, lets logs be joined with distributed traces and metrics. Many logging libraries support structured output natively, and a consistent schema across services makes the data far more useful.
Why It Matters
Free-form logs are easy to write but hard to analyze at scale; parsing them after the fact with regular expressions is brittle. Structured logs are searchable and aggregatable: you can count occurrences, filter by user, or chart error types directly. This makes structured logging a key contributor to observability, turning logs from a debugging afterthought into a queryable data source that complements metrics and traces.
Related Terms
Structured logging is a form of telemetry and one of the pillars of observability, alongside metrics and distributed tracing.