What is structured logging and why is it preferred over plain text logs?

Summary

Structured logging emits each log event as machine-readable key-value data (usually JSON) instead of free-form text, so logs can be filtered, aggregated and queried reliably.

Longer Answer

A plain line like User 42 failed login from 1.2.3.4 must be parsed with fragile regexes. A structured event {"event":"login_failed","user_id":42,"ip":"1.2.3.4","level":"warn"} can be queried directly (event=login_failed AND ip=...), aggregated into counts, and enriched automatically with request IDs, service name, version and environment.

Most languages have structured loggers: Pino (Node), structlog/python-json-logger (Python), Monolog with JSON formatter (PHP), Logback with JSON encoders (Java). Keep a stable schema (consistent field names) across services.

Code Example

{"ts":"2026-10-10T09:15:02Z","level":"warn","service":"checkout","version":"1.8.2",
 "event":"payment_declined","order_id":"ord_123","user_id":42,"reason":"insufficient_funds",
 "trace_id":"4bf92f3577b34da6a3ce929d0e0e4736","duration_ms":182}

Key Points

• JSON key-value events
• Queryable and aggregatable
• Consistent field names across services
• Automatic context enrichment (request ID, service, version)

Common mistakes

• Interpolating values into the message instead of using fields
• Different field names for the same thing in each service