What to log and what never to log

The default instinct is to log everything. That costs money, violates privacy, and buries the signal you actually need. The goal is to log the shape of every request and only the content you have explicit permission to store.

Good fields and risky fields

observability/redact.py

python

import re

_EMAIL = re.compile(r"[\w.\-+]+@[\w\-]+\.[\w.\-]+")
_PHONE = re.compile(r"\+?\d[\d\s\-()]{7,}\d")

def redact_pii(text: str) -> str:
    if not text:
        return text
    text = _EMAIL.sub("[email]", text)
    text = _PHONE.sub("[phone]", text)
    return text

def log_prompt(prompt: str, *, max_chars: int = 200) -> str:
    return redact_pii(prompt)[:max_chars]

A small redactor is enough for most cases. Pair it with a max_chars cap so you never log a full document dump by accident.

Quiz: Quiz

Loading practice…

Validation checklist: Your logging rules, written down

Loading practice…

AI prompt: Try it: audit your log fields

Loading practice…

Checkpoint: Structured logging checkpoint

Loading practice…