// ❌ console.log — not enough for production
console.log('User logged in:', userId);
console.log('Error:', err);

// These tell you something happened, but:
// - Can't search/filter by log level
// - No structured data (just text)
// - No timestamps by default
// - Can't trace a single request across services
// - No way to alert when error rates spike

Structured vs Unstructured Logging:

console.log:                                           Pino Logger:
"User 123 logged in from 192.168.1.1"                  {"level":30,"time":1712345678000,
                                                        "msg":"User logged in",
┌─────────────────────────────────────────────┐         "userId":123,
│ Can you grep for userId:123?                 │         "ip":"192.168.1.1",
│ Is "logged in" info or debug?                │         "service":"auth",
│ What timestamp format is that?                │         "requestId":"abc-123",
└─────────────────────────────────────────────┘         "latency":42}
                                                        ┌──────────────────────────────┐
                                                        │ Parseable by log aggregators │
                                                        │ Filterable by level/service  │
                                                        │ Searchable by userId          │
                                                        └──────────────────────────────┘

flowchart TD
    subgraph App["Node.js Application"]
        A["Application Logs<br/>(Pino/Winston)"]
        B["HTTP Logs<br/>(Morgan)"]
        C["Metrics<br/>(Prometheus client)"]
        D["Health Checks<br/>(/health endpoint)"]
    end

    subgraph Collection["Log Collection"]
        E["File System<br/>log files"]
        F["stdout/stderr<br/>(Docker/K8s)"]
    end

    subgraph Aggregation["Log Aggregation"]
        G["Logstash / Fluentd"]
        H["Elasticsearch"]
        I["Loki"]
    end

    subgraph Visualization["Visualization"]
        J["Kibana / Grafana"]
        K["Datadog / New Relic"]
    end

    subgraph Alerting["Alerting"]
        L["PagerDuty / OpsGenie"]
        M["Slack / Email"]
    end

    A --> E
    A --> F
    B --> F
    C --> G
    D --> H
    E --> G
    F --> G
    F --> I
    G --> H
    G --> K
    H --> J
    I --> J
    J --> L
    K --> L
    L --> M

// Pino's output format
{
  "level": 30,        // 30=info, 40=warn, 50=error
  "time": 1712345678000,
  "pid": 1234,
  "hostname": "server-1",
  "msg": "Server started",
  "service": "my-app"
}

flowchart TD
    Event["Something Happens"] --> Decide{"What is it?"}

    Decide -->|"Debugging info"| Debug["🐛 debug<br/>Only in development"]
    Decide -->|"Normal operation"| Info["ℹ️ info<br/>Startup, shutdown, state changes"]
    Decide -->|"Unexpected but handled"| Warn["⚠️ warn<br/>High memory, slow query, retry attempt"]
    Decide -->|"Operation failed"| Error["❌ error<br/>DB down, uncaught error, payment failed"]
    Decide -->|"App cannot continue"| Fatal["💀 fatal<br/>Corrupt state, out of memory"]

    Debug --> Dev["Only shown in development"]
    Info --> Prod["Shown in all environments"]
    Warn --> Prod
    Error --> Prod
    Error --> Alert["🚨 Send alert"]
    Fatal --> Alert

flowchart TD
    subgraph Services["Microservices"]
        Auth["Auth Service"]
        API["API Service"]
        Worker["Worker Service"]
    end

    subgraph Logging["Each service has:"]
        L1["Pino Logger"]
        L2["Morgan HTTP Logger"]
        L3["Health Endpoint"]
        L4["Metrics Endpoint"]
    end

    subgraph Output["Outputs"]
        O1["stdout (JSON)"]
        O2["Error file (rotated)"]
    end

    subgraph External["External Services"]
        E1["Elasticsearch"]
        E2["Prometheus"]
        E3["Sentry"]
        E4["Grafana"]
    end

    Auth --> L1
    API --> L1
    Worker --> L1
    L1 --> O1
    L2 --> O1
    L3 --> E2
    L4 --> E2
    O1 --> E1
    L1 --> O2
    O2 --> E1
    L1 -.->|"Errors only"| E3

sequenceDiagram
    participant C as Client
    participant G as Gateway
    participant A as Auth Service
    participant DB as Database

    Note over C,DB: Request starts — generate correlation ID

    C->>G: GET /api/users?traceId=abc123
    G->>G: Log: incoming request (level: info)
    G->>A: Forward with traceId
    A->>A: Log: auth check started (level: info)
    A->>DB: Query user
    DB-->>A: User data
    A->>A: Log: auth check complete (level: info, latency: 42ms)
    A-->>G: User authorized
    G->>G: Log: response sent (level: info, status: 200)
    G-->>C: Response

    Note over C,DB: All logs share traceId=abc123
    Note over C,DB: Log aggregator can trace the full request flow

const pino = require('pino');

// Basic setup
const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  transport: process.env.NODE_ENV !== 'production'
    ? { target: 'pino-pretty', options: { colorize: true } }
    : undefined,
});

// Logging
logger.info('Server started');
logger.info({ port: 3000 }, 'Server listening');
logger.warn({ user: 'alice' }, 'Login from unknown IP');
logger.error({ err }, 'Database connection failed');

// Child logger (adds context to all subsequent logs)
const child = logger.child({ service: 'auth', requestId: 'abc-123' });
child.info('User authenticated'); // Includes { service: 'auth', requestId: 'abc-123' }

const winston = require('winston');

const logger = winston.createLogger({
  level: process.env.LOG_LEVEL || 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.errors({ stack: true }),
    winston.format.json(),
  ),
  defaultMeta: { service: 'my-api' },
  transports: [
    new winston.transports.Console({ format: winston.format.json() }),
    new winston.transports.File({ filename: 'logs/error.log', level: 'error', maxsize: 5242880 }),
  ],
});

const express = require('express');
const pino = require('pino');
const { v4: uuidv4 } = require('uuid');

const app = express();
const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  redact: {
    paths: ['password', 'token', 'authorization', 'headers.authorization'],
    censor: '[REDACTED]',
  },
});

// Request ID middleware
app.use((req, res, next) => {
  req.id = uuidv4();
  req.log = logger.child({ requestId: req.id });
  next();
});

// Morgan → Pino integration
const morgan = require('morgan');
app.use(morgan('combined', {
  stream: { write: (msg) => logger.info(msg.trim()) },
}));

app.get('/users', async (req, res) => {
  req.log.info('Fetching users list');

  try {
    const users = await User.find({}).lean();
    req.log.info({ count: users.length }, 'Users fetched successfully');
    res.json({ data: users });
  } catch (err) {
    req.log.error({ err }, 'Failed to fetch users');
    res.status(500).json({ error: 'Internal server error' });
  }
});

app.listen(3000, () => {
  logger.info({ port: 3000 }, 'Server started');
});

const os = require('os');
const mongoose = require('mongoose');
const redis = require('ioredis');

// Simple health check
app.get('/health', async (req, res) => {
  const health = {
    status: 'healthy',
    uptime: process.uptime(),
    timestamp: Date.now(),
    memory: {
      heapUsed: Math.round(process.memoryUsage().heapUsed / 1024 / 1024) + 'MB',
      heapTotal: Math.round(process.memoryUsage().heapTotal / 1024 / 1024) + 'MB',
    },
    cpu: os.loadavg(),
  };
  res.json(health);
});

// Detailed health check with dependency checks
app.get('/health/detailed', async (req, res) => {
  const checks = {
    server: { status: 'ok' },
    database: { status: 'unknown' },
    redis: { status: 'unknown' },
  };

  // Check MongoDB
  try {
    await mongoose.connection.db.admin().ping();
    checks.database = { status: 'ok', responseTime: '5ms' };
  } catch (err) {
    checks.database = { status: 'error', message: err.message };
  }

  // Check Redis
  try {
    const start = Date.now();
    await redis.ping();
    checks.redis = { status: 'ok', responseTime: `${Date.now() - start}ms` };
  } catch (err) {
    checks.redis = { status: 'error', message: err.message };
  }

  const allHealthy = Object.values(checks).every(c => c.status === 'ok');
  res.status(allHealthy ? 200 : 503).json({
    status: allHealthy ? 'healthy' : 'degraded',
    checks,
  });
});

const promClient = require('prom-client');

// Collect default metrics (CPU, memory, event loop, garbage collection)
promClient.collectDefaultMetrics();

// HTTP request counter
const httpRequestCounter = new promClient.Counter({
  name: 'http_requests_total',
  help: 'Total number of HTTP requests',
  labelNames: ['method', 'path', 'status'],
});

// Request duration histogram
const httpRequestDuration = new promClient.Histogram({
  name: 'http_request_duration_seconds',
  help: 'HTTP request duration in seconds',
  labelNames: ['method', 'path'],
  buckets: [0.01, 0.05, 0.1, 0.5, 1, 5], // Buckets for latency distribution
});

// Active requests gauge
const activeRequests = new promClient.Gauge({
  name: 'http_requests_active',
  help: 'Number of active HTTP requests',
});

// Error counter
const errorCounter = new promClient.Counter({
  name: 'http_errors_total',
  help: 'Total number of HTTP errors',
  labelNames: ['method', 'path', 'status', 'type'],
});

// Middleware to record metrics
app.use((req, res, next) => {
  activeRequests.inc();
  const start = Date.now();

  res.on('finish', () => {
    const duration = (Date.now() - start) / 1000;
    const path = req.route?.path || req.path;

    httpRequestCounter.inc({ method: req.method, path, status: res.statusCode });
    httpRequestDuration.observe({ method: req.method, path }, duration);

    if (res.statusCode >= 400) {
      errorCounter.inc({
        method: req.method,
        path,
        status: res.statusCode,
        type: res.statusCode >= 500 ? 'server' : 'client',
      });
    }

    activeRequests.dec();
  });

  next();
});

// Metrics endpoint for Prometheus
app.get('/metrics', async (req, res) => {
  res.set('Content-Type', promClient.register.contentType);
  res.end(await promClient.register.metrics());
});

const Sentry = require('@sentry/node');
const { ProfilingIntegration } = require('@sentry/profiling-node');
const pino = require('pino');

// Initialize Sentry
Sentry.init({
  dsn: process.env.SENTRY_DSN,
  environment: process.env.NODE_ENV,
  tracesSampleRate: process.env.NODE_ENV === 'production' ? 0.1 : 1.0,
  integrations: [new ProfilingIntegration()],
  beforeSend(event) {
    // Don't send events in development
    if (process.env.NODE_ENV === 'development') return null;
    return event;
  },
});

// Logger setup
const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  redact: ['password', 'token'],
});

// Sentry request handler (adds request context)
app.use(Sentry.Handlers.requestHandler());
app.use(Sentry.Handlers.tracingHandler());

// Routes
app.get('/api/orders/:id', async (req, res) => {
  try {
    const order = await Order.findById(req.params.id);
    if (!order) {
      return res.status(404).json({ error: 'Order not found' });
    }
    res.json(order);
  } catch (err) {
    // Log structured error
    logger.error({
      err,
      orderId: req.params.id,
      userId: req.user?.id,
    }, 'Failed to fetch order');

    // Send to Sentry
    Sentry.captureException(err, {
      tags: { orderId: req.params.id },
      user: { id: req.user?.id },
    });

    res.status(500).json({ error: 'Internal server error' });
  }
});

// Sentry error handler (must be last)
app.use(Sentry.Handlers.errorHandler({
  shouldHandleError(error) {
    return error.status >= 500;
  },
}));

// 404 handler
app.use((req, res) => {
  res.status(404).json({ error: 'Not found' });
});

// Avoid logging in hot paths (every request)
for (const item of items) {
  logger.debug({ item }); // 1000 items = 1000 log lines!
}

// ✅ Log at appropriate aggregation level
logger.info({ count: items.length }, 'Processed items');

// ❌ Logging passwords and tokens
logger.info({ password: req.body.password }, 'Login attempt');

// ✅ Redact sensitive fields
const logger = pino({
  redact: ['password', 'token', 'secret', 'authorization'],
});

// ❌ Logging entire request objects (may contain auth headers)
logger.info({ req }, 'Request received');

// ❌ User input in log message — attacker can inject newlines
logger.info(`User ${req.body.name} registered`); // "User John\n[ERROR] System breached"

// ✅ Use structured fields — values are escaped
logger.info({ userName: req.body.name }, 'User registered');

// ✅ Production logging setup
const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  redact: ['password', 'token', 'secret'],
  formatters: {
    level(label, number) { return { level: label }; },
  },
});

// ✅ Always use child loggers for request context
req.log = logger.child({ requestId: req.id, method: req.method, url: req.url });

// ✅ Log at appropriate levels
req.log.info({ userId: user.id }, 'User authenticated');
req.log.warn({ ip: req.ip }, 'Failed login attempt');      // Expected but notable
req.log.error({ err }, 'Database connection failed');       // Requires investigation

const express = require('express');
const app = express();

// Bug 1: No structured logger — using console.log
app.get('/users', async (req, res) => {
  console.log('Getting users'); // Can't search, filter, or set levels

  // Bug 2: Logging sensitive data!
  console.log('Auth header:', req.headers.authorization);

  try {
    const users = await User.find({});
    res.json(users);
  } catch (err) {
    // Bug 3: Logging error without context
    console.log('Error:', err.message);
    // Bug 4: No request ID — can't correlate logs
    res.status(500).json({ error: 'Failed' });
  }
});

// Bug 5: No health check endpoint!
// Kubernetes can't tell if this app is healthy

// Quick reference: Logging & Monitoring

// 1. Pino setup
const pino = require('pino');
const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  redact: ['password', 'token'],
});

// 2. Log levels
logger.debug('Debug info');                      // Only in dev
logger.info({ port: 3000 }, 'Server started');   // Normal ops
logger.warn('High memory');                       // Notable
logger.error({ err }, 'Failed');                  // Alert-worthy

// 3. Health check
app.get('/health', (req, res) => {
  res.json({ status: 'healthy', uptime: process.uptime() });
});

// 4. Prometheus metrics
const promClient = require('prom-client');
promClient.collectDefaultMetrics();
const counter = new promClient.Counter({ name: 'requests_total', help: '...' });
counter.inc({ method: 'GET', path: '/users' });

// 5. Metrics endpoint
app.get('/metrics', async (req, res) => {
  res.set('Content-Type', promClient.register.contentType);
  res.end(await promClient.register.metrics());
});