ทำความเข้าใจรูปแบบล็อกสมัยใหม่

Imagine your application as a busy worker. How do you know what it's doing? That's where logs come in!

Logs are like a diary for your software. They record events, operations, and status messages as your application runs. They tell you:

• When something happened
• What action was performed
• If an error occurred

These records are crucial for debugging, monitoring performance, and understanding system behavior.

Historically, logs were often simple lines of text. Each event was written as a human-readable string.

For example, a login event might look like this:

This format is straightforward and easy for a human to read when looking at a few lines.

While plain text logs are human-friendly at a glance, they pose a big challenge for computers.

To find all logins from 'alice' or count errors from a specific IP address, a machine would need to:

• Guess the date format
• Extract the log level ('INFO')
• Parse the username ('alice')
• Identify the IP address

This process, called parsing, is complex and prone to errors because there's no fixed structure.

This is where structured logging comes to the rescue! It's a modern approach that outputs log data in a consistent, machine-readable format.

Instead of free-form text, each log entry is an object with clearly defined fields (like 'timestamp', 'level', 'user_id', 'message').

Think of it like organizing your notes into a spreadsheet instead of a jumbled notebook. Each piece of information has its own column.

The most popular format for structured logging today is JSON (JavaScript Object Notation).

JSON is lightweight, human-readable, and incredibly easy for machines to parse. It represents data as key-value pairs.

Here's how our 'alice' login event might look as a JSON log:

Using structured formats like JSON unlocks powerful capabilities:

• Easier Machine Parsing: Computers can directly read and understand each data field.
• Efficient Searching: Quickly find logs where user="alice" or level="ERROR".
• Better Analysis: Aggregate data, count events, and build dashboards based on specific fields.
• No More Guessing: No need for complex regular expressions to extract data, reducing errors.

This transforms logs from simple text files into rich, queryable data.

Here's a simple Java example demonstrating how you might output a structured log in JSON format. In real applications, you'd use a logging library to handle this.

Try running it to see the structured output!

Let's break down the JSON log from the previous example:

• Each piece of information is a key-value pair.
• "timestamp" is the key, "2023-10-27T10:30:00Z" is its value.
• "level" is the key, "INFO" is its value.

This explicit labeling makes every detail instantly accessible to machines.

While you can add any relevant data, some fields are commonly found and highly useful in structured logs:

• timestamp: The exact time the event occurred (often in ISO 8601 format).
• level: The severity of the log (e.g., DEBUG, INFO, WARN, ERROR, FATAL).
• message: A human-readable description of the event.
• service: The name of the application or service generating the log.
• transaction_id: A unique ID to link related events across different services.
• user_id: The ID of the user involved in the event.

Congratulations! You've taken a crucial step in understanding modern application logging.

• We saw that traditional plain text logs are simple but hard for computers to analyze.
• Structured logging provides a consistent, machine-readable format for log data.
• JSON is the most popular structured format, using key-value pairs.
• Structured logs enable powerful searching, filtering, and automated analysis, making your logs far more valuable.

Next, we'll explore how these structured logs are collected and managed in centralized systems!