DEV Community

QuintonShaw1483
QuintonShaw1483

Posted on

Node.js SaaS Application Logging: Request IDs, Trace Context, and PII Masking

#observability #node #logging

Short answer: Emit one JSON object per application event, carry request_id and W3C trace_id through every asynchronous boundary, attach a stable internal user_id only where authorization permits it, and mask sensitive fields before they reach the logging sink. For scheduled e-commerce imports, add a result event with tenant, job, outcome, duration, and item counts; alert on the absence of successful results, not merely on process errors.

The page arrives at 03:17: “catalog import has produced no successful result for 45 minutes.” The on-call view should already answer which tenant and import type are affected, when the last success occurred, which execution owns the current trace, and whether the worker is running but returning zero records. If the first response is to search unstructured strings across every service, the logging contract failed before the scheduler did.

This distinction matters. A worker can be healthy, its queue can be moving, and every HTTP call can return an expected status while a supplier feed silently produces no usable products. CPU, memory, and error-rate alerts won't catch that business failure. A result-bearing log event will, provided it has stable fields and a retention policy that the team can afford.

How can Node.js SaaS JSON logs link request ID, user ID, and trace ID without exposing PII?

Treat the log schema as an interface. Every event needs a timestamp, severity, event name, service name, deployment environment, and schema version. Request-scoped events should carry request_id; distributed work should carry the W3C trace_id and, when available, span_id. Authenticated activity may carry an opaque internal user_id, but not an email address, access token, session cookie, payment detail, or raw request body. Scheduled work needs job_id, tenant_id, import_type, outcome, duration_ms, and bounded result counters such as items_read, items_accepted, and items_rejected.

The IDs answer different questions. A request ID is an application correlation handle and can include retries or work outside a tracing system. A trace ID joins operations that participate in one distributed trace. A user ID supports authorization-aware investigation and cost attribution, but it must remain an opaque identifier with controlled access. Don't collapse them into one field. Their lifetimes and access rules differ.

Use low-cardinality names for event types and outcomes: catalog_import.completed and success are queryable; an event name containing a tenant, filename, or error sentence is not. Put variable details in separate fields, cap string lengths, and reject unexpected objects. The same capacity-planning reflex applies to logs as to databases: an unconstrained field is an unbounded storage decision disguised as convenience.

PII masking belongs at the application boundary, before serialization and transport. An allowlist is safer than a denylist because new input fields remain absent by default. Where a sensitive value has legitimate correlation value, use a keyed pseudonym created by an approved cryptographic service and document its rotation and access model; plain hashing of a small domain, such as phone numbers, is susceptible to guessing. I'm not sure which fields your legal team classifies as personal data, because jurisdiction and product use matter, so the schema review needs named security and privacy owners rather than an engineer's guess.

Four states hidden behind one stale-import page

Start with the action the alert permits. For the stalled import, the responder needs to distinguish four states: the schedule did not trigger; execution started but never completed; execution completed with a rejected or empty result; or successful results exist but the freshness calculation is wrong. A single error log can't represent those states. Emit lifecycle events at the transitions that establish them, then derive the page from the last observed successful result for each tenant and import type.

The earlier signal is usually a freshness SLI: elapsed time since a valid catalog_import.completed event with outcome="success" and an acceptable result count. Define “acceptable” from the business contract. Zero may be valid for a narrow supplier, while a drop from 8,400 accepted items to 0 for the primary catalog deserves investigation. Avoid turning that comparison into a per-tenant alert rule without a capacity estimate; 2,000 tenants times several import types, regions, and outcomes can make both query cost and on-call volume climb quickly.

Here is the trace the on-call should be able to follow:

  1. The page names the affected tenant, import type, freshness objective, and last successful result time.
  2. The result event links to the execution through job_id and trace_id.
  3. Start and completion events reveal whether the scheduler, worker, upstream response, or validation stage stopped progress.
  4. Request events explain remote dependencies through status classes and durations, without recording bodies or credentials.

Keep logs and metrics in separate roles. Logs preserve bounded diagnostic context; metrics evaluate the SLI cheaply and continuously. Export a counter for completed imports and a gauge or derived metric for last-success time, using base units and a consistent naming convention. The log-to-metric transform must be monitored too — otherwise a broken pipeline looks exactly like a stopped import. This is also why the page should show the age of the telemetry itself.

No heroics required.

Preserve causality across asynchronous boundaries

In Node.js, request context commonly crosses promises, timers, queue callbacks, and outbound calls. Use the runtime's asynchronous context mechanism to store correlation values when a request or job begins, then retrieve that context inside the logger rather than passing a loose map through every function. Accept a valid incoming W3C traceparent through your tracing layer, create a request ID at the trust boundary when one is absent, and never trust a caller-supplied user or tenant identity; those values must come from authenticated claims and authorization decisions.

The following Go component demonstrates the language-independent contract at a log ingestion boundary. The application sends structured fields to this boundary; the allowlist keeps unknown data out, and the recursive masker replaces sensitive keys before JSON encoding. A production version also needs authenticated transport, size limits, backpressure behavior, and tests for nested arrays and schema evolution.

package logging

import (
    "encoding/json"
    "io"
    "strings"
    "time"
)

var allowed = map[string]bool{
    "event": true, "service": true, "environment": true,
    "request_id": true, "trace_id": true, "span_id": true,
    "user_id": true, "tenant_id": true, "job_id": true,
    "import_type": true, "outcome": true, "duration_ms": true,
    "items_read": true, "items_accepted": true, "items_rejected": true,
}

var sensitive = map[string]bool{
    "authorization": true, "cookie": true, "email": true,
    "password": true, "token": true, "card_number": true,
}

func WriteEvent(w io.Writer, input map[string]any) error {
    event := map[string]any{
        "timestamp":      time.Now().UTC().Format(time.RFC3339Nano),
        "schema_version": 1,
    }
    for key, value := range input {
        if allowed[key] {
            event[key] = mask(value)
        }
    }

    return json.NewEncoder(w).Encode(event)
}

func mask(value any) any {
    switch typed := value.(type) {
    case map[string]any:
        clean := make(map[string]any, len(typed))
        for key, nested := range typed {
            if sensitive[strings.ToLower(key)] {
                clean[key] = "[REDACTED]"
                continue
            }
            clean[key] = mask(nested)
        }
        return clean
    case []any:
        clean := make([]any, len(typed))
        for index, nested := range typed {
            clean[index] = mask(nested)
        }
        return clean
    default:
        return typed
    }
}
Enter fullscreen mode Exit fullscreen mode

There is a deliberate catch: because the top-level allowlist admits only scalar contract fields in this example, arbitrary request payloads never enter the event. The recursive masker is defense in depth for future nested fields, not permission to log whole objects. Test the contract with known secrets, mixed-case key names, arrays, oversized values, invalid identifiers, and a canary value that the pipeline must never retain. Also test context loss across each queue and timer boundary; a syntactically valid JSON event with an empty trace ID is still operationally incomplete.

At deployment time, roll out the schema version before making a new field mandatory in alerts. Observe missing-field rates, verify that timestamps remain UTC and parseable, and sample actual event sizes. It's tempting to log every intermediate state during the rollout — resist that until the storage and query budget has an owner.

Every indexed field needs a cost owner

Cost attribution is not a billing dashboard added after launch. It begins with fields that map consumption to an accountable unit without leaking customer data. For this system, tenant_id, service, environment, event, and schema_version support useful allocation. High-cardinality IDs such as request_id, trace_id, and job_id remain essential for investigation, but they should not become metric labels; keep them in logs and traces, where indexed-field choices and retention tiers can be controlled.

Decision Managed service Self-hosted pipeline
Cost attribution Usually exposes ingestion, indexing, and retention usage; verify tenant-level export You own allocation logic across storage, compute, network, and on-call time
Operational load Less infrastructure to operate, with contract and lock-in review required Full control, plus upgrades, scaling, backups, and incident response
Query and retention Convenient policy controls may carry ingestion or index trade-offs Flexible tiers, but capacity errors become your pages
Data governance Confirm region, access, deletion, and field controls Greater placement control does not remove governance work

The buy-versus-build decision should use total operating cost, not storage price alone. Estimate daily event count multiplied by mean encoded bytes, replication, indexed-field overhead, retention days, query concurrency, and expected growth; then add engineering and on-call time. Measure before committing. A 1 KB average assumption that ignores stack traces, repeated attributes, and accidental payloads can miss the real ingestion shape by enough to invalidate the plan.

Managed logging is not suitable when contractual data placement, custom deletion semantics, or predictable very-high-volume economics cannot be met. A self-hosted pipeline is a poor fit when the team cannot staff upgrades, durability tests, capacity reviews, and 24-hour incident ownership. Stick with the option whose failure modes the team can fund and rehearse. Portability also has a price: standard JSON and trace context reduce migration friction, but query languages, index behavior, alert semantics, and retention controls still need deliberate abstraction or accepted lock-in.

When should missing import results consume error budget?

Define the user-visible objective first: for example, each in-scope catalog import must produce a valid result within its agreed freshness window. The exact window cannot be invented from infrastructure data; product owners need to state how stale a catalog may become before buyers or operations are harmed. Once that objective exists, alert on meaningful budget consumption or sustained freshness violation, not on a single missed tick.

The catch is sensitivity. A 15-minute threshold detects a real stall sooner but pages on routine upstream delays; a 90-minute threshold lowers noise and extends customer impact before response. Grouping all tenants into one alert can hide the affected account, while one page per tenant can flood the on-call during a shared dependency event. Use routing and grouping that preserve tenant attribution in the evidence while deduplicating a common cause. Review false positives as an operational cost with an owner, just like ingestion: count pages that required no action, time spent proving health, and alerts silenced during known maintenance.

Don't bury that cost.

A sound initial rule requires two signals: stale successful-result time and fresh telemetry from the scheduler or worker. That pairing distinguishes “no import result” from “the observability path is absent.” Add an explicit maintenance state rather than teaching responders to ignore predictable alerts, and rehearse the runbook with synthetic scheduled work that contains no personal data. The final test is mundane but decisive: given only the page and authorized links, can a responder identify scope, last success, execution trace, and next action without constructing a new query under pressure?

References

Top comments (0)