When you have full control over your logging format we recommend human readable key-value pairs whenever possible. JSON and XML are also acceptable, though XML is harder to read and parse than JSON.
Whatever you use follow these rules:
- Use key-value pairs in a regular, defined format such as
key=value,so they're easy to parse. - Start logs with a regular, well-defined timestamp, ideally including a time zone. See timestamp considerations and supported formats for details.
- Start logs with a regular format to make automatically detecting message boundaries easier. See collecting multiline logs for details.
For example, from our own production logs, we use the following:
2012-08-16 13:39:36,979 [metrics] INFO com.sumologic.util.Reporter - com.sumologic.util.scala.Aggregator.Buffer[/usr/sumo/stream-19.5-3/logs/stream.log]-Size-Meter (bytes/s) count=78847, fifteenMinuteRate=0.26, fiveMinuteRate=0.11, oneMinuteRate=0.00, meanRate=1.06
This is a key-value pair log, which is easy to parse and easy to read in Sumo.