Give a log query a question and a denominator
A useful logging design starts with a question precise enough to become a query. “Show errors” is different from “How many checkout requests finally failed between ten and eleven UTC?” The first locates diagnostic events. The second needs a population of completed requests, a definition of failure, and a time rule. Collecting more text does not supply these missing semantics automatically. ...