We used to split logs into two buckets at work, one containing parsable log lines that used the expected format and schema and then the rest in the second one.

We used to split logs into two buckets at work, one containing parsable log lines that used the expected format and schema and then the rest in the second one. That way we could centralise all logs and detect different kinds of failures, like unexpected log lines appearing.