--- title: How to structure a log | daily.dev description: A practical, opinionated guide to writing structured logs that are queryable, filterable, and consistent. Covers naming log events with a domain.action pattern... canonical: https://daily.dev/posts/how-to-structure-a-log-psj5teef9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to structure a log | daily.dev og:description: A practical, opinionated guide to writing structured logs that are queryable, filterable, and consistent. Covers naming log events with a domain.action pattern... og:url: https://daily.dev/posts/how-to-structure-a-log-psj5teef9 og:image: https://api.daily.dev/og/posts/psj5TEEf9.png og:image:alt: How to structure a log og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to structure a log **[Sentry Engineering](https://daily.dev/sources/sentry)** · 12 min read · 1 upvotes · 0 comments ## Summary A practical, opinionated guide to writing structured logs that are queryable, filterable, and consistent. Covers naming log events with a domain.action pattern using snake_case, using flat dot-notation attribute keys instead of nested objects, keeping attribute values as primitives, and enforcing these conventions with a custom ESLint plugin. Also discusses using logging library context scopes for shared attributes, avoiding timing data in logs (use spans instead), and leveraging AI agents to audit log schemas beyond what linters can catch. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How should I structure event names in structured logging? Use a stable, predictable domain.action pattern in snake_case, such as auth.login, payment.capture, webhook.delivery, or cart.checkout. The domain represents the closest context object associated with the event, and the action describes what happened. Dynamic values like usernames or IDs should never appear in the event name itself, only in attributes, so the event name stays low-cardinality and easy to query. _daily.dev surfaces practical guides like this for developers standardizing their logging conventions._ ### Why should I avoid nested objects in log attributes and use flat dot-notation keys instead? Flat, scoped keys like payment.failure.reason_code are directly addressable and immediately searchable by a logging backend without further parsing, whereas nested objects vary across code paths and are harder to query, group, or alert on. Attribute values should be limited to primitives (strings, numbers, booleans) or arrays of primitives, since arrays of objects can bloat log size while remaining hard to search. _teams choosing a logging schema can compare structured logging approaches through daily.dev._ ### Should I log timing or duration data directly on log events? No, timing and duration data should be avoided on log events and instead placed on tracing spans, since tracing is the proper domain for timing operations. In Sentry specifically, logs are trace-connected, so logs can still be correlated with the spans that measure duration, avoiding the need for manual timing fields inside the log event itself. _developers deciding where timing data belongs in their observability stack can track these patterns via daily.dev._ ## Similar posts on daily.dev - [A Software Engineer’s Guide to Observability: Part 1 - Logging](https://daily.dev/posts/a-software-engineer-s-guide-to-observability-part-1---logging-vvaaf97d2) · Blueground Engineering · 3 upvotes · 0 comments - [When and what should I be logging?](https://daily.dev/posts/when-and-what-should-i-be-logging--muc9vc2tm) · Sentry Engineering · 0 upvotes · 0 comments - [Your Logs Are Lying To You](https://daily.dev/posts/your-logs-are-lying-to-you-eq23czgvl) · Hacker News · 156 upvotes · 3 comments --- Tags: [#javascript](https://daily.dev/tags/javascript), [#typescript](https://daily.dev/tags/typescript), [#observability](https://daily.dev/tags/observability) [View this post on daily.dev](https://daily.dev/posts/how-to-structure-a-log-psj5teef9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to structure a log","url":"https://daily.dev/posts/how-to-structure-a-log-psj5teef9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-structure-a-log-psj5teef9"},"datePublished":"2026-07-21T15:44:50.271Z","dateModified":"2026-09-14T07:38:53.152Z","description":"A practical, opinionated guide to writing structured logs that are queryable, filterable, and consistent. Covers naming log events with a domain.action pattern...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/58721ffb83a6797b7de4ac42a8fdc4dc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/58721ffb83a6797b7de4ac42a8fdc4dc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sentry Engineering","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sentry Engineering","logo":"https://media.daily.dev/image/upload/s--qqXwMThM--/f_auto/v1710505439/logos/sentry","url":"https://daily.dev/sources/sentry"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-structure-a-log-psj5teef9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"javascript,typescript,observability","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sentry Engineering","item":"https://daily.dev/sources/sentry"},{"@type":"ListItem","position":3,"name":"How to structure a log"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-structure-a-log-psj5teef9#faq","mainEntity":[{"@type":"Question","name":"How should I structure event names in structured logging?","acceptedAnswer":{"@type":"Answer","text":"Use a stable, predictable domain.action pattern in snake_case, such as auth.login, payment.capture, webhook.delivery, or cart.checkout. The domain represents the closest context object associated with the event, and the action describes what happened. Dynamic values like usernames or IDs should never appear in the event name itself, only in attributes, so the event name stays low-cardinality and easy to query. daily.dev surfaces practical guides like this for developers standardizing their logging conventions."}},{"@type":"Question","name":"Why should I avoid nested objects in log attributes and use flat dot-notation keys instead?","acceptedAnswer":{"@type":"Answer","text":"Flat, scoped keys like payment.failure.reason_code are directly addressable and immediately searchable by a logging backend without further parsing, whereas nested objects vary across code paths and are harder to query, group, or alert on. Attribute values should be limited to primitives (strings, numbers, booleans) or arrays of primitives, since arrays of objects can bloat log size while remaining hard to search. teams choosing a logging schema can compare structured logging approaches through daily.dev."}},{"@type":"Question","name":"Should I log timing or duration data directly on log events?","acceptedAnswer":{"@type":"Answer","text":"No, timing and duration data should be avoided on log events and instead placed on tracing spans, since tracing is the proper domain for timing operations. In Sentry specifically, logs are trace-connected, so logs can still be correlated with the spans that measure duration, avoiding the need for manual timing fields inside the log event itself. developers deciding where timing data belongs in their observability stack can track these patterns via daily.dev."}}]} ```