
Security News
Crates.io Implements Trusted Publishing Support
Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.
@seek/logger
Advanced tools
@seek/logger is a JSON logger for Node.js applications. It implements several SEEK customisations over Pino, including:
timestamp
s for Splunk compatibilityimport createLogger, { createDestination } from '@seek/logger';
const { destination, stdoutMock } = createDestination({
mock: config.environment === 'test',
});
// Initialize the logger.
// This will log to stdout if `createDestination` is not mocked.
const logger = createLogger(
{
name: 'my-app',
},
destination,
);
// Write an informational (`level` 30) log with a `msg`.
logger.info('Something good happened');
// Create a child logger that automatically includes the `requestId` field.
const childLogger = logger.child({ requestId });
// Write an error (`level` 50) log with `err`, `msg` and `requestId`.
childLogger.error({ err }, 'Something bad happened');
// Introspect mocked calls in your test environment.
// See the Testing section for more information.
stdoutMock.calls;
@seek/logger bundles custom req
, res
and headers
serializers along with Pino's standard set.
User-defined serializers will take precedence over predefined ones.
Use the following standardised logging fields to benefit from customised serialization:
err
for errors.
The Error is serialized with its message, name, stack and additional properties.
Notice that this is not possible with e.g. JSON.stringify(new Error())
.
req
for HTTP requests.
The request object is trimmed to a set of essential fields.
Certain headers are omitted by default; see Omitting Headers for details.
res
for HTTP responses.
The response object is trimmed to a set of essential fields.
headers
for tracing headers.
Certain headers are omitted by default; see Omitting Headers for details.
All other fields will be logged directly.
You can type common sets of fields to enforce consistent logging across your application(s). Compatibility should be maintained with the existing serializer functions.
// Declare a TypeScript type for your log fields.
interface Fields {
activity: string;
err?: Error;
}
// Supply it as a type parameter for code completion and compile-time checking.
logger.trace<Fields>(
{
activity: 'Getting all the things',
},
'Request initiated',
);
logger.error<Fields>(
{
activity: 'Getting all the things',
err,
},
'Request failed',
);
Bearer tokens are redacted regardless of their placement in the log object.
Some property paths are redacted by default. See defaultRedact
in
src/redact/index.ts for the path list.
Additional property paths can be redacted using the redact
logger option as per
pino redaction.
Note that pino
only supports either redaction or removal of the properties, not
redaction of some properties and removal of other properties.
If you would like to redact some properties and remove others, you are recommended to
configure redact
with the list of paths to redact and provide a custom serializer to
omit specific properties from the logged object.
Custom serializers can be provided with the serializers
logger option as described in
pino serializers and is the strategy used for omitting default headers.
Specific headers defined in DEFAULT_OMIT_HEADER_NAMES
are omitted from the following properties:
headers
req.headers
This behaviour can be configured with the omitHeaderNames
option.
DEFAULT_OMIT_HEADER_NAMES
list and appending your own list.Example of extending the default header list:
-import createLogger from '@seek/logger';
+import createLogger, { DEFAULT_OMIT_HEADER_NAMES } from '@seek/logger';
const logger = createLogger({
name: 'my-app',
+ omitHeaderNames: [...DEFAULT_OMIT_HEADER_NAMES, 'dnt' , 'sec-fetch-dest']
});
The following trimming rules apply to all logging data:
Avoid logging complex structures such as buffers, deeply nested objects and long arrays. Trimming operations are not cheap and may lead to significant performance issues of your application.
While log depth is configurable via loggerOptions.maxObjectDepth
, we strongly discourage a log depth that exceeds the default of 4 levels.
Consider flattening the log structure for performance, readability and cost savings.
@seek/logger uses Pino under the hood. You can customise your logger by providing Pino options like so:
import createLogger, { pino } from '@seek/logger';
const logger = createLogger(
{
name: 'my-app',
...myCustomPinoOptions,
},
myDestination,
);
const extremeLogger = createLogger({ name: 'my-app' }, pino.extreme());
Note: createLogger
mutates the supplied destination in order to redact sensitive data.
@seek/logger supports Pino-compatible pretty printers.
For example, you can install pino-pretty as a devDependency
:
yarn add --dev pino-pretty
Then selectively enable pretty printing when running your application locally:
import createLogger from '@seek/logger';
const logger = createLogger({
name: 'my-app',
transport:
process.env.ENVIRONMENT === 'local' ? { target: 'pino-pretty' } : undefined,
});
See docs/testing.md.
10.0.0
Enforce stricter typing for logger methods (#182)
This is a breaking change to the types, improving type safety by enforcing stricter parameter typing on all logger methods.
Existing code that passes metadata after the message string will need to be updated. This pattern was previously silently ignoring the metadata, but now triggers a type error to prevent data loss.
Before (no longer works):
logger.error('my message', { err, metadata });
In this pattern, any metadata passed after the message string is not captured by the logger.
After (correct usage):
logger.error({ err, metadata }, 'my message');
This ensures all metadata is properly captured and logged.
Drop support for Node.js 18.x (#181)
Node.js 18 reached EOL in April 2025. The minimum supported version is now Node.js 20.9.0.
destination
type (#177)FAQs
Standardized logging
The npm package @seek/logger receives a total of 6,927 weekly downloads. As such, @seek/logger popularity was classified as popular.
We found that @seek/logger demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.
Research
/Security News
Undocumented protestware found in 28 npm packages disrupts UI for Russian-language users visiting Russian and Belarusian domains.
Research
/Security News
North Korean threat actors deploy 67 malicious npm packages using the newly discovered XORIndex malware loader.