Going back to plain-text logs
I switched a couple of long-running services from JSON logs to plain, one-line-per-event text and I'm not going back. This is a note on why, mostly so I stop relitigating it with myself.
Where structured logs earn their keep
If you have a fleet, an ingestion pipeline and people who query logs by field, structure is non-negotiable. Nobody wants to write a regex for a timestamp at three in the morning.
Where they don't
A single box with three services and one person reading the output is a different world. There the reader is journalctl -u name -f and a pair of eyes, and the cost of JSON is paid on every line: quoting, escaping, and the key names crowding out the message. The thing I'm looking for is usually a request id and a verb, and grep finds those either way.
2026-06-02T14:11:07Z info req=8f31 GET /api/items 200 12ms
2026-06-02T14:11:08Z warn req=8f32 upstream retry attempt=2 backoff=400msThat is still structured — the fields are key=value — but it reads top to bottom without a viewer. If I ever need to ship these somewhere, a five-line parser gets them back into JSON.
Rule I settled on
Emit key=value text by default. Emit JSON when a machine is the primary reader. Never emit both.