Software Devs Picked These 2 Log Formats

It’s 3 AM. You’re staring at a wall of logs, and every second counts. With clean, structured logs, finding the issue becomes more than a guess—it’s a direct line to the answer.

In 2024’s cloud-native world of microservices, containers, and serverless functions, the right log format gives you clarity. It’s not just data. It’s a roadmap to faster solutions.

The Top 2 Logging Formats

JSON: The Swiss Army Knife of Logs

JSON came on the scene in the early 2000s and never left. Elasticsearchadopted it, making JSON the backbone of the ELK Stack. Today, AWS CloudWatch, Splunk, and Datadog rely on JSON because it’s structured, searchable, and universal.

Read by: AWS CloudWatch, Elasticsearch, Google Cloud Logging, Grafana Loki, Graylog, Logstash, Splunk

Exported by: Elasticsearch, Fluent Bit, Go Zap, Graylog, Java Log4j2, Java Logback, Java SLF4J, Logstash, Python Loguru, Python Structlog, Python logging, Splunk

Example:

{
  "timestamp": "2024-11-03T12:34:56Z",
  "level": "INFO",
  "message": "User login successful",
  "userId": 123,
  "sessionId": "abc123"
}

logfmt: Stripped-Down Speed

Introduced by Heroku and picked up by Papertrail, logfmt became the go-to for fast, high-volume logs. Kubernetes, Docker, and microservices architectures swear by it. It’s efficient and straight to the point.

Read by: Datadog, Fluent Bit, Grafana Loki, LogDNA, Logstash, Papertrail

Exported by: Fluent Bit, Grafana Loki, Go Logrus, Logstash

Example:

timestamp=2024-11-03T12:34:56Z level=INFO message="User login successful" userId=123 sessionId=abc123

The Old Guard

Common Log Format (CLF): The Veteran

Apache set the standard for CLF back in the ‘90s. Today, it’s still logging web traffic for hundreds of millions of sites.

Read by: AWS CloudWatch, Google Cloud Logging, Graylog, Logstash, Splunk

Exported by: Apache, Fluent Bit, Logstash, NGINX

Example:

127.0.0.1 - - [03/Nov/2024:12:34:56 +0000] "GET /index.html HTTP/1.1" 200 1024

Combined Log Format

A step beyond CLF, the Combined Log Format captures more detail, such as referrer and user agent, making it popular with web servers.

Read by: Datadog, Google Cloud Logging, Graylog, Logstash, Splunk

Exported by: Apache, Fluent Bit, Logstash, NGINX

Example:

127.0.0.1 - - [03/Nov/2024:12:34:56 +0000] "GET /index.html HTTP/1.1" 200 1024 "http://example.com" "Mozilla/5.0"

Plain Text: The Original

Plain text logs have been around forever. They’re still widely used for network devices and Unix systems, handling everything from rsyslog to syslog-ng.

Read by: AWS CloudWatch, Elasticsearch, Fluent Bit, Google Cloud Logging, Graylog, Logstash, Splunk

Exported by: Fluent Bit, Go Zap, Java Logback, Logstash, Syslog-ng, rsyslog, Python logging

Example:

[2024-11-03 12:34:56] INFO: User login successful (UserID: 123, SessionID: abc123)

Syslog

The Syslog Protocol has been around for decades, ideal for system and network logs. It’s widely supported and remains the standard for many infrastructure logs.

Read by: AWS CloudWatch, Grafana Loki, Graylog, Logstash, Splunk, Syslog-ng, rsyslog

Exported by: Fluent Bit, Java Logback, Logstash, Syslog-ng, rsyslog, Python logging

Example:

<134>1 2024-11-03T12:34:56Z hostname appname 1234 - - User login successful

Journald: The Linux Workhorse

Journald entered the scene with systemd in 2011, and today most Linux distributions depend on it for system-level observability.

Read by: Fluent Bit, Grafana Loki, Graylog, Journalctl, Splunk

Exported by: Fluent Bit, systemd (Linux)

Example:

Nov 03 12:34:56 hostname appname[1234]: User login successful

Patterns for Success

Teams that log right deliver solutions faster. Investing in a structured format is an investment in your system’s future.

What the Best Use

• Netflix loves JSON for its ELK stack, ideal for tracing issues in real time.

• Google Cloud standardizes on JSON for uniform insights across their services.

• GitHub relies on logfmt for speed, with JSON for deeper analysis.

• Cloudflare structures logs to keep global observability sharp.

• Shopify uses logfmt to drive performance in their container-based setup.

Want More?

About the Author: Mike Vincent is an American software engineer who’s scaled logging systems handling billions of events daily. He’s the author of many articles on tech leadership and helps Fortune 500s build rock-solid logging strategies. Follow Mike for practical insights on modern infrastructure and AI engineering.

Connect with Mike:
🔗 linkedin.com/in/michael-thomas-vincent

Disclaimer: This material has been prepared for informational purposes only, and is not intended to provide, and should not be relied on for business, tax, legal, or accounting advice.