Use the same name/label for the same data across applications (e.g. sessionid=..., userid=...), this will make it easier to find a single transaction across all layers of your stack.

Performance problems are not always where you think they are. Log the start and end (including lapsed time) of every request that goes out-of-process (e.g. REST request) or may take a long time (e.g. > 100ms).

If you don't have a session/transaction ID, synthesize one as high as possible in your stack. The more layers you use it in, the better.

Log at the right level (FATAL, ERROR, WARN, INFO, DEBUG, TRACE). Simple count trends can tell you a lot about the health of your system

Log enough context to avoid having to look at code. Log messages should not be pointers into the code, they should be self-explanatory.

Log full stack traces. Bugs are not always where you expect them to be.

Don't put plain-text passwords in log events.

Logging session ID's helps group events into transactions.

Use NTP to synchronize timestamps across systems.

Many applications can be configured to log directly to syslog.

Use Saved Searches to run common or repeated queries.

Alerts can run searches and send results via email.

Log more - don't limit yourself to what a human can handle. "Manual inspection" of logs is slower and more error prone than using Loggly