What is structured logging and what metadata should be included?

• A. Unstructured free-form text logs.
• B. Logs with a defined schema; include timestamp, level, service, request/trace id, user id, and error codes.
• C. Only log errors and ignore info logs.
• D. Logs should never mention user identifiers.

Answer: (B)

Structured logging uses a defined, machine-readable schema so logs can be parsed, searched, and correlated across services. The metadata listed — timestamp, log level, service or component name, a request or trace identifier, a user identifier, and an error code — provides the essential context to understand what happened, where it happened, and who was involved, plus how severe the event was and how to categorize any failure.

This approach enables precise filtering, querying, and dashboarding. If you rely on free-form text, machines can’t reliably extract fields, making analysis slow and error-prone. Logging only errors removes valuable context about normal operation and helps nothing with tracing requests. And including user identifiers is often necessary for debugging, auditing, and security—privacy considerations aside—so the blanket rule that you should never include them isn’t appropriate.