{"id":464,"date":"2026-07-15T13:03:18","date_gmt":"2026-07-15T13:03:18","guid":{"rendered":"https:\/\/abrarqasim.com\/blog\/golang-slog-in-production-the-structured-logging-i-actually-ship\/"},"modified":"2026-07-15T13:03:18","modified_gmt":"2026-07-15T13:03:18","slug":"golang-slog-in-production-the-structured-logging-i-actually-ship","status":"publish","type":"post","link":"https:\/\/abrarqasim.com\/blog\/golang-slog-in-production-the-structured-logging-i-actually-ship\/","title":{"rendered":"Golang slog in Production: The Structured Logging I Actually Ship"},"content":{"rendered":"

Short version for the impatient: I ripped go.uber.org\/zap<\/code> out of a mid-sized Go backend last quarter and replaced it with the stdlib log\/slog<\/code>. Log volume stayed the same. The dependency tree got smaller. Nothing caught fire. If you want to know how I actually wired it up, and what I still miss from zap, read on.<\/p>\n

I resisted this for a while. zap<\/code> is fast, well-known, and I had been copy-pasting the same zap.NewProduction()<\/code> setup across services for years. But once slog<\/code> landed in the stdlib and the surrounding ecosystem stopped being weird, the argument for a third-party logger got thin. What follows is the exact slog<\/code> shape I now ship, plus the few sharp edges I hit that the official docs kind of glide over.<\/p>\n

Why I finally stopped reaching for zap<\/h2>\n

Honestly, slog<\/code> isn’t dramatically better than zap<\/code>. In micro-benchmarks zap<\/code> is still faster on hot loops, and its SugaredLogger<\/code> API is nicer than slog.Info(msg, \"key\", val)<\/code> for people who hate typing key-value pairs. So the case for switching isn’t performance. The case is that slog<\/code> is in the standard library, which means every dependency I pull in will eventually accept a *slog.Logger<\/code> and log the way I want it to log. That’s already happening with the newer net\/http<\/code>, database\/sql\/driver<\/code> wrappers I use, and a couple of internal libraries at work.<\/p>\n

The other thing that pushed me: when you’re paged at 3am, the fewer moving parts under your logging pipeline, the better. slog<\/code> is boring. Boring in a production log library is a compliment.<\/p>\n

If you want the full backstory on the design, the Go blog’s slog announcement<\/a> and the pkg.go.dev reference for log\/slog<\/code><\/a> are the two sources that helped me most. Read them in that order.<\/p>\n

The before\/after that convinced my team<\/h3>\n

Here’s what a request-scoped log line looked like in our zap<\/code> setup:<\/p>\n

\/\/ old: zap, sugared\nlogger.Infow("payment settled",\n    "user_id", user.ID,\n    "amount_cents", amt,\n    "provider", "stripe",\n    "request_id", reqID,\n)\n<\/code><\/pre>\n
And here’s the same line in slog<\/code> after migration:<\/p>\n
\/\/ new: stdlib slog\nlogger.InfoContext(ctx, "payment settled",\n    slog.String("user_id", user.ID),\n    slog.Int64("amount_cents", amt),\n    slog.String("provider", "stripe"),\n)\n<\/code><\/pre>\n
Notice the request_id<\/code> disappeared from the call site. That’s not a bug, it’s the whole point of the context-based approach I’ll get to in a second.<\/p>\n
The one handler I actually use in prod<\/h2>\n
I’ve tried the fancy handlers. slog-multi<\/code>, tint<\/code>, custom ones that wrap OpenTelemetry. In production I use exactly one: the stdlib slog.NewJSONHandler<\/code>, configured once at process start, and that’s it.<\/p>\n
func newLogger() *slog.Logger {\n    opts := &slog.HandlerOptions{\n        Level:     slog.LevelInfo,\n        AddSource: false, \/\/ flip to true only when debugging locally\n    }\n    h := slog.NewJSONHandler(os.Stdout, opts)\n    return slog.New(h)\n}\n<\/code><\/pre>\n
Three things I learned the hard way here.<\/p>\n
First, AddSource: true<\/code> sounds harmless, but on a busy request handler it eats a surprising amount of CPU because the runtime has to walk the stack for every log line. Leave it off in prod. Turn it on when you’re actually staring at logs on your laptop.<\/p>\n
Second, os.Stdout<\/code> is the right destination. Not a file. Not a syslog socket. Let the runtime (systemd, Docker, Kubernetes, whatever) capture stdout and ship it. If you fight this, you’ll regret it.<\/p>\n
Third, set the default logger. slog.SetDefault(logger)<\/code> at the top of main()<\/code> means every library that uses slog<\/code> package-level calls picks up your config for free. Skipping this line was my single biggest “why aren’t these logs formatted right” bug in the first week.<\/p>\n
Context, request IDs, and the pattern that stuck<\/h2>\n
The reason I dropped zap<\/code>’s With()<\/code> chains is that slog<\/code> finally has a clean context story. My rule: request-scoped fields go into the context, everything else goes at the call site. That means the handler adds them once, and no one has to remember to pass the logger down through every function signature.<\/p>\n
Here’s the middleware I run at the edge of every HTTP handler:<\/p>\n
func requestLogger(base *slog.Logger) func(http.Handler) http.Handler {\n    return func(next http.Handler) http.Handler {\n        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n            reqID := r.Header.Get("X-Request-ID")\n            if reqID == "" {\n                reqID = randomID()\n            }\n            l := base.With(\n                slog.String("request_id", reqID),\n                slog.String("path", r.URL.Path),\n                slog.String("method", r.Method),\n            )\n            ctx := context.WithValue(r.Context(), loggerKey{}, l)\n            next.ServeHTTP(w, r.WithContext(ctx))\n        })\n    }\n}\n\nfunc fromContext(ctx context.Context) *slog.Logger {\n    if l, ok := ctx.Value(loggerKey{}).(*slog.Logger); ok {\n        return l\n    }\n    return slog.Default()\n}\n<\/code><\/pre>\n
Downstream, any handler grabs the logger like this:<\/p>\n
func handleCharge(w http.ResponseWriter, r *http.Request) {\n    log := fromContext(r.Context())\n    log.InfoContext(r.Context(), "charge started", slog.Int64("amount_cents", amt))\n    \/\/ ...\n}\n<\/code><\/pre>\n
One thing to be honest about: this isn’t a slog<\/code>-only pattern. You could do the same with zap<\/code>. But the reason it feels less awkward now is that InfoContext<\/code>, WarnContext<\/code>, and friends were added specifically so the handler can also inspect the context. If you use OpenTelemetry, that’s how trace IDs get pulled in automatically by a wrapping handler. I don’t currently pipe traces into logs, but if I did, I’d add an OTel handler here and I would not have to change a single call site. That kind of layered composition is much easier to get right in the stdlib version.<\/p>\n
My Go concurrency patterns writeup<\/a> covers the sister pattern for propagating context through goroutines. If you’re doing structured logging without also passing ctx.Done()<\/code> down into your workers, you’re going to lose logs on shutdown.<\/p>\n
Groups and With: how I keep noise out of prod logs<\/h2>\n
The two slog<\/code> features I use every day are With<\/code> (for shared attrs) and groups (for namespacing). Grouping matters more than it looks.<\/p>\n
Say a payment call touches three subsystems: your DB, a Stripe SDK, and an internal fraud check. Without groups, you get 12 fields at the top level of every log line and your grep-ability tanks. With groups, you get:<\/p>\n
log.InfoContext(ctx, "charge settled",\n    slog.Group("db",\n        slog.Int("rows", 3),\n        slog.Duration("latency", dbLatency),\n    ),\n    slog.Group("stripe",\n        slog.String("charge_id", chargeID),\n        slog.Int("http_status", 200),\n    ),\n    slog.Group("fraud",\n        slog.Float64("score", 0.12),\n    ),\n)\n<\/code><\/pre>\n
Which lands in the JSON output as nested objects. In Datadog, Grafana Loki, or whatever you’re using, this is a lot easier to query than a flat forest of keys. I wish I’d started with groups from day one instead of retrofitting them later.<\/p>\n
The other thing I do heavily is logger.With<\/code> at package init for library-style code:<\/p>\n
var log = slog.Default().With(slog.String("component", "billing"))\n<\/code><\/pre>\n
That one line, at the top of each internal package, means every log line from that package is instantly filterable by component<\/code>. It’s the same trick people use with prefixed loggers in other languages, only cleaner because With<\/code> returns a new logger and doesn’t mutate global state.<\/p>\n
Levels, sampling, and the hot-path problem<\/h2>\n
Here’s where I was annoyed with slog<\/code> for about a week. It doesn’t ship with sampling. zap<\/code> has a very nice sampler.Core<\/code> that lets you say “emit the first 100 of each log line per second, then drop”. When you’re running a request-per-millisecond service and a downstream starts throwing errors, zap<\/code> sampling saves your log bill. slog<\/code> makes you build that yourself.<\/p>\n
The workaround I use is a small wrapping handler with a per-message counter:<\/p>\n
type samplingHandler struct {\n    inner slog.Handler\n    counts sync.Map \/\/ map[string]*atomic.Int64\n    every  int64\n}\n\nfunc (h *samplingHandler) Handle(ctx context.Context, r slog.Record) error {\n    v, _ := h.counts.LoadOrStore(r.Message, new(atomic.Int64))\n    n := v.(*atomic.Int64).Add(1)\n    if n%h.every != 0 {\n        return nil\n    }\n    return h.inner.Handle(ctx, r)\n}\n\/\/ Enabled, WithAttrs, WithGroup omitted for brevity: delegate to inner.\n<\/code><\/pre>\n
Not as clever as zap<\/code>’s tick-based sampler, but it’s fifty lines and I understand every one of them. For the noisier services I’ve since switched to letting the ingest side (Vector, in our case) do the sampling, which is where I probably should’ve been doing it all along.<\/p>\n
If you want a longer, less opinionated look at handler internals, the Go team’s guide to writing a handler<\/a> is the closest thing to a canonical reference.<\/p>\n
What I still miss from zap<\/h2>\n
Two things.<\/p>\n
One, the Sugar()<\/code> API is genuinely nicer for exploratory code. sugar.Infow(\"msg\", \"k\", v)<\/code> reads better than slog.Info(\"msg\", slog.Any(\"k\", v))<\/code>. slog<\/code>’s key-value variadic form (slog.Info(\"msg\", \"k\", v)<\/code>) exists but the type safety is weaker and you lose autocomplete. I now use slog.String<\/code>, slog.Int64<\/code>, and friends religiously, but it feels a hair more ceremonial than the zap version.<\/p>\n
Two, zap<\/code> has better first-party integrations with a lot of the observability vendors. Datadog’s Go SDK, for example, still assumes zap<\/code> in most examples. That’ll fix itself over the next year, but if you’re setting up a brand new service today, budget an afternoon to figure out the right handler for your log backend.<\/p>\n
Also: I still keep zap<\/code> in my monorepo for one specific service, our real-time market data feed, where the extra 30% throughput matters. Sometimes the right answer is “use both”. I write about that kind of pragmatic trade-off in the work I put on my portfolio<\/a>, because pretending every service should look identical is how you end up with pain later.<\/p>\n
Try this next week<\/h2>\n
Grab whichever Go service in your stack has the most tangled log call sites. Add slog.SetDefault(newLogger())<\/code> in main<\/code>. Delete one zap.Logger<\/code> field from a struct and replace it with a call to fromContext(ctx)<\/code>. See how the diff feels. That’s the whole migration, one file at a time, and it’s genuinely lower risk than most stdlib swaps I’ve done.<\/p>\n
And if you like this kind of “here’s the setup I actually run” writeup, my post on Go 1.23 iterators<\/a> is in the same voice and might save you a similar afternoon.<\/p>\n","protected":false},"excerpt":{"rendered":"
How I moved a Go backend from zap to the stdlib log\/slog package, the handler config I use in prod, and what I quietly miss from the old logger.<\/p>\n","protected":false},"author":2,"featured_media":463,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_title":"","rank_math_description":"How I moved a Go backend from zap to the stdlib log\/slog package, the handler config I use in prod, and what I quietly miss from the old logger.","rank_math_focus_keyword":"golang slog","rank_math_canonical_url":"","rank_math_robots":"","footnotes":""},"categories":[147,159],"tags":[49,46,47,512,328,329,326,515,513,514],"class_list":["post-464","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-backend","category-go","tag-backend","tag-go","tag-golang","tag-log-slog","tag-logging","tag-observability","tag-slog","tag-stdlib","tag-structured-logging-2","tag-zap"],"_links":{"self":[{"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/posts\/464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/comments?post=464"}],"version-history":[{"count":0,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/posts\/464\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/media\/463"}],"wp:attachment":[{"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/media?parent=464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/categories?post=464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/abrarqasim.com\/blog\/wp-json\/wp\/v2\/tags?post=464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}