What to Log, and What to Leave Alone

Log everything, the advice goes, because you never know what you will need. Follow it and you get a bill that scales with traffic, a search that takes forty seconds, and a haystack that reliably contains the needle you cannot find. Volume is not the same as visibility.

The test: would you act on it?

For each line, ask what you would do differently if you saw it. If the honest answer is nothing, it is noise — and noise is not free. It costs storage, query time and, most expensively, the attention of whoever is scrolling past it during an incident.

Worth keeping

• Failures, with enough context to reproduce them.
• State transitions on anything involving money or permissions.
• External calls: what you sent, what came back, how long it took.
• Anything you have needed once during a post-mortem.

Usually not worth keeping

• Successful health checks, at full volume, forever.
• "Entering function" breadcrumbs left over from a debugging session.
• Whole request bodies on high-traffic endpoints — a fast way to log personal data you never meant to store.
• Anything you have never once searched for.

The useful move is to separate the two streams: logs for reconstructing what happened, and reports for the failures that need a decision. Conflating them is how both become useless.