What Is Structured Logging
JSON Logs, Better Search, Safer PII Handling

# Matches: "User alice@example.com logged in successfully from 203.0.113.42"
grok {
  match => { "message" => "User %{EMAILADDRESS:email} logged in %{WORD} from %{IP:client_ip}" }
}

# The pattern above breaks silently the moment the message changes to:
# "User alice@example.com signed in from 203.0.113.42"  — "signed" ≠ "logged"
# "User alice@example.com login attempt from 203.0.113.42"  — "attempt" != match
# "alice@example.com logged in from 203.0.113.42"  — "User " prefix gone

# Each variation silently drops the event into _grokparsefailure.
# Your dashboard shows zero logins. Nobody notices for three days.

import structlog

structlog.configure(
    processors=[
        structlog.contextvars.merge_contextvars,    # merge request-scoped context
        structlog.stdlib.add_log_level,             # adds "level" field
        structlog.stdlib.add_logger_name,           # adds "logger" field
        structlog.processors.TimeStamper(fmt="iso"),# adds "timestamp" field
        structlog.processors.JSONRenderer(),        # renders to JSON string
    ],
    wrapper_class=structlog.make_filtering_bound_logger(20),  # INFO level
    context_class=dict,
    logger_factory=structlog.PrintLoggerFactory(),
)

log = structlog.get_logger()

# Basic event with key=value context fields
log.info("user.login", user_id=9182, action="login", success=True)

# Output:
{
  "level": "info",
  "timestamp": "2026-05-02T14:22:31.004Z",
  "logger": "structlog_setup",
  "event": "user.login",
  "user_id": 9182,
  "action": "login",
  "success": true
}

import uuid
import structlog
from structlog.contextvars import bind_contextvars, clear_contextvars

log = structlog.get_logger()

def handle_request(request):
    # Bind fields that should appear on EVERY log call in this request
    clear_contextvars()
    bind_contextvars(
        request_id=str(uuid.uuid4()),
        method=request.method,
        path=request.path,
    )

    # Every log call in this request automatically includes request_id etc.
    log.info("request.start")
    process(request)
    log.info("request.end", status=200, duration_ms=42)

# Output for request.end:
# {"event":"request.end","request_id":"a3f9...","method":"GET",
#  "path":"/api/users","status":200,"duration_ms":42,"level":"info"}

# Fields to strip before any event is written to the output sink
SENSITIVE_FIELDS = {"ip", "email", "user_email", "phone"}

def drop_sensitive(logger, method, event_dict):
    """structlog processor: remove sensitive keys from every event."""
    for field in SENSITIVE_FIELDS:
        event_dict.pop(field, None)
    return event_dict

structlog.configure(
    processors=[
        structlog.contextvars.merge_contextvars,
        drop_sensitive,                # <-- insert anywhere before the renderer
        structlog.stdlib.add_log_level,
        structlog.processors.TimeStamper(fmt="iso"),
        structlog.processors.JSONRenderer(),
    ],
    ...
)

# Now even if code calls:
#   log.info("user.login", user_id=9182, ip="203.0.113.42")
# the output will be:
# {"event":"user.login","user_id":9182,"level":"info","timestamp":"..."}
# The "ip" field is gone — without editing the log call site.

import pino from 'pino';

const logger = pino({
  level: 'info',
  // Redact sensitive fields before serialisation
  redact: {
    paths: ['user.email', 'req.headers.authorization'],
    censor: '[REDACTED]',
  },
});

// Object first = structured fields; string second = msg
logger.info({ userId: 9182, action: 'login', success: true }, 'User logged in');

// Output:
{
  "level": 30,
  "time": 1746187351004,
  "pid": 12345,
  "hostname": "app-01",
  "userId": 9182,
  "action": "login",
  "success": true,
  "msg": "User logged in"
}

import { randomUUID } from 'crypto';

function handleRequest(req, res) {
  // Child logger: every call on reqLog includes requestId automatically
  const reqLog = logger.child({ requestId: randomUUID(), path: req.url });

  reqLog.info('request.start');

  try {
    const result = processRequest(req);
    reqLog.info({ statusCode: 200, durationMs: 38 }, 'request.end');
    res.send(result);
  } catch (err) {
    reqLog.error({ err, statusCode: 500 }, 'request.error');
    res.status(500).send('Internal Server Error');
  }
}

// All three calls above produce JSON lines containing:
// "requestId": "a3f9c2d1-...", "path": "/api/users"
// — without you passing those values to each log call explicitly.

package main

import "go.uber.org/zap"

func main() {
    logger, _ := zap.NewProduction()
    defer logger.Sync()

    // Typed field constructors — no fmt.Sprintf, no interface{}
    logger.Info("user.login",
        zap.String("user_id", "9182"),
        zap.String("action", "login"),
        zap.Bool("success", true),
        zap.Int("attempt", 1),
    )
}

// Output:
{
  "level": "info",
  "ts": 1746187351.004,
  "caller": "main/main.go:12",
  "msg": "user.login",
  "user_id": "9182",
  "action": "login",
  "success": true,
  "attempt": 1
}

sugar := logger.Sugar()

// key-value pairs, alternating — still produces JSON
sugar.Infow("user.login",
    "user_id", "9182",
    "action", "login",
    "success", true,
)

// Named fields attached to every call from this logger instance
requestLogger := logger.With(
    zap.String("request_id", "a3f9c2d1"),
    zap.String("path", "/api/login"),
)
requestLogger.Info("request.start")
requestLogger.Info("request.end", zap.Int("status", 200), zap.Int("ms", 12))

import logging
import structlog

# Configure structlog to intercept stdlib logging calls
structlog.configure(
    processors=[
        structlog.contextvars.merge_contextvars,
        structlog.stdlib.filter_by_level,
        structlog.stdlib.add_logger_name,
        structlog.stdlib.add_log_level,
        structlog.stdlib.PositionalArgumentsFormatter(),
        structlog.processors.TimeStamper(fmt="iso"),
        structlog.processors.StackInfoRenderer(),
        structlog.processors.format_exc_info,
        structlog.processors.UnicodeDecoder(),
        structlog.processors.JSONRenderer(),
    ],
    wrapper_class=structlog.stdlib.BoundLogger,
    context_class=dict,
    logger_factory=structlog.stdlib.LoggerFactory(),
)

# Route all stdlib logging through structlog
logging.basicConfig(
    format="%(message)s",
    handlers=[logging.StreamHandler()],
    level=logging.INFO,
)

# Now existing code that calls:
#   import logging
#   logger = logging.getLogger(__name__)
#   logger.info("User %s logged in from %s", user_id, ip)
#
# automatically produces JSON output:
# {"event":"User 9182 logged in from 203.0.113.42","logger":"auth","level":"info","ts":"..."}

import express from 'express';
import pino from 'pino';
import pinoHttp from 'pino-http';

const logger = pino({ level: 'info' });
const app = express();

// One line adds structured request/response logging to every route
app.use(pinoHttp({ logger }));

app.get('/api/users/:id', (req, res) => {
    // req.log is a child logger pre-bound with request context
    req.log.info({ userId: req.params.id }, 'user.fetch');
    res.json({ id: req.params.id });
});

// pino-http automatically logs:
// {"level":30,"time":...,"req":{"method":"GET","url":"/api/users/9182","id":1},
//  "res":{"statusCode":200},"responseTime":4,"msg":"request completed"}