-
Notifications
You must be signed in to change notification settings - Fork 904
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Tigran Najaryan
committed
Aug 14, 2020
1 parent
276a395
commit f014f61
Showing
2 changed files
with
50 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,41 @@ | ||
# Events and Logs | ||
|
||
Let’s start with Wikipedia’s definition of log file: | ||
|
||
> In computing, a log file is a file that records either events that occur in an | ||
> operating system or other software runs. | ||
The notion of a log record used throughout this document is fully aligned with | ||
Wikipedia’s definition. In fact we claim that in the observability realm there | ||
is no important distinction between logs and recorded events from a data | ||
modeling perspective. Logs are simply records of events. | ||
|
||
Logs and Events are different names for the same concept. | ||
|
||
Some products may want to make a distinction between Events collected from | ||
certain sources and Logs collected from other sources. We claim that there is | ||
nothing inherently different between logs and events, the differences are in the | ||
sources themselves. Thus where it matters the products should make that | ||
distinction based on the source of the data rather than attempt to arbitrarily | ||
categorize the data as events vs logs. | ||
|
||
One traditional way events and logs were thought to be different was that logs | ||
are unstructured while events are structured. This is however an orthogonal | ||
argument, which also contradicts with the fact that there are logging formats | ||
that support structured data and there are modern logging libraries that by | ||
default output structured data rather than unstructured text. | ||
|
||
Debates and comments are welcome on this topic. We would like to either confirm | ||
our claim or find definitive arguments in favour of treating events and logs as | ||
different data types. | ||
|
||
Additional historical references using the term "logs" in the "events records" | ||
sense: | ||
|
||
- From Syslog [RFC5424](https://tools.ietf.org/html/rfc5424): "This document | ||
describes the syslog protocol, which is used to convey **event** notification | ||
**messages**." | ||
|
||
- System logs on Windows operating system are known as Windows **Event** Log | ||
(see | ||
[MSDN](https://docs.microsoft.com/en-us/windows/win32/wes/windows-event-log)). |