ADR 9: Use JSON for structured logging¶
Status¶
accepted
Context¶
The effort to implement log aggregation requires consistency in field enrichment to allow for cross-service log tracing. The log format must be simple for common log platforms to intake.
Decision¶
Most log platforms with structured logging support JSON to avoid the need for a custom parser
Datadog automatically parses JSON-formatted logs. For other formats, Datadog allows you to enrich your logs with the help of Grok Parser.
Formatting¶
The preference is for a compact serializer such as Serilog.Formatting.Compact.CompactJsonFormatter
.
Consequences¶
What becomes easier or more difficult to do because of this change? - Enrichment additions (new fields) are simple to handle due to the kvp nature of JSON logs - Log aggregators support structured logging via JSON - Parsing is trivial vs plain text - When using SQL tables as a log sink with plain text, new columns need to be added to the table to support enrichment. With JSON, the properties may be formatted from the log body.