Log Schema Consistency
Enforcing the same field names, types and semantics for structured log records across every service, so cross-service queries are possible.
Structured logging is only useful if the structure is the same everywhere. A service logging
user_id, another logging userId and a third logging uid cannot be queried together — which defeats
the purpose, since the questions worth asking during an incident span services.
Retrofitting consistency is expensive: every service must change, and historical data stays inconsistent, so queries need a compatibility layer indefinitely. The cost of getting this right is near zero on day one and substantial later, which makes it a platform decision rather than a per-team one.
What to standardise: the baseline fields on every record (timestamp, level, service, version,
environment, trace ID, span ID), the names and types of common domain identifiers, and the
semantics — duration_ms always in milliseconds, timestamps always in UTC and ISO 8601.
Adopting OpenTelemetry semantic conventions is usually better than inventing a house standard: they are already defined, tooling understands them, and there is no internal negotiation.
Enforcement that works: a shared logging library that emits the baseline automatically and validates field names, so consistency is the default rather than a rule people must remember. Documentation alone does not achieve this.