# Logs Are Not Free

> A log line is free to write and expensive at 3am. Levels, structure, cardinality, retention.

Source: https://christwentyfour.com/blog/logs-are-not-free

A log line is free to write. It is not free at 3am, when you search a hundred million of them. It is not free on the invoice either.

## Volume hurts search first

Slow queries get abandoned, and iteration is how you find causes. The worst case is a debug line in a hot path. It buries everything, and it looks harmless in review.

## Use the levels

- **Error**: a human should look eventually. If it fires constantly and nobody looks, it is not an error.
- **Warn**: the system handled something unexpected.
- **Info**: what the system did. This is the tier you will search.
- **Debug**: off in production, unless you turn it on briefly for one service.

## Use fields, not sentences

Three fields pay off right away: a request ID, the service and version, and your main domain key. Carry the request ID across services, and tracing a failure becomes a query.

## Watch cardinality

A unique value is fine in a log and dangerous as a metric label. A counter tagged with user ID makes one time series per user. My rule: if you cannot name the maximum number of values, it is unbounded, so it belongs in logs.

## Match retention to the question

Debugging needs detail for days. Audits need specific events for longer. Trends need aggregates. Tier by purpose.