The Two Temples: On the Divergent Paths of Logging Philosophy
There is a quiet schism in the world of operations, a fundamental disagreement on the nature of truth that plays out not in conference halls but in the silent, scrolling streams of our log files. It is a divide between two architectural philosophies, two ways of building a temple of understanding from the raw stone of events. On one side stands the Temple of the Single Source, and on the other, the Temple of the Convergent Stream.
The Temple of the Single Source is built upon a principle of pristine origin. Its architects believe that a log event, once generated, is a sacred, immutable artifact. It should be written once, in its most complete and detailed form, to a single, authoritative destination. This log is the source of truth. From this primary well, all other needs are met—analytics, alerting, auditing—through consumption and processing. The integrity of the event is paramount; it is never altered, only enriched by the context of its unchanging core. This approach prizes clarity and a single version of reality. There is one log to rule them all, and its sanctity is never questioned.
In contrast, the Temple of the Convergent Stream operates on a principle of purposeful duplication. Its builders see the initial log event not as a final artifact, but as a raw ingredient. They advocate for writing the same event to multiple destinations simultaneously, each tailored for a specific purpose. The same process start-up event might be written to a local file for immediate debugging, to a high-speed stream for real-time alerting, to a structured data store for analytics, and to a long-term archive for compliance. Each destination might receive the event in a slightly different format, optimized for its particular consumer.
This is not seen as a violation of truth, but as a pragmatic acknowledgment that no single format can perfectly serve every master. The truth is not in the pristine preservation of a single byte, but in the convergent story told by all the streams together.
The choice between these temples is rarely about right or wrong, but about alignment. The Single Source offers simplicity and a guaranteed consistency, a bastion against the drift of interpretation. Its risk is that the one true log can become a monolithic burden, a format that must serve too many masters and ends up serving none perfectly. The Convergent Stream offers agility and optimization, allowing each tool to work with data shaped for its hand. Its peril is in the complexity of its plumbing and the potential for a fractured narrative if the streams ever fall out of sync.
One seeks to build a perfect, central record of all that occurs. The other seeks to craft the right message for every ear that needs to hear it. Both are valid prayers offered to the same gods of stability and insight. The choice of which temple to maintain is one of the first and most defining acts of building a reliable service.
Notes & further reading
A few pages I came back to while writing this: