Structured logging

Production logs are JSON. shared-logging adds HttpAccessLogFilter, StructuredLog, and UseCaseObservationAspect.

Fields you can rely on:

Field	Meaning
event	What happened (http.access, a use-case name, a job name)
direction	Inbound or outbound
outcome	Success or failure
traceId	Correlation id
userId	Present when the JWT was valid. Absent on public routes
service	Process name
httpStatus	Status code
durationMs	Elapsed time

Log levels: info for access and successful use cases that matter, warn for rejected auth and retries, error for failed jobs and unhandled exceptions. Debug is off in production.

Never log: passwords, OTP, refresh tokens, presigned query strings, email provider API keys, APNs private keys, raw payment identifiers.

Promtail ships Docker logs for containers named splick-* to Loki. Kong access logs are included and labeled with traceId from X-Request-Id.