The described technology is directed towards a structured logging technology in which events corresponding to program execution are received in a structured format and logged based upon filtering of those events. A log handler is associated with a filtering mechanism that determines whether each event matches filtering criteria and is thus to be logged by the log handler. The log handler provides matching logged events to an event sink, such as an analytic tool that consumes the events for analysis.