Comparison
Audit logvsStructured logging
Audit log
you record who did what to which record and when, in a store that the application itself cannot go back and edit.
An append-only record of security-relevant actions, kept for investigation and compliance. It is distinct from application logging in retention, integrity requirements and audience. If the service writing it can also modify it, it will not survive the one scenario it exists for.
Full entry →Structured logging
you log an object with named fields instead of a sentence, so you can query on user id rather than grep for it.
Emitting logs as machine-parseable records with consistent field names. It turns logs into something queryable and aggregatable rather than something you read. The discipline is in the field names: a user id logged under four different keys is four fields that cannot be joined.
Full entry →