Replace console.log with structured logging using Winston or Pino #161

Activity

1. Josie123-Dev

   added

   backendBackend related issuesBackend related issues

   observabilityLogging, monitoring, tracingLogging, monitoring, tracing

   difficulty:hardHard difficulty issuesHard difficulty issues

   priority:highHigh priority issuesHigh priority issues

   Maybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox reward

   GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSS

   Official Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26

   Third CampaignCampaign: Third CampaignCampaign: Third Campaign

   and removed

   Official Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26

   on Aug 23, 2026
2. Wilfred007 commented on Aug 23, 2026

   

   Wilfred007

   on Aug 23, 2026 – with GrantFox OSS

   Contributor

   More actions

   Hi! I’d like to work on this structured logging improvement. I can migrate the backend from console.log/console.error to a production-ready Pino-based logging system while keeping observability and security in focus.

   My approach would include:

   Configuring nestjs-pino as the NestJS logger with debug, info, warn, and error levels.
   Replacing scattered console calls with structured logger methods.
   Adding request IDs and correlation IDs, including request method, path, status, and duration.
   Including relevant user/request context while filtering sensitive health or credential data.
   Using JSON logs in production and readable pretty-printing in development.
   Adding LOG_LEVEL to .env.example.
   Testing logging behavior, request context, error handling, and sensitive-data redaction.

   I’ll keep the implementation aligned with the existing Sentry/Datadog setup so the resulting logs are easy to search, correlate, and monitor in production.
3. grantfox-oss

   assigned

   Wilfred007

   on Aug 23, 2026
4. grantfox-oss commented on Aug 23, 2026

   

   grantfox-ossbot

   on Aug 23, 2026 – with GrantFox OSS

   More actions

   🦊 GrantFox — @Wilfred007 has been assigned to this issue as part of the Third Campaign campaign!

   Next steps:

   1. Open a Pull Request referencing this issue (e.g., Closes #161)
   2. Your PR will be reviewed by the GuardZero144 maintainers

   Good luck! Track your progress on GrantFox.
5. meshackyaro commented on Aug 23, 2026

   

   meshackyaro

   on Aug 23, 2026 – with GrantFox OSS

   Contributor

   More actions

   Hi, I'd like to work on this issue. I'd ensure to implement structured logging across the NestJS backend.

   Approach & Technical Implementation

   1. Library Selection & Bootstrap Setup

   • nestjs-pino Integration: Install nestjs-pino and pino-http along with pino-pretty for development. pino offers superior performance compared to Winston, featuring low overhead and native JSON output.
   • NestJS Logger Override: Configure LoggerModule in AppModule and pass app.useLogger(app.get(Logger)) inside backend/src/main.ts to fully replace NestJS's default internal logger.

   2. Contextual Request Logging & Correlation IDs

   • Automatic Request Context: Use pino-http middleware to automatically capture method, url, statusCode, responseTime, and HTTP headers for incoming requests.
   • Correlation IDs: Extract incoming X-Request-ID or X-Correlation-ID headers to bind to the logger context. Fall back to crypto.randomUUID() when headers are absent, ensuring every request has a stable tracking ID.
   • User Context: Bind authenticated user IDs (req.user?.id) dynamically into the request logger context inside the NestJS middleware/interceptor layer.

   3. Environment Formatting & Sensitive Data Redaction

   • Environment-Based Output: Use pino-pretty when NODE_ENV=development (npm run start:dev) for colored, human-readable console output. Switch directly to single-line JSON logs in production (npm run start:prod).
   • Dynamic Log Levels: Map LOG_LEVEL from environment variables (e.g., debug, info, warn, error) defaulting to info.
   • PII & Health Data Redaction: Use Pino’s built-in redact config to prevent leaking sensitive fields. Mask authorization tokens, passwords, and sensitive health records:

   redact: {
     paths: [
       'req.headers.authorization',
       'req.headers.cookie',
       '*.password',
       '*.token',
       '*.healthData',
       '*.ssn',
     ],
     censor: '[REDACTED]',
   }

   Execution Plan

   • Phase 1 (Setup & Configuration): Add nestjs-pino, pino-http, and pino-pretty to package.json. Define LOG_LEVEL in .env.example and wire LoggerModule into backend/src/main.ts and app.module.ts.
   • Phase 2 (Codebase Refactoring): Search and replace all existing console.log, console.error, console.warn, and standard Logger instances across backend/src/ with the injected PinoLogger / Nest JS Logger abstraction.
   • Phase 3 (Redaction & Middleware Testing): Verify sensitive header/body redaction, trace correlation ID assignment through custom middleware, and ensure proper error stack formatting.
   • Phase 4 (Validation): Confirm npm run start:dev streams formatted color logs and npm run start:prod emits valid, queryable single-line JSON objects.

   Ready to take this on as soon as assigned!
6. grantfox-oss commented on Aug 24, 2026

   

   grantfox-ossbot

   on Aug 24, 2026 – with GrantFox OSS

   More actions

   🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

   @Wilfred007's PR #174 was approved and merged by @Josie123-Dev.

   🏆 @Wilfred007: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,068 total points). Track your full progress on GrantFox.

   👏 Great work, @Wilfred007! Keep contributing to GuardZero144.
7. Josie123-Dev

   closed this as completedin #174on Aug 24, 2026