Structured Logging

The difference is queryability. A line like Order 123 failed for user 456 can only be grepped. The same event as {"event":"order_failed","order_id":123,"user_id":456,"trace_id":"...","reason":"payment_declined"} can be filtered, grouped and counted — "how many orders failed for payment_declined in the last hour, by region" becomes a query rather than an investigation.

The fields that should be on every line: timestamp, level, service, version, trace or correlation ID, and the event name. Everything else is context specific to the event.

Two disciplines that keep it useful. A stable event name per log type, so a query written today still works after somebody rewords the message. And no secrets or personal data — logs are widely readable, exported to third-party tooling, and retained far longer than anyone intends, so this is where regulated data most often escapes.