Is structured logging worth it for a small app?

Yes, because the cost is nearly zero and retrofitting is painful. Every mainstream language has a JSON logging library, so structure costs you a dependency and a habit. The payoff arrives the first time you need to count errors by type or follow one request across two services, which happens well before you consider yourself at scale.

Won't sampling make me miss the one log line that explains an incident?

Not if you sample by outcome. Keep 100 percent of errors and slow requests and sample only routine successes, which are statistically interchangeable. The riskier gap is dropping lines under load because your pipeline has no buffer, which loses data exactly when you need it and without any policy behind the loss.

How long should I keep logs?

Match tiers to how logs are used. Almost all searches hit the last day or two, so keep 7 to 14 days hot, a month or three warm and cheaper, and archive to object storage for whatever your compliance rules demand, often a year. Keeping everything hot forever is the most common and least examined observability expense.

Observabilitychapter 1 of 4 · 4 lessons

Logging

Record discrete events to answer 'what happened and when' during incidents.

← All chapters View in cheatsheet

A customer emails: my payment failed at about half past two yesterday, order 8812.

You open your logs and search. There are 40 million lines from yesterday, and the one you want says payment failed for user after retry, with no order number, no error code and no way to tell which of the 900 payment failures that afternoon was theirs.

The line was written for a human reading one line. Nobody reads one line.

Logs are still the signal you reach for when you need to know exactly what happened to one specific request at 14:32 last Tuesday, and whether that is possible was decided long before the incident, by how the lines were written.

Lessons

4 in this chapter

Structured LoggingLog JSON with named fields, not prose, so a machine can answer questions during an incident.3 min
The Log PipelineFrom stdout to a search box: agents, buffers, and indexers, and where each one falls over.2 min
Sampling and CostLog volume grows with traffic, the bill grows with volume, and sampling is how you stay solvent.2 min
What to Log, and What Never to LogLevels with teeth, context that answers questions, and zero secrets or PII.3 min