JSON logging gives you the ability to parse the log file programmatically even if the format has changed in time.
A good example is Apache logs. By default Apache uses
common format for access.log:
"%h %l %u %t \"%r\" %>s %b"
Say that you have built an offline parser that takes one of those log files and calculates some statistics from it.
At some moment you introduce subdomains to your application and include
virtual_host to your logs (just so you can debug if problems appear with one of the subdomains):
"%v %h %l %u %t \"%r\" %>s %b"
Your parser doesn't make use of the
virtual_hosts, but you still need to adapt your parser to:
- accept the new log format (notice the
%v at the head of log format)
- still support the old log format (for older log files)
But if you log in JSON, your parser won't even notice the added field and can happily parse the new logs as well as old logs. And some other parser can make use of the added fields if they exist.
And of course for you, parsing JSON is easier than writing
regexps to parse string logs.