Details
When a node starts, shuts down, or processes acockroach command, it produces a stream of messages about the command’s activities. Each message is composed of:
- A payload that contains events either structured in JSON or conveyed in an arbitrary string. For details on structured event types and their fields, see Notable Event Types.
- An envelope that contains event metadata (e.g., severity, date, timestamp, channel). Depending on the log format you specify when configuring logs, the envelope can be formatted either in JSON or as a flat prefix to the message.
Logging channels
Log messages in CockroachDB are directed into logging channels, which can in turn be assigned to output to one or more log sinks. This allows you to group channels that log related information (e.g., operational, security, or SQL events) into their own sinks. Each sink can output to a predetermined destination where the logs can be collected and parsed. For usage examples, see Logging Use Cases.
Logging channels are analogous to logging facilities in Syslog or logging services in Datadog. For more details on the contents of each logging channel, see the Logging reference.
Logging destinations
When using the default logging configuration, the events collected on each logging channel are split into log files as follows:
Logging destinations and many other parameters are configurable via YAML. For details, see Configure Logs.

