Don't Panic — Logging Fundamentals

A log is a record of an event, which is less mystical than it sounds and more useful than a folder full of apologetic text files. A completed request, failed sign-in, or configuration change happens; a source writes down selected evidence; later, someone asks the evidence what occurred. The record is not the event. This distinction matters because a missing line can mean no event, or it can mean a buffer filled, a parser objected, a network wandered away, or a receiver discarded the message. Computers are capable of all of these before lunch.

The main trick is structured logging: put reusable context in named fields instead of burying it in prose. A concise body says what happened. Fields say when, where, how serious, and which operation connects the occurrence to other work. A resource identifies the producing application, host, device, or component. Attributes hold details for that occurrence. Stable field names and value types are the small amount of order that lets a search work across services instead of becoming an archaeological expedition into punctuation.

A record then takes the long route: source, collector, processing, transport, backend, query, retention or deletion. That is the pipeline, and each station can change reliability, cost, or meaning. Severity is useful for routing attention, but it is not an internationally binding truth handed down on a stone tablet. Teams define what their levels mean. Add the failed operation and affected component, or an error label merely announces that somewhere, something has become unhappy.

Logs also do not have to answer every question. A metric summarizes numeric behavior over time. A trace follows a request through components. Logs describe individual events. A trace ID and span ID can connect a record to that request path, but correlation cannot repair a record with no useful timestamp, source, body, or attributes. Nor should a log become a souvenir shop for passwords, access tokens, encryption keys, session identifiers, or sensitive personal data. Evidence that creates a new incident has misunderstood its assignment.

Start with the Intro for the model and the pipeline. Use Slides for the relationships among logs, metrics, traces, severity, and retention. Keep the Cheatsheet nearby when choosing fields or testing failure behavior. Then use the practice reference and exercise to make a known test record travel from emission to retrieval. That is where logging stops being writing and starts being evidence.