Log Structured Enrichment
Log structured enrichment adds context — request ID, user, tenant, build version — to every log entry at emit time, so the log is queryable by context without parsing prose and joining.
Definition
Log structured enrichment is the practice of emitting logs as structured records with contextual fields added at the source — request ID, user ID, tenant, service, version — so that the log store can index and query by context directly, and a single log entry is self-locating without a join to a trace or a user table.
Context and scope
Applied in structured logging pipelines, observability platforms, and any system where logs must be filtered by context during incident diagnosis.
Common misconceptions
- Enrichment is just adding fields — it is adding the right fields at the source, where the context is in scope, rather than joining later when it is expensive
- Enrich every log with everything — over-enrichment bloats every record and the storage cost; enrich with the context the operator will query by
Anti-patterns
- Emitting prose logs and parsing them at ingest, so a format change breaks the parser and the context is lost
- Enriching with high-cardinality fields like user_id on every log, exploding the index and the storage
Related concepts
Authoritative source
What it is
Log structured enrichment is the practice of emitting logs as structured records with contextual fields added at the source — request ID, user ID, tenant, service, version — so that the log store can index and query by context directly, and a single log entry is self-locating without a join to a trace or a user table. Applied in structured logging pipelines, observability platforms, and any system where logs must be filtered by context during incident diagnosis. The goal is not to collect all data but to be able to answer the question you did not think to ask in advance — which requires high-cardinality labels and exemplars that link traces to the metric that triggered them.
How it works
Three signals compose: metrics aggregate over time, traces preserve causality across boundaries, and logs carry the unstructured detail. Sampling is adaptive — head sampling for known-interesting paths, tail sampling to retain slow or error traces at a fixed budget. Cardinality is controlled at the source, not the query, because a high-cardinality label explodes storage and makes dashboards unusable.
When to invest and pitfalls
Invest when mean time to detect matters — in production, at scale, with paying users. The pitfall is instrumenting everything and alerting on nothing: dashboards full of lines that no one reads, alerts that fire on noise and are then muted, leaving the real outage undetected. Symptom-based alerts on user-visible degradation outperform cause-based alerts on internal thresholds.