{"id":282,"date":"2026-05-26T13:04:32","date_gmt":"2026-05-26T13:04:32","guid":{"rendered":"https:\/\/abrarqasim.com\/blog\/go-slog-structured-logging-i-stopped-hand-rolling\/"},"modified":"2026-05-26T13:04:32","modified_gmt":"2026-05-26T13:04:32","slug":"go-slog-structured-logging-i-stopped-hand-rolling","status":"publish","type":"post","link":"https:\/\/abrarqasim.com\/blog\/go-slog-structured-logging-i-stopped-hand-rolling\/","title":{"rendered":"Go slog: the Structured Logging I Stopped Hand-Rolling"},"content":{"rendered":"

For years my Go logging setup was the same handful of steps on every new service. Import a third-party logger, wire it to emit JSON, then spend twenty minutes deciding how to thread it through the code so handlers could actually reach it. I had a little internal package called logx<\/code> that I copied between projects. It wasn’t good. It was just mine, and it was familiar, and familiar is a hard thing to give up.<\/p>\n

Go 1.21 added log\/slog<\/code><\/a> to the standard library, and after avoiding it for a while out of pure habit, I deleted logx<\/code>. Not refactored. Deleted. The standard library now does the part I actually cared about, which is structured logs with typed key and value pairs, and it does it well enough that reaching for an external logger needs a real justification now.<\/p>\n

Here’s what slog<\/code> replaced for me, where it’s genuinely good, and the one part I still find awkward.<\/p>\n

What was wrong with plain log<\/h2>\n

Go always shipped a log<\/code> package, and it was fine for exactly one job: printing a line of text so a human would see it. The trouble is that text is where log data goes to die. Here’s the kind of line my old code produced:<\/p>\n

log.Printf("user %d updated order %d, status now %s", userID, orderID, status)\n<\/code><\/pre>\n
You can read that. A machine cannot, not reliably. If you want every log line for order 4821, you’re writing a regular expression against an English sentence. If you ship those logs to anything that indexes fields, the fields don’t exist. There’s just prose.<\/p>\n
The standard log<\/code> package also has no notion of severity. Every line is just a line. If you wanted to separate routine information from a genuine warning, you built that distinction yourself, usually with a second logger and a naming convention you’d forget within a month. So my logx<\/code> package wasn’t solving an exotic problem. It was patching two holes that the standard library left open for a decade.<\/p>\n
Structured logging fixes this by making each log line a set of key and value pairs instead of a sentence. The message is one field. The user id is another. The order id is another, stored as an actual number. Your log backend can then filter on order_id<\/code> the way a database filters on a column. That’s the entire pitch, and it’s why the Go team wrote up structured logging<\/a> as a first-class concern rather than leaving it to the ecosystem to solve five different ways.<\/p>\n
slog, the version I actually use<\/h2>\n
Here’s that same line with slog<\/code>:<\/p>\n
slog.Info("order updated",\n    "user_id", userID,\n    "order_id", orderID,\n    "status", status,\n)\n<\/code><\/pre>\n
The first argument is the message, a constant string you can group on. Everything after it is key and value pairs. Finding one order is now a field match instead of a guess.<\/p>\n
By default slog<\/code> prints a readable line, which is what you want at your desk. In production I switch the handler to JSON once, at startup:<\/p>\n
func main() {\n    handler := slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{\n        Level: slog.LevelInfo,\n    })\n    slog.SetDefault(slog.New(handler))\n\n    slog.Info("service started", "port", 8080)\n}\n<\/code><\/pre>\n
slog.SetDefault<\/code> installs a package-level logger, so the bare slog.Info<\/code> calls scattered through the code pick it up automatically. That one detail is why I stopped threading a logger through every function signature. For a small service the default logger is genuinely fine, and I say that as someone who spent years insisting it wasn’t.<\/p>\n
Levels come built in, Debug<\/code> through Error<\/code>, and the HandlerOptions.Level<\/code> in that snippet is what filters them. Set it to LevelInfo<\/code> in production and your Debug<\/code> lines cost almost nothing, because the handler drops them before it formats anything. There’s also a context-aware variant, slog.InfoContext<\/code>, that threads a context.Context<\/code> into the handler. Write a handler that reads a request id off the context once, and every call site stops needing to remember to attach it.<\/p>\n
When a section of code should tag every line with the same context, slog.With<\/code> returns a child logger that carries those fields for you:<\/p>\n
reqLog := slog.With("request_id", reqID, "route", r.URL.Path)\nreqLog.Info("handling request")\nreqLog.Warn("slow query", "ms", elapsed)\n<\/code><\/pre>\n
Both of those lines come out carrying request_id<\/code> and route<\/code> without you repeating them. That’s the feature I lean on most, because request-scoped context is exactly the thing you forget to attach by hand.<\/p>\n
Where slog is genuinely good<\/h2>\n
Two things make slog<\/code> worth the switch beyond the obvious win of structured output.<\/p>\n
The first is that it lives in the standard library, so it has no version of its own to track and no dependency to audit. A logging library that every service imports is a library you have to keep patched across every service. slog<\/code> ships with the Go you already installed. The Go 1.21 release notes<\/a> introduced it, and it has been stable since.<\/p>\n
The second is the handler interface. slog<\/code> separates the front end, the Info<\/code> and Warn<\/code> calls you write, from the back end, the handler that decides what a log line becomes. The standard library gives you a text handler and a JSON handler out of the box. If you need something else, you implement one interface, and every slog<\/code> call in your program and in your dependencies routes through it. That means a library logging with slog<\/code> can be told how to log by the application importing it, which is the coordination the ecosystem never quite managed before.<\/p>\n
If you’re structuring a service from scratch, this pairs well with how I think about Go services in general, which I went into in a post on Go web frameworks<\/a>. Logging is one of the few decisions you want to make early and then stop thinking about.<\/p>\n
The part I still find awkward<\/h2>\n
slog<\/code> isn’t perfect, and the rough edge shows up quickly: the key and value pairs are loosely typed in the form most people use.<\/p>\n
When you write slog.Info(\"msg\", \"user_id\", userID)<\/code>, nothing checks that a value follows every key. If you drop one, slog<\/code> does its best and emits a line flagged as having a bad argument, at runtime, not at compile time. I’ve shipped that mistake. It’s the kind of typo a stricter API would have refused outright.<\/p>\n
The Go team is aware of this. go vet<\/code> ships an slog<\/code> analyzer that catches some mismatched key and value pairs before they reach production, and it’s worth keeping in your build. But it doesn’t catch everything, and a vet<\/code> warning is still a step you can ignore, not a wall the compiler puts in front of you.<\/p>\n
slog<\/code> does offer a stricter form through its Attr<\/code> constructors:<\/p>\n
slog.Info("order updated",\n    slog.Int("order_id", orderID),\n    slog.String("status", status),\n)\n<\/code><\/pre>\n
This version is much harder to get wrong, because slog.Int<\/code> won’t accept a string. It’s also noisier to type, and most code I read in the wild uses the loose form regardless. I’ve settled on a rule: loose form for ordinary logs, Attr<\/code> constructors in the paths I care about most, anything touching money or auth. It’s a compromise, and I’d rather the compiler simply helped, which is a complaint I have about a few corners of Go and have made before in a post on Go error handling<\/a>.<\/p>\n
Where to start<\/h2>\n
If you’re starting a new Go service in 2026, use slog<\/code>. There’s no reason to add a logging dependency before you’ve hit a concrete need the standard library can’t meet, and for most services that need never arrives.<\/p>\n
If you have an existing service on an external logger, don’t tear it out for sport. But the next time you’re already in the logging code for some other reason, that’s your opening to switch.<\/p>\n
Here’s the thing to try this week. Find the ugliest log.Printf<\/code> in your codebase, the one with four values crammed into a sentence, and rewrite just that line as a slog.Info<\/code> call with real keys. Send it to wherever your logs end up and try to filter on one of the fields. That single query, the one you could not run before, is the whole argument for structured logging, and it lands harder than anything I can write here. If you want to see the kind of Go services I build this into, that’s over on my portfolio<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Go 1.21’s log\/slog brought structured logging into the standard library. Here’s what it replaced for me, where it shines, and the one part I still find awkward.<\/p>\n","protected":false},"author":2,"featured_media":281,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_title":"","rank_math_description":"Go 1.21's log\/slog brought structured logging into the standard library. Here's what it replaced for me, where it shines, and the one part I still find awkward.","rank_math_focus_keyword":"golang slog","rank_math_canonical_url":"","rank_math_robots":"","footnotes":""},"categories":[159,45],"tags":[49,46,47,328,329,326,327],"class_list":["post-282","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-go","category-programming","tag-backend","tag-go","tag-golang","tag-logging","tag-observability","tag-slog","tag-structured-logging"],"_links":{"self":[{"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/posts\/282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/comments?post=282"}],"version-history":[{"count":0,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/posts\/282\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/media\/281"}],"wp:attachment":[{"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/media?parent=282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/categories?post=282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/tags?post=282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}