Use slog with a JSON handler for machine-parseable output, attach request-scoped fields via slog.With, and inject the logger via dependency injection rather than using a global.
JSON output for log aggregators (Datadog, Loki, CloudWatch) — text for local development
Attach traceID, spanID, userID, requestID to every log entry for correlation
Avoid logging sensitive data: passwords, tokens, PII — mask or omit
Log at appropriate levels: Debug (local only), Info (normal ops), Warn (recoverable issues), Error (failures)
Inject logger via dependency injection — global loggers make testing and context propagation harder