Hat of Log Consumer Has Reduced Working Memory
One of important principles of logging is to put on a the hat of the Log Consumer.
The hat of the log consumer is going to be worn at times by someone in the middle of night, decently exhausted, trying to figure why something is not working. Hence, we have to design logs to be consumable by someone who is NOT FRESH. Performance optimizations like collapsing fields names should be taken on with EXTREME care and generally should be avoided.
For example ll/llevel may be obvious as log_level while you are writing the log handling but it will NOT be obvious by looking only at the schema of the logs without their values for the log consumer at midnight. This sort of optimizations spreads into operational tooling making it much more obscure.
For example, without context you could get a sense what this line means right away:
| jq.sort_by log_level
But without having context loaded into your working memory, you would have to dig deeper to find out what the following means:
| jq.sort_by ll
So we very much have to keep Cognitive Load in mind when creating log format as the log consumer at midnight is not going to have much to spare.
Backlinks