Logging requests in Express app

I needed to log all requests passing through an Express.js application. For years I used morgan, the most common HTTP request logger middleware for Node.js.

morgan has not shipped an update in four years. So I moved to express-requests-logger, a logging middleware that is still maintained.

Install the middleware and mount it

Two packages: the middleware itself and its TypeScript types.

npm install express-requests-logger
npm install --save-dev @types/express-requests-logger

Mounting it takes one line. It applies to every route registered after it, so put it near the top of the app setup.

import audit from "express-requests-logger";
// Other imports and app setup code
app.use(audit());

Four options morgan does not give you

doubleAudit logs the request and the response together

doubleAudit writes two entries per call: one for the incoming request, one for the matching response. That covers the full lifecycle of a request, which is what you want when you are debugging an interaction between services.

excludeURLs keeps health checks out of the log

Kubernetes hits my health check endpoints every few seconds, and those entries filled the log. excludeURLs drops them, so the output holds only the traffic I care about.

Masking options keep sensitive data out of the log

The middleware has several options for controlling what reaches the log store:

• excludeBody / maskBody: Great for omitting or anonymizing sensitive data in request bodies.
• maskQuery: Helps mask data in query parameters.
• excludeHeaders / maskHeaders: Useful for handling sensitive header information.

Those options matter for data protection compliance. A request body carrying a password or an access token should never land in the log store.

Point it at winston, pino, or whichever logger you already run

The middleware writes through a logger you supply. I use winston, and it kept working without any changes to my transport config. pino plugs in the same way. Express logging then comes out in whatever format the rest of your stack already parses.

If morgan is still your Express logger, this one is worth the swap.