Logging in Production

Structured Logging

console.log("user logged in") is debugging. Production logging is machine-readable, structured, and queryable. The goal: logs you can search, alert on, and correlate across services.

Pino — Fast Structured Logging for Node.js

npm install pino pino-pretty pino-http

import pino from 'pino';
const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  ...(process.env.NODE_ENV !== 'production' && {
    transport: { target: 'pino-pretty' }  // Pretty in dev, JSON in prod
  })
});

// Child logger with request context
app.use((req, res, next) => {
  req.log = logger.child({ requestId: req.id, userId: req.user?.id });
  next();
});

req.log.info({ event: 'order.placed', orderId: 123, amount: 29.99 });
req.log.warn({ event: 'rate_limit.hit', ip: req.ip });
req.log.error({ event: 'db.connection_failed', err: error.message });

What to Log / Not Log

• Always log: HTTP requests, auth events, errors with context, background job lifecycle
• Never log: Passwords, API keys, credit card numbers, session tokens, full request bodies (may contain PII)

CloudWatch — Centralized Log Aggregation on AWS

# Docker logs to CloudWatch:
services:
  api:
    logging:
      driver: awslogs
      options:
        awslogs-region: us-east-1
        awslogs-group: /myapp/api
        awslogs-create-group: "true"

# Query with CloudWatch Insights:
fields @timestamp, @message
| filter event = "order.placed"
| stats count() by bin(1h)
| sort @timestamp desc