Externalizing logs

A Twelve-Factor App never attempts to store or ship log files. In a cloud, it is better to avoid local I/Os or file systems. If the I/Os are not fast enough in a given infrastructure, they could create a bottleneck. The solution to this is to use a centralized logging framework. Splunk, greylog, Logstash, Logplex, Loggly are some examples of log shipping and analysis tools. The recommended approach is to ship logs to a central repository by tapping the logback appenders and write to one of the shipper's endpoints.

In a microservices ecosystem, this is very important, as we are breaking a system into a number of smaller services, which could result in decentralized logging. If they store logs in a local storage, it would be extremely difficult to correlate logs between services:

In development, microservice may direct the log stream to stdout, whereas, in production, these streams will be captured by the log shippers and sent to a central log service for storage and analysis.