Errors in production do not arrive evenly spread; they arrive in clumps when something upstream falls over. The burst option clusters eight consecutive failures into the timeline, which is what an alerting rule actually has to detect.
What you can control
- Six formats covering web servers, structured logging and syslog.
- The burst option groups errors together instead of scattering them, so alerting thresholds get a realistic test.
- Trace and span IDs for testing distributed-tracing correlation.
- Failed requests carry realistic latency — hundreds of milliseconds to tens of seconds, not the same as successes.
What this is not
Timestamps are spread evenly across the window rather than following real traffic patterns. A log covering a full day will not show the daily peak your capacity planning depends on.
Questions
What is logfmt?
A flat key=value line format. It is human-readable like a plain log and machine-parseable like JSON, which is why Heroku and Go tooling adopted it.
Why cluster the errors?
Because that is how incidents happen. An alert rule tuned against evenly scattered errors will either fire constantly or never fire at all.
Can I use these to test a log parser?
Yes, that is the main use. The Apache combined format in particular has quoting rules that catch out naive regex parsers.