Log Level Discipline
Consistent semantics for log severity so that levels can be used for routing, alerting and cost control.
Levels are only useful if they mean the same thing everywhere. The workable definitions:
ERROR — something failed that requires attention. If nobody will act, it is not an ERROR. This is the level that gets abused most, and once ERROR is noisy it cannot be alerted on.
WARN — something unexpected that the system handled. A retry succeeded, a fallback was used, a deprecated path was taken.
INFO — significant business events: a request completed, an order was placed. The default production level.
DEBUG — detail useful during investigation, normally disabled and enabled selectively.
Two practices make levels pay for themselves. Dynamic level adjustment — raising a service or module to DEBUG at runtime without a deployment — turns debugging from a redeploy cycle into a configuration change, and is one of the highest-value pieces of logging infrastructure.
Sampling of high-volume INFO with full retention of ERROR and WARN, which typically removes most of the cost while keeping everything that matters. Logging is one of the largest observability line items, and it is dominated by successful-request records that nobody reads.