feat(logging, ai): add log capture with native transport injection by litianningdatadog · Pull Request #7522 · DataDog/dd-trace-js

litianningdatadog · 2026-02-13T03:39:04Z

https://datadoghq.atlassian.net/browse/SVLS-8572

The AWS Serverless team is exploring an approach that leverages dd-trace log injection to collect logs without depending on CloudWatch or the Log Forwarder. This would:
• Simplify the Datadog log ingestion setup
• Provide customers with potential cost savings

What does this PR do?

This PR implements native logger transport injection that automatically forwards application logs to a custom intake service by injecting HTTP transports/streams directly into Winston, Bunyan, and Pino loggers.

Implements automatic log forwarding for Winston, Bunyan, and Pino by injecting native HTTP transports/streams directly into logger instances.

Component Architecture

Key Features:

Zero-configuration automatic injection via diagnostic channels
Native transport/stream injection for Winston, Bunyan, and Pino
Full trace correlation - logs include trace_id, span_id, service, env, version
Non-invasive - logs still go to original destinations (stdout, files, etc.)
Single intake endpoint with automatic format detection
Configurable batching (default: 1000 logs or 5 seconds, whichever comes first)
Exit handlers ensure logs are flushed on process exit (critical for Lambda/serverless)

Implementation Approach:

Winston: Uses native winston.transports.Http with batching
Bunyan: Custom Writable stream in object mode with synchronous injection
Pino: Custom transport with NDJSON parsing and post-create multistream combination

Performance:

<5% overhead per log (benchmark-verified)
~20-110 KB memory usage (typical)
Non-blocking async I/O
725k-755k logs/sec throughput (Winston)

Test Coverage:

26 comprehensive test scenarios covering all user configurations
Tests validate injection works with: no transports, Console, File, multiple transports, pino-pretty, custom destinations, multistream, serializers, child loggers, dynamic
additions
Exit handler verification test
Performance benchmark tool

Motivation

Business Value:

Streamline Datadog log ingestion: Eliminate the need for a Log Forwarder to collect logs from CloudWatch
Potential cost savings for customers: By bypassing AWS CloudWatch in the log ingestion path, customers may reduce log storage costs
Faster time to value - no code changes required
Lower maintenance burden - works with all logger configurations
Improved reliability - native implementation, exit handlers prevent log loss
Better developer experience - transparent, automatic, performant

Why Native Transport Injection?

Zero Developer Burden

Works automatically with existing logger configurations
No code changes required
Supports ALL logger features and configurations
Drop-in replacement for wrapper approach

Native Performance

<5% overhead per log call (negligible)
Leverages logger-native transport mechanisms
Async I/O doesn't block application
Minimal memory footprint (~20-110 KB typical)

Critical for Lambda/Serverless

Exit handlers ensure logs are flushed on process termination
No logs lost when functions exit (30-second runtime example)
Configurable flush intervals (fast for tests, optimal for production)
Guaranteed delivery even if flush interval hasn't elapsed

Production Ready

Comprehensive test coverage (26 scenarios)
Benchmark-verified performance metrics
Supports all user transport configurations for Winston/Bunyan/Pino
Silent failures - never crashes user applications

Use Cases:

High-volume production applications (10k+ logs/min)
Lambda/serverless functions with short runtimes
Applications that can't modify logging code
Applications using advanced logger features (child loggers, custom transports, etc.)
Teams wanting centralized log management without code changes

github-actions · 2026-02-13T03:39:48Z

Overall package size

Self size: 4.89 MB
Deduped: 5.73 MB
No deduping: 5.73 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 2.0.6 | 81.92 kB | 816.75 kB | | dc-polyfill | 0.1.10 | 26.73 kB | 26.73 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

datadog-official · 2026-02-13T03:48:19Z

⚠️ Tests

✨ Fix all issues with BitsAI or with Cursor

⚠️ Warnings

❄️ 5 New flaky tests detected

can inject into multiple different loggers independently from Mocha Tests (Datadog) (Fix with Cursor)
Expected values to be strictly equal:

0 !== 1


      + expected - actual

      -0
      +1
      
...
logs error and does not throw when injection fails from Mocha Tests (Datadog) (Fix with Cursor)
The expression evaluated to a falsy value:

  assert.ok(log.error.called)


      + expected - actual

      -false
      +true
      
...
uses /logs as default path when logCapturePath is not set from Mocha Tests (Datadog) (Fix with Cursor)
Cannot read properties of null (reading 'args')
TypeError: Cannot read properties of null (reading 'args')
    at Context.<anonymous> (packages\dd-trace\test\plugins\log_plugin.spec.js:212:50)
    at process.processImmediate (node:internal/timers:504:21)
View all

🧪 7 Tests failed

esbuild support for IAST cjs "before all" hook in "cjs" from cjs (Datadog) (Fix with Cursor)
Command failed: npm run build

    iast/index.js:16:8:
      16 │         stringCase: noop,
         ╵         ~~~~~~~~~~

  The original key "stringCase" is here:

    iast/index.js:15:8:
      15 │         stringCase: noop,
...
esbuild support for IAST esm "before all" hook in "esm" from esm (Datadog) (Fix with Cursor)
Command failed: npm run build

    iast/index.mjs:15:8:
      15 │         stringCase: noop,
         ╵         ~~~~~~~~~~

  The original key "stringCase" is here:

    iast/index.mjs:14:8:
      14 │         stringCase: noop,
...
does not inject transport twice for the same logger from Mocha Tests (Datadog) (Fix with Cursor)
Expected values to be strictly equal:

0 !== 1


      + expected - actual

      -0
      +1
      
...
View all

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 4bb3175 | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback!}

pr-commenter · 2026-02-13T03:49:09Z

Benchmarks

Benchmark execution time: 2026-03-03 23:24:24

Comparing candidate commit 4bb3175 in PR branch tianning.li/log-network-transport-patch with baseline commit 895aac7 in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 229 metrics, 31 unstable metrics.

litianningdatadog · 2026-03-03T18:30:46Z

Code review

Found 9 issues:

Bugs

Channel subscriptions in _initializeWinstonTransport, _initializeBunyanStream, and _initializePinoTransport are created with raw channel.subscribe() instead of this.addSub(), so they are never added to this._subscriptions and are never unsubscribed when the plugin is disabled. The config object is permanently closed over from the first configure() call — subsequent calls with different settings are silently ignored for these paths.

dd-trace-js/packages/dd-trace/src/plugins/log_plugin.js

Lines 97 to 102 in df6a242

    
           this._winstonTransportSubscribed = true 
        
           addTransportCh.subscribe((logger) => { 
        
             log.info('Winston logger received via channel, attempting to inject HTTP transport') 
        
             try { 
        
               this._injectWinstonHttpTransport(logger, config)

Winston's createLogger() internally calls Logger.prototype.configure(). The existing instrumentation already wraps Logger.prototype.configure and publishes synchronously to the addTransport channel. The new createLogger hook publishes to the same channel again (via setImmediate), so every createLogger() fires the channel twice. The LogSubmissionPlugin (CI visibility) has no duplicate guard and will inject its transport twice per logger.

dd-trace-js/packages/datadog-instrumentations/src/winston.js

Lines 55 to 61 in df6a242

    
           // Use setImmediate to allow logger to fully initialize 
        
           if (addTransport.hasSubscribers) { 
        
             setImmediate(() => { 
        
               addTransport.publish(logger) 
        
             }) 
        
           } 
        
           return logger

Every pino() call creates a new Writable stream and a new setInterval flush timer via _createPinoHttpTransport. There is no duplicate guard equivalent to the _injectedLoggers WeakSet used for Winston/Bunyan (the Symbol.for('dd-trace-pino-transport-injected') property is set on the instance after the fact but is never checked before requesting a transport). Applications that create many Pino instances accumulate unbounded timers.

dd-trace-js/packages/dd-trace/src/plugins/log_plugin.js

Lines 261 to 270 in df6a242

    
           this._pinoTransportSubscribed = true 
        
           transportConfigCh.subscribe((configPayload) => { 
        
             log.info('Pino requesting transport config, providing HTTP transport') 
        
             try { 
        
               const transport = this._createPinoHttpTransport(config) 
        
               configPayload.transport = transport 
        
             } catch (err) { 
        
               log.error('Failed to create Pino HTTP transport: %s', err.message) 
        
             }

DD_LOG_CAPTURE_PROTOCOL is stored verbatim via setString with no normalization. The protocol selection is a strict === 'https:' check, so a user setting DD_LOG_CAPTURE_PROTOCOL=https (without trailing colon) silently falls back to plain HTTP with no warning.

dd-trace-js/packages/dd-trace/src/plugins/bunyan_http_stream.js

Lines 18 to 21 in df6a242

    
           this.path = options.path || '/logs' 
        
           this.protocol = options.protocol || 'http:' 
        
           this.httpModule = this.protocol === 'https:' ? https : http 
        
           this.timeout = options.timeout || 5000

CLAUDE.md violations

require('http'), require('https'), and require('stream') in both new files are missing the node: prefix. Additionally, require('stream') is inside the pinoHttpTransport factory function body rather than at module top-level. (CLAUDE.md says: "Node.js core modules (with node: prefix)")

dd-trace-js/packages/dd-trace/src/plugins/bunyan_http_stream.js

Lines 1 to 7 in df6a242

    
           'use strict' 
        
           const http = require('http') 
        
           const https = require('https') 
        
           const { Writable } = require('stream') 
        
           const log = require('../log')

dd-trace-js/packages/dd-trace/src/plugins/pino_http_transport.js

Lines 89 to 93 in df6a242

    
           // Return a Writable stream that Pino can write to 
        
           const { Writable } = require('stream') 
        
           const transport = new Writable({

null is used as an initial/sentinel value in let httpTransport = null (pino.js:15), let flushTimer = null (pino_http_transport.js), this.timer = null (bunyan_http_stream.js), and return null in _createPinoHttpTransport. (CLAUDE.md says: "Use undefined over null, if not required otherwise")

dd-trace-js/packages/datadog-instrumentations/src/pino.js

Lines 13 to 17 in df6a242

    
           return function pinoWithTrace () { 
        
             // Get HTTP transport from plugin if available 
        
             let httpTransport = null 
        
             if (transportConfigCh.hasSubscribers) { 
        
               const configPayload = {}

req.on('error', ...) and req.on('timeout', ...) are used on per-request ClientRequest objects in both _flush and flush. These events fire at most once per request. (CLAUDE.md says: "Use .once() methods instead of .on(), if the event is only needed once")

dd-trace-js/packages/dd-trace/src/plugins/bunyan_http_stream.js

Lines 85 to 95 in df6a242

    
           }) 
        
           req.on('error', (err) => { 
        
             // Silently fail - never crash the app 
        
             log.debug('Bunyan HTTP stream request failed: %s', err.message) 
        
           }) 
        
           req.on('timeout', () => { 
        
             req.destroy() 
        
             log.debug('Bunyan HTTP stream request timed out') 
        
           })

dd-trace-js/packages/dd-trace/src/plugins/pino_http_transport.js

Lines 60 to 69 in df6a242

    
           ) 
        
           req.on('error', () => { 
        
             // Silent failure - don't crash application 
        
           }) 
        
           req.on('timeout', () => { 
        
             req.destroy() 
        
           })

.filter(line => line.trim()) is called inside the Writable.write method, which runs on every log record Pino emits. (CLAUDE.md says: "Prefer for-of / for / while loops over forEach/map/filter in production code")

dd-trace-js/packages/dd-trace/src/plugins/pino_http_transport.js

Lines 97 to 103 in df6a242

    
           const chunkStr = chunk.toString() 
        
           // Split by newlines in case multiple logs in one chunk 
        
           const lines = chunkStr.split('\n').filter(line => line.trim()) 
        
           for (const line of lines) { 
        
             const log = JSON.parse(line) 
        
             buffer.push(log)

logCaptureTimeout is a millisecond-based value but lacks a unit suffix, inconsistent with logCaptureFlushIntervalMs added in the same PR. (CLAUDE.md says: "Size/time-based config options should have unit suffixes (e.g., timeoutMs, maxBytes, intervalSeconds)")

dd-trace-js/packages/dd-trace/src/config/defaults.js

Lines 129 to 133 in df6a242

    
           ciVisibilityTestSessionName: '', 
        
           ciVisAgentlessLogSubmissionEnabled: false, 
        
           legacyBaggageEnabled: true, 
        
           isTestDynamicInstrumentationEnabled: false, 
        
           isServiceUserProvided: false,

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

codecov · 2026-03-03T19:16:00Z

Codecov Report

❌ Patch coverage is 36.79245% with 67 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.22%. Comparing base (895aac7) to head (4bb3175).

Files with missing lines	Patch %	Lines
packages/dd-trace/src/plugins/log_plugin.js	20.00%	48 Missing ⚠️
packages/datadog-instrumentations/src/pino.js	6.25%	15 Missing ⚠️
packages/dd-trace/src/config/index.js	76.47%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #7522      +/-   ##
==========================================
- Coverage   80.28%   76.22%   -4.07%     
==========================================
  Files         738      643      -95     
  Lines       31897    27194    -4703     
==========================================
- Hits        25610    20729    -4881     
- Misses       6287     6465     +178

Flag	Coverage Δ
aiguard-macos	`38.99% <76.47%> (-0.04%)`	⬇️
aiguard-ubuntu	`39.11% <76.47%> (-0.04%)`	⬇️
aiguard-windows	`38.84% <76.47%> (-0.04%)`	⬇️
apm-capabilities-tracing-macos	`?`
apm-capabilities-tracing-ubuntu	`?`
apm-capabilities-tracing-windows	`?`
apm-integrations-child-process	`38.57% <76.47%> (-0.04%)`	⬇️
apm-integrations-couchbase-18	`37.50% <76.47%> (-0.07%)`	⬇️
apm-integrations-couchbase-eol	`37.98% <76.47%> (+0.11%)`	⬆️
apm-integrations-oracledb	`37.81% <76.47%> (-0.04%)`	⬇️
appsec-express	`55.38% <76.47%> (-0.05%)`	⬇️
appsec-fastify	`51.50% <24.73%> (-0.25%)`	⬇️
appsec-graphql	`51.69% <24.73%> (-0.24%)`	⬇️
appsec-kafka	`44.38% <76.47%> (-0.04%)`	⬇️
appsec-ldapjs	`44.07% <76.47%> (-0.04%)`	⬇️
appsec-lodash	`43.73% <76.47%> (-0.04%)`	⬇️
appsec-macos	`58.37% <76.47%> (-0.05%)`	⬇️
appsec-mongodb-core	`48.88% <76.47%> (+0.07%)`	⬆️
appsec-mongoose	`49.56% <76.47%> (-0.05%)`	⬇️
appsec-mysql	`50.92% <76.47%> (-0.04%)`	⬇️
appsec-node-serialize	`43.25% <76.47%> (-0.04%)`	⬇️
appsec-passport	`47.69% <76.47%> (-0.05%)`	⬇️
appsec-postgres	`50.67% <76.47%> (-0.02%)`	⬇️
appsec-sourcing	`42.65% <76.47%> (-0.04%)`	⬇️
appsec-template	`43.41% <76.47%> (-0.04%)`	⬇️
appsec-ubuntu	`58.45% <76.47%> (-0.05%)`	⬇️
appsec-windows	`58.23% <76.47%> (-0.05%)`	⬇️
instrumentations-instrumentation-bluebird	`32.38% <76.47%> (-0.03%)`	⬇️
instrumentations-instrumentation-body-parser	`40.54% <76.47%> (-0.04%)`	⬇️
instrumentations-instrumentation-child_process	`37.90% <76.47%> (-0.04%)`	⬇️
instrumentations-instrumentation-cookie-parser	`34.37% <76.47%> (-0.03%)`	⬇️
instrumentations-instrumentation-express	`34.70% <76.47%> (-0.03%)`	⬇️
instrumentations-instrumentation-express-mongo-sanitize	`34.50% <76.47%> (-0.03%)`	⬇️
instrumentations-instrumentation-express-session	`40.17% <76.47%> (-0.04%)`	⬇️
instrumentations-instrumentation-fs	`31.99% <76.47%> (-0.03%)`	⬇️
instrumentations-instrumentation-generic-pool	`29.73% <ø> (ø)`
instrumentations-instrumentation-http	`39.89% <76.47%> (-0.04%)`	⬇️
instrumentations-instrumentation-knex	`32.38% <76.47%> (-0.03%)`	⬇️
instrumentations-instrumentation-mongoose	`33.52% <76.47%> (-0.03%)`	⬇️
instrumentations-instrumentation-multer	`40.29% <76.47%> (-0.04%)`	⬇️
instrumentations-instrumentation-mysql2	`38.36% <76.47%> (-0.04%)`	⬇️
instrumentations-instrumentation-passport	`44.06% <76.47%> (-0.04%)`	⬇️
instrumentations-instrumentation-passport-http	`43.73% <76.47%> (-0.04%)`	⬇️
instrumentations-instrumentation-passport-local	`44.27% <76.47%> (-0.04%)`	⬇️
instrumentations-instrumentation-pg	`37.79% <76.47%> (-0.04%)`	⬇️
instrumentations-instrumentation-promise	`32.31% <76.47%> (-0.03%)`	⬇️
instrumentations-instrumentation-promise-js	`32.32% <76.47%> (-0.03%)`	⬇️
instrumentations-instrumentation-q	`32.36% <76.47%> (-0.03%)`	⬇️
instrumentations-instrumentation-url	`32.28% <76.47%> (-0.03%)`	⬇️
instrumentations-instrumentation-when	`32.33% <76.47%> (-0.03%)`	⬇️
llmobs-ai	`42.01% <76.47%> (-0.04%)`	⬇️
llmobs-anthropic	`40.35% <76.47%> (-0.04%)`	⬇️
llmobs-bedrock	`39.30% <76.47%> (-0.03%)`	⬇️
llmobs-google-genai	`39.88% <76.47%> (-0.04%)`	⬇️
llmobs-langchain	`39.80% <76.47%> (-0.03%)`	⬇️
llmobs-openai	`44.18% <76.47%> (-0.04%)`	⬇️
llmobs-vertex-ai	`40.07% <76.47%> (-0.11%)`	⬇️
platform-core	`31.53% <ø> (ø)`
platform-esbuild	`34.48% <ø> (ø)`
platform-instrumentations-misc	`43.94% <ø> (ø)`
platform-shimmer	`37.63% <ø> (ø)`
platform-unit-guardrails	`32.95% <ø> (ø)`
plugins-azure-event-hubs	`25.71% <ø> (ø)`
plugins-azure-service-bus	`25.07% <ø> (ø)`
plugins-bullmq	`43.83% <76.47%> (+<0.01%)`	⬆️
plugins-cassandra	`37.85% <76.47%> (-0.04%)`	⬇️
plugins-cookie	`26.77% <ø> (ø)`
plugins-cookie-parser	`26.56% <ø> (ø)`
plugins-crypto	`26.79% <ø> (ø)`
plugins-dd-trace-api	`38.43% <76.47%> (-0.04%)`	⬇️
plugins-express-mongo-sanitize	`26.70% <ø> (ø)`
plugins-express-session	`26.51% <ø> (ø)`
plugins-fastify	`42.08% <24.73%> (-0.24%)`	⬇️
plugins-fetch	`38.38% <76.47%> (-0.04%)`	⬇️
plugins-fs	`38.68% <76.47%> (-0.04%)`	⬇️
plugins-generic-pool	`25.75% <ø> (ø)`
plugins-google-cloud-pubsub	`45.41% <76.47%> (-0.04%)`	⬇️
plugins-grpc	`40.99% <76.47%> (-0.04%)`	⬇️
plugins-handlebars	`26.75% <ø> (ø)`
plugins-hapi	`40.18% <76.47%> (-0.04%)`	⬇️
plugins-hono	`40.44% <76.47%> (-0.04%)`	⬇️
plugins-ioredis	`38.48% <76.47%> (-0.04%)`	⬇️
plugins-knex	`26.39% <ø> (ø)`
plugins-ldapjs	`24.24% <ø> (ø)`
plugins-light-my-request	`26.12% <ø> (ø)`
plugins-limitd-client	`32.67% <76.47%> (-0.03%)`	⬇️
plugins-lodash	`25.84% <ø> (ø)`
plugins-mariadb	`39.54% <76.47%> (-0.04%)`	⬇️
plugins-memcached	`38.23% <76.47%> (-0.04%)`	⬇️
plugins-microgateway-core	`39.22% <76.47%> (-0.04%)`	⬇️
plugins-moleculer	`40.56% <76.47%> (-0.04%)`	⬇️
plugins-mongodb	`39.25% <76.47%> (-0.04%)`	⬇️
plugins-mongodb-core	`39.09% <76.47%> (-0.04%)`	⬇️
plugins-mongoose	`38.91% <76.47%> (-0.04%)`	⬇️
plugins-multer	`26.51% <ø> (ø)`
plugins-mysql	`39.22% <76.47%> (-0.04%)`	⬇️
plugins-mysql2	`39.32% <76.47%> (-0.04%)`	⬇️
plugins-node-serialize	`26.81% <ø> (ø)`
plugins-opensearch	`37.68% <76.47%> (-0.04%)`	⬇️
plugins-passport-http	`26.57% <ø> (ø)`
plugins-postgres	`35.77% <76.47%> (-0.03%)`	⬇️
plugins-process	`26.79% <ø> (ø)`
plugins-pug	`26.77% <ø> (ø)`
plugins-redis	`38.95% <76.47%> (-0.04%)`	⬇️
plugins-router	`43.15% <76.47%> (+0.09%)`	⬆️
plugins-sequelize	`25.35% <ø> (ø)`
plugins-test-and-upstream-amqp10	`38.55% <76.47%> (-0.04%)`	⬇️
plugins-test-and-upstream-amqplib	`43.87% <76.47%> (-0.05%)`	⬇️
plugins-test-and-upstream-apollo	`39.08% <76.47%> (-0.04%)`	⬇️
plugins-test-and-upstream-avsc	`38.76% <76.47%> (-0.04%)`	⬇️
plugins-test-and-upstream-bunyan	`33.91% <39.08%> (-0.07%)`	⬇️
plugins-test-and-upstream-connect	`40.84% <76.47%> (-0.04%)`	⬇️
plugins-test-and-upstream-graphql	`40.19% <76.47%> (-0.04%)`	⬇️
plugins-test-and-upstream-koa	`40.42% <76.47%> (-0.04%)`	⬇️
plugins-test-and-upstream-protobufjs	`38.99% <76.47%> (-0.04%)`	⬇️
plugins-test-and-upstream-rhea	`44.07% <76.47%> (-0.05%)`	⬇️
plugins-undici	`39.16% <76.47%> (-0.04%)`	⬇️
plugins-url	`26.79% <ø> (ø)`
plugins-valkey	`38.14% <76.47%> (-0.01%)`	⬇️
plugins-vm	`26.79% <ø> (ø)`
plugins-winston	`34.07% <33.75%> (-0.10%)`	⬇️
plugins-ws	`41.93% <76.47%> (-0.04%)`	⬇️
profiling-macos	`39.89% <76.47%> (-0.04%)`	⬇️
profiling-ubuntu	`40.01% <76.47%> (-0.04%)`	⬇️
profiling-windows	`41.22% <76.47%> (-0.04%)`	⬇️
serverless-azure-functions-client	`25.43% <ø> (ø)`
serverless-azure-functions-eventhubs	`25.43% <ø> (ø)`
serverless-azure-functions-servicebus	`25.43% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

litianningdatadog · 2026-03-03T23:08:15Z

Code review

Found 9 issues:

Bugs

Channel subscriptions in _initializeWinstonTransport, _initializeBunyanStream, and _initializePinoTransport are created with raw channel.subscribe() instead of this.addSub(), so they are never added to this._subscriptions and are never unsubscribed when the plugin is disabled. The config object is permanently closed over from the first configure() call — subsequent calls with different settings are silently ignored for these paths.

dd-trace-js/packages/dd-trace/src/plugins/log_plugin.js

Lines 97 to 102 in df6a242

this._winstonTransportSubscribed = true

addTransportCh.subscribe((logger) => {

log.info('Winston logger received via channel, attempting to inject HTTP transport')

try {

this._injectWinstonHttpTransport(logger, config)

Winston's createLogger() internally calls Logger.prototype.configure(). The existing instrumentation already wraps Logger.prototype.configure and publishes synchronously to the addTransport channel. The new createLogger hook publishes to the same channel again (via setImmediate), so every createLogger() fires the channel twice. The LogSubmissionPlugin (CI visibility) has no duplicate guard and will inject its transport twice per logger.

dd-trace-js/packages/datadog-instrumentations/src/winston.js

Lines 55 to 61 in df6a242

// Use setImmediate to allow logger to fully initialize

if (addTransport.hasSubscribers) {

setImmediate(() => {

addTransport.publish(logger)

})

}

return logger

Every pino() call creates a new Writable stream and a new setInterval flush timer via _createPinoHttpTransport. There is no duplicate guard equivalent to the _injectedLoggers WeakSet used for Winston/Bunyan (the Symbol.for('dd-trace-pino-transport-injected') property is set on the instance after the fact but is never checked before requesting a transport). Applications that create many Pino instances accumulate unbounded timers.

dd-trace-js/packages/dd-trace/src/plugins/log_plugin.js

Lines 261 to 270 in df6a242

this._pinoTransportSubscribed = true

transportConfigCh.subscribe((configPayload) => {

log.info('Pino requesting transport config, providing HTTP transport')

try {

const transport = this._createPinoHttpTransport(config)

configPayload.transport = transport

} catch (err) {

log.error('Failed to create Pino HTTP transport: %s', err.message)

}

DD_LOG_CAPTURE_PROTOCOL is stored verbatim via setString with no normalization. The protocol selection is a strict === 'https:' check, so a user setting DD_LOG_CAPTURE_PROTOCOL=https (without trailing colon) silently falls back to plain HTTP with no warning.

dd-trace-js/packages/dd-trace/src/plugins/bunyan_http_stream.js

Lines 18 to 21 in df6a242

this.path = options.path || '/logs'

this.protocol = options.protocol || 'http:'

this.httpModule = this.protocol === 'https:' ? https : http

this.timeout = options.timeout || 5000

CLAUDE.md violations

require('http'), require('https'), and require('stream') in both new files are missing the node: prefix. Additionally, require('stream') is inside the pinoHttpTransport factory function body rather than at module top-level. (CLAUDE.md says: "Node.js core modules (with node: prefix)")

dd-trace-js/packages/dd-trace/src/plugins/bunyan_http_stream.js

Lines 1 to 7 in df6a242

'use strict'

const http = require('http')

const https = require('https')

const { Writable } = require('stream')

const log = require('../log')

dd-trace-js/packages/dd-trace/src/plugins/pino_http_transport.js

Lines 89 to 93 in df6a242

// Return a Writable stream that Pino can write to

const { Writable } = require('stream')

const transport = new Writable({

null is used as an initial/sentinel value in let httpTransport = null (pino.js:15), let flushTimer = null (pino_http_transport.js), this.timer = null (bunyan_http_stream.js), and return null in _createPinoHttpTransport. (CLAUDE.md says: "Use undefined over null, if not required otherwise")

dd-trace-js/packages/datadog-instrumentations/src/pino.js

Lines 13 to 17 in df6a242

return function pinoWithTrace () {

// Get HTTP transport from plugin if available

let httpTransport = null

if (transportConfigCh.hasSubscribers) {

const configPayload = {}

req.on('error', ...) and req.on('timeout', ...) are used on per-request ClientRequest objects in both _flush and flush. These events fire at most once per request. (CLAUDE.md says: "Use .once() methods instead of .on(), if the event is only needed once")

dd-trace-js/packages/dd-trace/src/plugins/bunyan_http_stream.js

Lines 85 to 95 in df6a242

})

req.on('error', (err) => {

// Silently fail - never crash the app

log.debug('Bunyan HTTP stream request failed: %s', err.message)

})

req.on('timeout', () => {

req.destroy()

log.debug('Bunyan HTTP stream request timed out')

})

dd-trace-js/packages/dd-trace/src/plugins/pino_http_transport.js

Lines 60 to 69 in df6a242

)

req.on('error', () => {

// Silent failure - don't crash application

})

req.on('timeout', () => {

req.destroy()

})

.filter(line => line.trim()) is called inside the Writable.write method, which runs on every log record Pino emits. (CLAUDE.md says: "Prefer for-of / for / while loops over forEach/map/filter in production code")

dd-trace-js/packages/dd-trace/src/plugins/pino_http_transport.js

Lines 97 to 103 in df6a242

const chunkStr = chunk.toString()

// Split by newlines in case multiple logs in one chunk

const lines = chunkStr.split('\n').filter(line => line.trim())

for (const line of lines) {

const log = JSON.parse(line)

buffer.push(log)

logCaptureTimeout is a millisecond-based value but lacks a unit suffix, inconsistent with logCaptureFlushIntervalMs added in the same PR. (CLAUDE.md says: "Size/time-based config options should have unit suffixes (e.g., timeoutMs, maxBytes, intervalSeconds)")

dd-trace-js/packages/dd-trace/src/config/defaults.js

Lines 129 to 133 in df6a242

ciVisibilityTestSessionName: '',

ciVisAgentlessLogSubmissionEnabled: false,

legacyBaggageEnabled: true,

isTestDynamicInstrumentationEnabled: false,

isServiceUserProvided: false,

🤖 Generated with Claude Code

If this code review was useful, please react with 👍. Otherwise, react with 👎.

All have been addressed

Implements automatic log forwarding for Winston, Bunyan, and Pino by injecting native HTTP transports/streams directly into logger instances. Features: - Zero-configuration automatic injection via diagnostic channels - Native performance using logger-specific transports - Full trace correlation (trace_id, span_id, service, env, version) - Non-invasive (logs still go to original destinations) - Single intake endpoint with automatic format detection - Configurable batching and buffering Implementation: - Winston: Uses native winston.transports.Http - Bunyan: Custom Writable stream in object mode - Pino: Custom transport with NDJSON parsing Configuration: 9 new options (DD_LOG_CAPTURE_*) Performance: ~1.5-2μs per log overhead Package size: +33 KB (+0.13%) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

litianningdatadog force-pushed the tianning.li/log-network-transport-patch branch 4 times, most recently from fbc3011 to 97d90fa Compare February 13, 2026 19:57

litianningdatadog changed the title ~~feat(logging): add log capture with native transport injection~~ feat(logging, ai): add log capture with native transport injection Feb 23, 2026

litianningdatadog force-pushed the tianning.li/log-network-transport-patch branch from 97d90fa to df6a242 Compare March 2, 2026 20:22

litianningdatadog force-pushed the tianning.li/log-network-transport-patch branch from df6a242 to 9739b77 Compare March 3, 2026 19:15

litianningdatadog force-pushed the tianning.li/log-network-transport-patch branch 9 times, most recently from f4219f9 to 84f060f Compare March 3, 2026 22:56

litianningdatadog force-pushed the tianning.li/log-network-transport-patch branch from 84f060f to 4bb3175 Compare March 3, 2026 23:16

litianningdatadog closed this Apr 8, 2026

Navigation Menu

Uh oh!

feat(logging, ai): add log capture with native transport injection - #7522

feat(logging, ai): add log capture with native transport injection #7522
litianningdatadog wants to merge 1 commit into
masterfrom
tianning.li/log-network-transport-patch

litianningdatadog commented Feb 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Feb 13, 2026 •

edited

Loading

Uh oh!

datadog-official Bot commented Feb 13, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading

Uh oh!

pr-commenter Bot commented Feb 13, 2026 •

edited

Loading

Uh oh!

litianningdatadog commented Mar 3, 2026

Uh oh!

codecov Bot commented Mar 3, 2026 •

edited

Loading

Uh oh!

litianningdatadog commented Mar 3, 2026

Code review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

litianningdatadog commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Uh oh!

github-actions Bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overall package size

Uh oh!

datadog-official Bot commented Feb 13, 2026 • edited by datadog-datadog-prod-us1 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

Uh oh!

pr-commenter Bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Uh oh!

litianningdatadog commented Mar 3, 2026

Code review

Uh oh!

codecov Bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

litianningdatadog commented Mar 3, 2026

Code review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

litianningdatadog commented Feb 13, 2026 •

edited

Loading

github-actions Bot commented Feb 13, 2026 •

edited

Loading

datadog-official Bot commented Feb 13, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading

pr-commenter Bot commented Feb 13, 2026 •

edited

Loading

codecov Bot commented Mar 3, 2026 •

edited

Loading