ASVS 5.0 V16.2.4 requires that logs can be read and correlated by the log processor in use, preferably through a common logging format. It is Level 2. Choose one format, usually JSON lines, with agreed field names, and verify the processor parses every source without custom guesswork.
Why it matters
Correlation is how you spot an attack across services. If one service logs key value pairs, another logs free text and a third logs XML, searching for one user across all of them takes hand written parsers that break silently.
How to implement it
Pick a field schema and publish it with the logging library. Example event:
{"ts":"2026-10-19T08:30:00.123Z","service":"auth","level":"WARN","event":"login_failed","user_id":"u_8841","ip":"198.51.100.20","request_id":"7c1f"}
Use the same names everywhere for time, service, level, event, user, source IP and request id. Wrap third party components, such as web servers, so their output is converted at the agent. Validate in CI that sample output matches the schema.
How to test it
Send logs from each source into a staging processor and check that fields land in the right columns with no parse errors. Run one query by request_id and confirm it returns entries from every service involved.
Common mistakes
- Multi line stack traces that split into many events.
- Changing field names between versions.
- Parsing failures that nobody monitors.
Quick check
Must it be JSON?
No. The requirement is that your processor reads and correlates it. A common format is the simplest way to achieve that.
