---
title: "Logging requests in Express app"
description: "express-requests-logger is a maintained morgan replacement. It logs Express.js requests and responses, skips health check URLs, and masks sensitive fields."
canonical: https://omiid.me/notebook/26/logging-requests-in-express-app
author: Omid Sayfun
published: 2024-06-16
updated: 2026-08-09
---

# Logging requests in Express app

I needed to log all requests passing through an Express.js application. For years I used [morgan](https://www.npmjs.com/package/morgan), the most common HTTP request logger middleware for Node.js.

morgan has not shipped an update in four years. So I moved to [express-requests-logger](https://github.com/PayU/express-request-logger#readme), a logging middleware that is still maintained.

## Install the middleware and mount it

Two packages: the middleware itself and its TypeScript types.

```shell
npm install express-requests-logger
npm install --save-dev @types/express-requests-logger
```

Mounting it takes one line. It applies to every route registered after it, so put it near the top of the app setup.

```typescript
import audit from "express-requests-logger";
// Other imports and app setup code
app.use(audit());
```

## Four options morgan does not give you

### doubleAudit logs the request and the response together

`doubleAudit` writes two entries per call: one for the incoming request, one for the matching response. That covers the full lifecycle of a request, which is what you want when you are debugging an interaction between services.

### excludeURLs keeps health checks out of the log

Kubernetes hits my health check endpoints every few seconds, and those entries filled the log. `excludeURLs` drops them, so the output holds only the traffic I care about.

### Masking options keep sensitive data out of the log

The middleware has several options for controlling what reaches the log store:

- **excludeBody / maskBody**: Great for omitting or anonymizing sensitive data in request bodies.
- **maskQuery**: Helps mask data in query parameters.
- **excludeHeaders / maskHeaders**: Useful for handling sensitive header information.

Those options matter for data protection compliance. A request body carrying a password or an access token should never land in the log store.

### Point it at winston, pino, or whichever logger you already run

The middleware writes through a logger you supply. I use `winston`, and it kept working without any changes to my transport config. `pino` plugs in the same way. Express logging then comes out in whatever format the rest of your stack already parses.

If morgan is still your Express logger, this one is worth the swap.