Stop 19 · Monitoring & LoggingTopics · 1/9

Logging Best Practices

In short

At 2 a.m. production breaks and you can't attach a debugger. Logs are all you have, so write them for your future sleepy self. Because that's who will be reading them.

Writing logs that are actually useful when something goes wrong in production — structured, leveled (info/warn/error), and free of sensitive data like passwords or tokens.

The purple blob dressed as a railway guard writes in a logbook on a platform, holding a pocket watch.

Think of it like this

The train guard's logbook

A train guard writes down every event: time, station, what happened, who reported it. Not 'something went wrong somewhere'. When there's an inquiry later, that dull, precise book is gold. Good logs are the same: every line has a time, a level and the facts.

Watch it happen

Log levels and the threshold

trace

debug

info

min

warn

error

fatal

1/5Production usually logs info and above. debug and trace lines are skipped, so they cost almost nothing.

The big ideas

What you need to know

Structured, not prose

Log JSON objects with fields like userId and orderId. Machines can search and count them, and humans can still read them.

Request IDs tie it together

Give every request an ID and add it to each log line, so you can follow one request across services.

Never log secrets

Passwords, tokens, card numbers and full Aadhaar numbers stay out of logs. Redact them automatically.

Write to stdout

Let the app print logs and let the platform collect them. Don't juggle log files from inside your code.

See it in code

Walk through the code

1// Bad: no level, no context, impossible to search2console.log("payment failed");3 4// Good: structured, levelled, traceable5logger.error(6  {7    reqId: req.id,8    userId: user.id,9    orderId: order.id,10    provider: "razorpay",11    err, // includes message and stack12  },13  "payment capture failed",14);

1/3A bare string with no level or IDs. Good luck finding which payment this was.

The good version lets you search 'all failed payments for user 7 today' in seconds. The bad version only tells you something, somewhere, failed.

Save yourself the pain

Common mistakes

Oops

Logging the whole req.body on every request.

Do this instead

That dumps passwords and personal data into log storage. Log selected fields and redact the rest.

Oops

Logging everything at error level so it's 'visible'.

Do this instead

Real errors then drown in noise and alerts fire all day. Use levels honestly.

Your mission

Upgrade your logs

~25 min

Quick check

Why add a request ID to every log line?

Go deeper

1Audit a project's `console.log` calls and replace them with a proper logger.
2Adopt log levels (debug, info, warn, error) and use them consistently.
3Ensure logs never include passwords, tokens, or other sensitive data.