ADR 9: Use JSON for structured logging

Status

accepted

Context

The effort to implement log aggregation requires consistency in field enrichment to allow for cross-service log tracing. The log format must be simple for common log platforms to intake.

Decision

Most log platforms with structured logging support JSON to avoid the need for a custom parser

Datadog automatically parses JSON-formatted logs. For other formats, Datadog allows you to enrich your logs with the help of Grok Parser.

Formatting

The preference is for a compact serializer such as Serilog.Formatting.Compact.CompactJsonFormatter.

Consequences

What becomes easier or more difficult to do because of this change? - Enrichment additions (new fields) are simple to handle due to the kvp nature of JSON logs - Log aggregators support structured logging via JSON - Parsing is trivial vs plain text - When using SQL tables as a log sink with plain text, new columns need to be added to the table to support enrichment. With JSON, the properties may be formatted from the log body.