Logs are for questions you’ll ask later
The test for any log line is whether it helps answer a question during an incident. Lines that exist because someone was debugging in 2023 are noise, and noise makes the useful lines harder to find precisely when it matters.
Record decisions, not just events
“Order updated” tells you nothing; who or what changed it, from what to what, and on what basis tells you everything. This is the same distinction that makes a system ready for AI features later.
Log what you’d need to reconstruct the decision. Everything else is storage costs.
Include a correlation identifier
One identifier following a request across services is the difference between reconstructing an incident in minutes and never fully reconstructing it. It is trivial to add at the start and painful to retrofit.
What to leave out
Credentials, tokens, full payment details, and personal data beyond what an investigation genuinely needs. Logs are copied, shipped to third parties, and retained longer than anyone intends — treat them as a place data escapes, the same concern as what a retrieval layer can reach.
Distinguish failure from noise
If everything is an error, nothing is. Reserve error level for things a human should act on, and make sure those reach somewhere a human actually looks — otherwise you have failures that are invisible with extra steps.
Set retention on purpose
Decide how long each category is kept, based on what you would investigate and what you are obliged to hold. Indefinite retention is a decision too — usually the wrong one, and always the most expensive.