Gathering detailed insights and metrics for @opentelemetry/instrumentation-winston
Gathering detailed insights and metrics for @opentelemetry/instrumentation-winston
OpenTelemetry instrumentation for JavaScript modules
Installations
npm install @opentelemetry/instrumentation-winstonDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS
Min. Node Version
>=14
Node Version
18.20.5
NPM Version
lerna/6.6.2/node@v18.20.5+x64 (linux)
Score
81.7
Supply Chain
98.5
Quality
87.1
Maintenance
100
Vulnerability
99.6
License
Releases
1,644
instrumentation-pg: v0.51.0
instrumentation-pg-v0.51.0
Published on 28 Jan 2025
instrumentation-mysql2: v0.45.1
instrumentation-mysql2-v0.45.1
Published on 28 Jan 2025
instrumentation-cucumber: v0.14.0
instrumentation-cucumber-v0.14.0
Published on 28 Jan 2025
auto-instrumentations-node: v0.56.0
auto-instrumentations-node-v0.56.0
Published on 28 Jan 2025
instrumentation-fastify: v0.44.1
instrumentation-fastify-v0.44.1
Published on 20 Jan 2025
instrumentation-aws-lambda: v0.50.2
instrumentation-aws-lambda-v0.50.2
Published on 20 Jan 2025
Contributors
459
Languages
3
TypeScript
JavaScript
Shell
TypeScript (97.92%)
JavaScript (2.08%)
Shell (0.01%)
Love this project? Help keep it running — sponsor us today! 🚀
Developer
Download Statistics
Total Downloads
66,969,794
Last Day
204,612
Last Week
1,266,896
Last Month
4,986,928
Last Year
43,085,226
GitHub Statistics
745 Stars
2,217 Commits
549 Forks
17 Watching
16 Branches
459 Contributors
Bundle Size
15.06 kB
Minified
4.78 kB
Minified + Gzipped
Maintainers
3
Package Meta Information
Latest Version
0.44.0
Package Id
@opentelemetry/instrumentation-winston@0.44.0
Unpacked Size
62.87 kB
Size
13.73 kB
File Count
18
NPM Version
lerna/6.6.2/node@v18.20.5+x64 (linux)
Node Version
18.20.5
Publised On
18 Dec 2024
Total Downloads
Cumulative downloads
Total Downloads
66,969,794
Last day
9.2%
204,612
Compared to previous day
Last week
6.5%
1,266,896
Compared to previous week
Last month
34.7%
4,986,928
Compared to previous month
Last year
128.9%
43,085,226
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Peer Dependencies
1
Versions
OpenTelemetry instrumentation for winston
This module provides automatic instrumentation of the winston module to inject trace-context into Winston log records (log correlation) and to send Winston logging to the OpenTelemetry Logging SDK (log sending). It may be loaded using the @opentelemetry/sdk-trace-node package and is included in the @opentelemetry/auto-instrumentations-node bundle.
If total installation size is not constrained, it is recommended to use the @opentelemetry/auto-instrumentations-node bundle with @opentelemetry/sdk-node for the most seamless instrumentation experience.
Compatible with OpenTelemetry JS API and SDK 1.0+.
Installation
1npm install --save @opentelemetry/instrumentation-winston
Supported Versions
winstonversions>=1.0.0 <4
Log sending: winston versions >=3.0.0 <4
Usage
1const { NodeTracerProvider } = require('@opentelemetry/sdk-trace-node'); 2const logsAPI = require('@opentelemetry/api-logs'); 3const { 4 LoggerProvider, 5 SimpleLogRecordProcessor, 6 ConsoleLogRecordExporter, 7} = require('@opentelemetry/sdk-logs'); 8const { WinstonInstrumentation } = require('@opentelemetry/instrumentation-winston'); 9const { registerInstrumentations } = require('@opentelemetry/instrumentation'); 10 11const tracerProvider = new NodeTracerProvider(); 12tracerProvider.register(); 13 14// To start a logger, you first need to initialize the Logger provider. 15const loggerProvider = new LoggerProvider(); 16// Add a processor to export log record 17loggerProvider.addLogRecordProcessor( 18 new SimpleLogRecordProcessor(new ConsoleLogRecordExporter()) 19); 20logsAPI.logs.setGlobalLoggerProvider(loggerProvider); 21 22registerInstrumentations({ 23 instrumentations: [ 24 new WinstonInstrumentation({ 25 // See below for Winston instrumentation options. 26 }), 27 ], 28}); 29 30const winston = require('winston'); 31const logger = winston.createLogger({ 32 transports: [new winston.transports.Console()], 33}) 34logger.info('foobar'); 35// {"message":"foobar","trace_id":"e21c7a95fff34e04f77c7bd518779621","span_id":"b7589a981fde09f4","trace_flags":"01", ...}
Winston instrumentation options
| Option | Type | Description |
|---|---|---|
disableLogSending | boolean | Whether to disable log sending. Default false. |
logSeverity | SeverityNumber | Control severity level for log sending. Default SeverityNumber.UNSPECIFIED, it will use Winston Logger's current level when unspecified. |
disableLogCorrelation | boolean | Whether to disable log correlation. Default false. |
logHook | LogHookFunction | An option hook to inject additional context to a log record after trace-context has been added. This requires disableLogCorrelation to be false. |
Log sending
Winston Logger will automatically send log records to the OpenTelemetry Logs SDK if not explicitly disabled in config and @opentelemetry/winston-transport npm package is installed in the project. The OpenTelemetry SDK can be configured to handle those records, for example, sending them on to an OpenTelemetry collector for log archiving and processing. The example above shows a minimal configuration that emits OpenTelemetry log records to the console for debugging.
If the OpenTelemetry SDK is not configured with a Logger provider, then this will be a no-op.
Log sending can be disabled with the disableLogSending: true option. Log sending is only available for Winston version 3 and later.
1npm install --save @opentelemetry/winston-transport
Log correlation
Winston logger calls in the context of a tracing span will have fields identifying the span added to the log record. This allows correlating log records with tracing data. The added fields are (spec):
trace_idspan_idtrace_flags
After adding these fields, the optional logHook is called to allow injecting additional fields. For example:
1logHook: (span, record) => { 2 record['resource.service.name'] = provider.resource.attributes['service.name']; 3}
Log injection can be disabled with the disableLogCorrelation: true option.
Using OpenTelemetryTransportV3 without instrumentation
@opentelemetry/winston-transport package exports the Winston transport class that is used to send records to the OpenTelemetry Logs SDK. It can be used directly when configuring a Winston logger. For example:
1const logsAPI = require('@opentelemetry/api-logs'); 2const { 3 LoggerProvider, 4 SimpleLogRecordProcessor, 5 ConsoleLogRecordExporter, 6} = require('@opentelemetry/sdk-logs'); 7const { OpenTelemetryTransportV3 } = require('@opentelemetry/winston-transport'); 8const winston = require('winston'); 9 10 11// To start a logger, you first need to initialize the Logger provider. 12const loggerProvider = new LoggerProvider(); 13// Add a processor to export log record 14loggerProvider.addLogRecordProcessor( 15 new SimpleLogRecordProcessor(new ConsoleLogRecordExporter()) 16); 17logsAPI.logs.setGlobalLoggerProvider(loggerProvider); 18 19const logger = winston.createLogger({ 20 level: 'info', 21 transports: [ 22 new winston.transports.Console(), 23 new OpenTelemetryTransportV3() 24 ] 25});
[!IMPORTANT] Logs will be duplicated if
@opentelemetry/winston-transportis added as a transport inwinstonand@opentelemetry/instrumentation-winstonis configured withdisableLogSending: false.
Semantic Conventions
This package does not currently generate any attributes from semantic conventions.
Useful links
- For more information on OpenTelemetry, visit: https://opentelemetry.io/
- For more about OpenTelemetry JavaScript: https://github.com/open-telemetry/opentelemetry-js
- For help or feedback on this project, join us in GitHub Discussions
License
Apache 2.0 - See LICENSE for more information.
No vulnerabilities found.
Reason
all changesets reviewed
Reason
no dangerous workflow patterns detected
Reason
30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
no binaries found in the repo
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/open-telemetry/.github/SECURITY.md:1
- Info: Found linked content: github.com/open-telemetry/.github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/open-telemetry/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/open-telemetry/.github/SECURITY.md:1
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (30) are checked with a SAST tool
Reason
dependency not pinned by hash detected -- score normalized to 4
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/close-stale.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/close-stale.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/close-stale.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/close-stale.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/close-stale.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/close-stale.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/codeql-analysis.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/component-owners.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/component-owners.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/label-prs.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/label-prs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/label-prs.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/label-prs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/peer-api.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/peer-api.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr-title.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/pr-title.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please-validate.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/release-please-validate.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/release-please.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/release-please.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/release-please.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/release-please.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.pr.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:138: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:141: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:152: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:146: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:149: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:160: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/unit-test.yml:174: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:192: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:195: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:201: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/unit-test.yml:210: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-otel-deps.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/update-otel-deps.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-otel-deps.yaml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/update-otel-deps.yaml/main?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/release-please-validate.yaml:20
- Warn: npmCommand not pinned by hash: .github/workflows/release-please.yml:53
- Warn: npmCommand not pinned by hash: .github/workflows/test-all-versions.yml:149
- Warn: npmCommand not pinned by hash: .github/workflows/unit-test.yml:157
- Warn: npmCommand not pinned by hash: .github/workflows/update-otel-deps.yaml:35
- Info: 0 out of 35 GitHub-owned GitHubAction dependencies pinned
- Info: 1 out of 5 third-party GitHubAction dependencies pinned
- Info: 10 out of 15 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/label-prs.yml:9
- Warn: no topLevel permission defined: .github/workflows/close-stale.yml:1
- Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1
- Warn: no topLevel permission defined: .github/workflows/component-owners.yml:1
- Warn: no topLevel permission defined: .github/workflows/label-prs.yml:1
- Warn: no topLevel permission defined: .github/workflows/lint.yml:1
- Warn: no topLevel permission defined: .github/workflows/peer-api.yaml:1
- Warn: no topLevel permission defined: .github/workflows/pr-title.yml:1
- Warn: no topLevel permission defined: .github/workflows/release-please-validate.yaml:1
- Warn: no topLevel permission defined: .github/workflows/release-please.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-all-versions.pr.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-all-versions.push.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-all-versions.yml:1
- Warn: no topLevel permission defined: .github/workflows/unit-test.yml:1
- Warn: no topLevel permission defined: .github/workflows/update-otel-deps.yaml:1
- Info: no jobLevel write permissions found
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
22 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-7v5v-9h63-cj86
- Warn: Project is vulnerable to: GHSA-8hc4-vh64-cxmj
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-rrr8-f88r-h8q6
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-m5vv-6r4h-3vj9
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-x3cc-x39p-42qx
- Warn: Project is vulnerable to: GHSA-2j2x-2gpw-g8fm
- Warn: Project is vulnerable to: GHSA-4jv9-3563-23j3
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
- Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc
Score
6.5
/10
Last Scanned on 2025-02-03
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More