One point that I'd try to convey is that the canonical line technique works for any kind of structured format. We use logfmt in all our examples, but JSON would work just as well.
What I can't find described for logfmt is how to handle escaping special characters in the keys or values. Specifically the quotes and equals.
JSON defines this very well, but Splunk simple key=value logging formats suffer from escaping and parsing problems.