Grafana Learn
Sign in Sign up
Section 4 · Apply labeling strategy to logs

When log data belongs in a label, in structured metadata, or in the log line

Estimated time: 1 min

The decision framework

For any piece of log data, ask where it belongs.

  • If you filter by it in almost every query, and it’s bounded, make it a label. Example: env, app.
  • It’s high-cardinality but you query it often, attach it as structured metadata. It’s queryable with a label filter expression, such as {job="example"} | pod="myservice-abc1234-56789", without being indexed or creating streams. Examples: pod names, process IDs, trace IDs.
  • Everything else, leave it in the log line and extract it at query time with parsers like json or logfmt, or search it with filter expressions.
Decision tree routing a piece of log data to a label, structured metadata, or the log line, based on how often it's queried and whether it's bounded