Logs: definition
Logs are records of discrete events. An application might log a failed authentication, a database timeout or a deployment event; infrastructure might log a process restart or kernel error. Logs can preserve details that would be too expensive or inappropriate to encode as metric dimensions.
Structured vs unstructured logs
Plain text is easy to emit but harder to query consistently. Structured logs attach fields such as service name, severity, environment, request ID and error type so systems can filter and aggregate events without fragile text parsing.
Context makes logs useful
A timestamp and message are often not enough. Correlation IDs, trace context, deployment version, region and service ownership can turn an isolated error into evidence that links to the affected request or release. Consistent field names make cross-service investigation faster.
Security and privacy
Logs can accidentally capture credentials, tokens, personal data or sensitive payloads. Collection pipelines should minimize sensitive fields, apply access controls and define retention deliberately. “Log everything” is not a safe observability strategy.
Logs, metrics and traces
Metrics are efficient for aggregate detection, traces show the path and timing of requests, and logs preserve event-level detail. During an incident, a metric may reveal an error-rate spike, a trace may identify the failing dependency, and related logs may contain the exact error returned by that dependency.
Common mistakes
- Using inconsistent field names across services.
- Logging high-volume debug detail permanently in production.
- Failing to include trace or request correlation context.
- Keeping sensitive data without a clear operational need.
- Alerting on every log line instead of on conditions that represent impact.
Related concepts
Short answer
Logs are event records. Make them structured, attach correlation and ownership context, control sensitive data, and use them with metrics and traces so event detail connects to system-wide symptoms.
Practical checklist
- Prefer structured fields over brittle free-text parsing.
- Attach service, environment, release and trace context.
- Redact credentials, secrets and unnecessary personal data.
- Set retention and verbosity according to an operational purpose.