doctor: complete runtime check documentation sprint

Signed-off-by: master <>

docs/doctor/articles/observability/observability-logging.md

@@ -0,0 +1,49 @@
+---
+checkId: check.observability.logging
+plugin: stellaops.doctor.observability
+severity: warn
+tags: [observability, logging, structured-logs]
+---
+# Logging Configuration
+
+## What It Checks
+Reads default and framework log levels and looks for structured logging via `Logging:Structured`, JSON console formatting, or a `Serilog` configuration section.
+
+The check warns when default logging is `Debug` or `Trace`, when Microsoft categories are too verbose, or when structured logging is missing.
+
+## Why It Matters
+Unstructured logs slow incident response and make exports difficult to analyze. Overly verbose framework logging also drives storage growth and noise.
+
+## Common Causes
+- Only the default ASP.NET console logger is configured
+- `Logging:Structured` or `Serilog` settings were omitted from compose values
+- Troubleshooting log levels were left enabled in production
+
+## How to Fix
+
+### Docker Compose
+```yaml
+services:
+  doctor-web:
+    environment:
+      Logging__LogLevel__Default: Information
+      Logging__LogLevel__Microsoft: Warning
+      Logging__Structured: "true"
+```
+
+If Serilog is used, make sure the console sink emits JSON or another structured format that downstream tooling can parse.
+
+### Bare Metal / systemd
+Keep framework namespaces at `Warning` or stricter unless you are collecting short-lived debugging evidence.
+
+### Kubernetes / Helm
+Ensure log collectors expect the same output format the application emits.
+
+## Verification
+```bash
+stella doctor --check check.observability.logging
+```
+
+## Related Checks
+- `check.observability.alerting` - alerting often relies on structured log pipelines
+- `check.security.audit.logging` - audit logs should follow the same transport and retention standards