Loading...
The written record of what your systems did, and one of the sneakiest line items on the bill.
Quick Definition
Logging is the practice of recording events as software runs: requests handled, errors thrown, decisions made, and changes applied. Logs are the primary evidence when something breaks, the raw material for security and compliance audits, and one of the three pillars of observability alongside metrics and traces. They are also a significant and frequently underestimated cost, because every log line is written, shipped, indexed, stored, and queried, and each of those steps is billed.
Logging is the practice of recording events as software runs: requests handled, errors thrown, decisions made. Logs are the primary evidence when something breaks, the raw material for audits, and one third of the observability triad alongside metrics and traces.
Logs are also a notorious cost trap. Every log line is written, shipped, indexed, stored, and eventually queried, and each step bills. Verbose debug logging left on in production, logs retained for years by default, and high-cardinality noise nobody reads can push logging platforms into a company's top five cloud expenses without anyone deciding that should happen.
Example. A team discovers one chatty service produces 40 percent of total log volume, mostly a debug line firing on every request. One configuration change cuts the monthly observability bill by thousands.
The disciplines are sampling, log levels enforced in production, retention tiers that move old logs to cheap storage, and regular top-talker reviews. The monitoring tools roundup and the Datadog pricing guide explain where logging charges come from.
Keep logs hot and searchable for days to weeks, which covers almost all debugging, then move them to cheap archive storage for whatever your compliance obligations require. The expensive default is keeping everything searchable indefinitely, because indexed retention is priced far above archive storage. A common pattern is 7 to 30 days searchable, then archive for 1 to 7 years depending on the regulation.
Log sampling means keeping a representative fraction of high-volume, low-value log lines rather than all of them, for example one in every hundred routine success messages, while retaining 100 percent of errors and warnings. It cuts volume sharply with little loss of diagnostic value, because the thousandth identical success line tells you nothing the first did not.
Almost always because a small number of services produce most of the volume. The usual causes are debug-level logging left enabled in production, high-cardinality fields that explode the index, and retention set once at a long default and never revisited. Find the top talkers first, fix log levels and noisy lines, then tier retention, in that order, because the first step typically delivers most of the saving.
The standard levels, from least to most severe, are TRACE, DEBUG, INFO, WARN, ERROR, and FATAL. TRACE and DEBUG are detailed developer diagnostics, INFO records normal operation, WARN flags something unexpected but survivable, and ERROR and FATAL mark failures. Production systems normally run at INFO or WARN; leaving DEBUG enabled in production is one of the most common causes of runaway logging costs.
Logs are discrete, timestamped records of individual events, so they tell you exactly what happened. Metrics are numeric measurements aggregated over time, such as request rate or error percentage, so they tell you how the system is behaving overall. Traces follow a single request across multiple services, so they tell you where time was spent. Together they form the three pillars of observability, and each is priced differently, with logs usually the most expensive at volume.