What Is a Log? Event Records in Observability Explained
A log is a timestamped record of a discrete event that happened in a system, written so a human or machine can reconstruct what occurred later.
Logs are the oldest and most intuitive observability signal: a running narrative of what a program did. Where metrics aggregate and traces follow a request, logs capture individual moments in full detail. That detail makes them invaluable for investigation and expensive to store at scale.
What a log entry contains
A log line typically carries a timestamp, a severity level such as info, warn, or error, and a message, often with extra fields giving context like a request ID or component name. Together, a stream of log lines tells the story of what a system was doing at a given moment.
Severity levels
Levels let you filter signal from noise. Debug and info describe normal operation; warn flags something suspicious; error and fatal mark real problems. Setting the right level per environment, verbose in development, quieter in production, keeps logs useful without drowning storage.
Structured vs unstructured logs
An unstructured log is free-form text, easy to write but hard to query. A structured log is emitted as key-value data, typically JSON, so fields can be filtered and aggregated by machines. Structured logging is the modern default precisely because it turns logs into something you can search and analyze, not just read.
Logs in CI/CD
Build logs are the first thing anyone reads when a job fails, and they are the rawest form of pipeline observability. When CI steps emit structured logs and you ship them to a central store, you can search across runs, count error patterns, and spot a failure that recurs across many builds rather than re-reading one job at a time.
Cost and retention
Logs are detailed, which makes them voluminous and costly to keep. Teams manage this with sampling, with shorter retention for low-value logs, and by promoting frequently queried fields into metrics. The goal is to keep enough detail to investigate without paying to store everything forever.
Key takeaways
- A log is a timestamped, detailed record of a single event.
- Severity levels separate routine activity from real problems.
- Structured logs are queryable; unstructured logs are just text.
- Build logs are the rawest form of pipeline observability.