Express 5 + pino-http structured request logging: working versions (tested 2026-10-15)

{
  "name": "express-pino-http-logging",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "express": "5.3.0",
    "pino": "10.4.0",
    "pino-http": "11.0.0"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2",
    "supertest": "7.3.1",
    "@types/supertest": "7.2.1",
    "@types/express": "5.0.6"
  }
}

import express from "express";
import pino from "pino";
import { pinoHttp } from "pino-http";
import { randomUUID } from "node:crypto";

export function createApp(stream?: pino.DestinationStream) {
  const logger = pino({ redact: ["req.headers.authorization", "req.headers.cookie"] }, stream);
  const app = express();
  app.use(pinoHttp({
    logger,
    genReqId: (req, res) => {
      const id = (req.headers["x-request-id"] as string) ?? randomUUID();
      res.setHeader("x-request-id", id);
      return id;
    },
  }));
  app.get("/orders/:id", (req, res) => {
    req.log.info({ orderId: req.params.id }, "loading order");
    res.json({ id: req.params.id });
  });
  return app;
}

import { test } from "node:test";
import assert from "node:assert/strict";
import { Writable } from "node:stream";
import request from "supertest";
import { createApp } from "../src/app.ts";

function capture() {
  const lines: any[] = [];
  const stream = new Writable({ write(chunk, _e, cb) { lines.push(JSON.parse(chunk.toString())); cb(); } });
  return { lines, stream };
}

test("logs with request id and redacts auth", async () => {
  const { lines, stream } = capture();
  const res = await request(createApp(stream as any)).get("/orders/42").set("x-request-id", "req-1").set("authorization", "Bearer secret");
  assert.equal(res.headers["x-request-id"], "req-1");
  const custom = lines.find((l) => l.msg === "loading order");
  assert.equal(custom.orderId, "42");
  assert.equal(custom.req.id, "req-1");
  const done = lines.find((l) => l.res?.statusCode === 200);
  assert.ok(done);
  assert.equal(done.req.headers.authorization, "[Redacted]");
});

test("generates a request id when none is sent", async () => {
  const { stream } = capture();
  const res = await request(createApp(stream as any)).get("/orders/1");
  assert.match(res.headers["x-request-id"], /^[0-9a-f-]{36}$/);
});