What is structured logging and why is it preferred over plain-text logs?

Structured logging is the practice of emitting log records as machine-parseable data — typically JSON — rather than free-form text strings. Each log entry is a document with well-defined fields: timestamp, level, message, service, trace_id, user_id, and any other contextual fields relevant to the operation.

Plain-text logs look like: 2024-01-15 10:32:01 ERROR Failed to connect to DB after 3 retries. To extract the retry count, you write a fragile regex. Structured logs look like:

{"timestamp": "2024-01-15T10:32:01Z", "level": "ERROR", "event": "db_connect_failed", "retries": 3, "db_host": "postgres-primary", "trace_id": "abc123"}

The advantages are significant. Log aggregation systems (Elasticsearch, Loki, Splunk, CloudWatch Logs Insights) can index every field automatically, enabling fast, precise queries like level=ERROR AND retries > 2 AND db_host=postgres-primary without regex parsing. You can correlate logs with traces using trace_id directly. You can build metrics from log field counts without parsing.

In Java, libraries like Logback with Logstash encoder, Log4j2 with JSON layout, or SLF4J with structured argument APIs make structured logging straightforward. In Python, structlog or the standard logging module with a JSON formatter achieve the same result.