One event, one line, machine-readable
A timestamp, a level, a message and a context object. The moment logs are queryable, questions like "how often does this fail for this customer" take seconds instead of an afternoon.
Correlate with a request id
Attach a single identifier to every line produced by one request. Without it, tracing a failure across several services is guesswork.
Never log secrets
Passwords, tokens, card numbers and full request bodies. Logs are copied, shipped and retained far more widely than the database, and protected far less carefully.
