Re:The Art of Logging
by systemvoltage on Wednesday October 05, 2022 @09:37PM
(#33103326)
Stick with JSON. Just slightly less readable than logfmt but highly ubiquitous adaptation and parsing capabilities.
logfmt might be fine for people at Stripe who've built infra around it, but for mortals, stick with JSON so you can send data around.
When you have a million log lines, the question "Did it parse correctly?" shouldn't need to be asked because checking correctness is a huge problem.
It's quite nice at first glance. My main qualm with it is that there is no formal spec and I got bitten a few times by incompatibilities between emitters and parsers especially around quoted values.
(In particular we had a rust binary emitting badly escaped values such that fluentbit emitted structured logs with thousands of fields which in turn caused graylog to explode which was particularly gnarly because at the same time we had a production incident we had to troubleshoot without historical logs)