Field names in structured logs are hard to change later

The first JSON logging attempt usually looks like {"time":"...","level":"info","msg":"...","data":{...}}. The problems arrive later: half the services use timestamp, the other half time; error codes live at the top level in some and inside data in others.

Agree on a few things first. ts as ISO 8601 with an offset, in UTC. level limited to debug, info, warn, error. request_id and trace_id propagated across services. Business fields flat, no more than two levels of nesting, or query languages become painful. Errors as an err object with type, message and stack, not a string with a stack glued on.

Stability of names matters more than the number of fields. Extra fields are free; renaming breaks every dashboard and saved query.