Schema first
Define your log schema once: timestamp, level, service, trace_id, user_id, message, attributes. Every service logs the same shape. Don't let teams invent fields ad-hoc — you'll regret it when the SIEM ingests inconsistent data.
Advertisement
Trace correlation
Every log line includes trace_id and span_id from OTel context. In Loki/Datadog/Splunk, you can click a log → see the full trace, or click a trace span → see all logs for that span. This bidirectional pivot is the unlock for incident debugging.
Advertisement
PII scrubbing
Email, SSN, credit card, phone, IP — these MUST NOT land in logs unredacted. Use a logging middleware that scrubs known field names BEFORE serialization. Periodically audit your log streams with a PII scanner (e.g., AWS Macie, GCP DLP) for what slipped through.