Backend logging is the systematic recording of events, errors, and state changes within server-side applications to enable debugging, monitoring, and security compliance. In distributed systems, effective logging transforms raw event streams into actionable insights, balancing verbosity with cost through sampling, aggregation, and structured formats. Always log in UTC, use structured JSON, and treat correlation IDs as non-negotiable — these foundational decisions determine whether your logs serve production debugging or drown engineers in noise.
What This Cheat Sheet Covers
This topic spans 21 focused tables and 130 indexed concepts, 129 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Structured Logging Formats
How you serialize a log line decides how easily a machine can parse it later. JSON has become the default for centralized systems, but plenty of older infrastructure still speaks Syslog or one of its variants — knowing the trade-offs between structure, byte limits, and human readability helps you pick a format your aggregation stack can actually query.
| Format | Example | Description | |
|---|---|---|---|
{"timestamp":"2026-05-16T14:30:00Z", "level":"ERROR","service":"api", "correlationId":"abc-123","message":"Auth failed"} | • Key-value pairs enabling efficient parsing and querying • industry standard for centralized log systems | ||
<134>1 2026-05-16T14:30:00Z app-1 api - ID47 [user="john"] Auth failed | • Modern syslog format with structured data and metadata fields • supports custom key-value extensions | ||
<134>May 16 14:30:00 app-1 api: Auth failed | • Legacy plaintext syslog format • limited to 1024 bytes • widely supported but lacks structure | ||
192.168.1.1 - john [16/May/2026:14:30:00 +0000] "GET /api HTTP/1.1" 401 256 | • HTTP access log format • space-delimited fields • standard for web servers but not easily parseable | ||
{"version":"1.1","host":"api-1", "short_message":"Auth failed","level":3, "_user_id":123} | • Designed for avoiding syslog limitations • supports chunking, compression, and arbitrary fields | ||
ts=2026-05-16T14:30:00Z level=error service=api msg="Auth failed" | • Lightweight space-separated key=value format • human-readable and machine-parseable with minimal overhead |