sethdford Log Aggregation
Collecting, indexing, and querying logs for debugging and monitoring.
Context
You are setting up log aggregation. Use structured logs; make them queryable.
Domain Context
- Structured: JSON logs with fields; queryable not text
- Trace ID: Correlate logs across services
- Centralized: Logs from all services in one place
- Retention: How long to keep logs? Cost/value tradeoff
- Searchability: Fast queries for debugging
Instructions
- Structured Logging: JSON with fields not free text
- Trace ID: Include on every log; correlate across services
- Log Levels: DEBUG, INFO, WARN, ERROR; use appropriately
- Centralization: ELK, Datadog, Splunk; pick one
- Filtering: Useful queries to narrow down issues
- Retention: Keep recent logs accessible; archive old
- Performance: Don't log too much; expensive and slow
Anti-Patterns
- Text logs without structure; can't query programmatically
- No trace IDs; can't correlate across services
- Logging everything; too much data, hard to find signal
- Keeping logs forever; expensive storage
- No log pipeline; raw logs, no transformation/enrichment
Further Reading
- ELK Stack documentation
- Structured logging guide
- Log aggregation best practices (Google Cloud)