Log Level Formatter

Structured logging means writing log entries as machine-readable JSON objects instead of plain strings. Each field (timestamp, level, message, requestId, userId) is a separate key, making it easy to query, filter, and alert on specific values in tools like Elasticsearch, Datadog, or CloudWatch.

Most logging frameworks use: TRACE (most verbose, diagnostic), DEBUG (development detail), INFO (normal operation), WARN (unexpected but recoverable), ERROR (failure requiring attention), FATAL/CRITICAL (system-level failure). Higher severity levels should be sparse in production logs.

Timestamps let you correlate events across services and understand the sequence of operations. Always log in UTC ISO 8601 format (2024-01-15T10:30:45.123Z). Local timestamps cause timezone confusion when debugging across teams or regions.

A trace ID (or requestId, correlationId) is a unique identifier generated at the start of a request and propagated through all services and functions that handle that request. It lets you find all log entries for a specific user action across distributed systems.

Pino outputs JSON by default. For Winston: use format.json() as the format option. For pino with pretty printing in dev, use pino-pretty as a transport. In production, always output raw JSON and let your log aggregation platform handle formatting and filtering.