Http Logger Bundle Laravel Package

Product Decisions This Supports

• Build vs. buy for HTTP logging. The capability on offer — capture method, URI, status, timing, and (optionally) payloads for inbound and outbound HTTP, tag with a correlation ID, emit to a log sink — is commodity. In Laravel it is roughly a middleware (inbound), a listener on Illuminate\Http\Client events or a Guzzle middleware (outbound), and a Monolog tap with a correlation-ID processor. Realistic in-house estimate: 2–4 days including tests and a redaction review. This package’s value is as a reference design for field selection, not as a dependency.
• Observability roadmap prioritization. The decision that actually needs making is not “which logger” but “where do HTTP logs land, at what retention, and under what PII policy” — Monolog channel → CloudWatch/Datadog/Loki, sampling strategy, size caps, index-cost implications of high-cardinality URLs. Treat this evaluation as an input to a logging-standard spec; the library choice is downstream of that spec.
• Support and triage investment. Structured request/response logs are the cheapest lever on “customer says it’s broken” triage time and mean-time-to-resolution. Size the investment against ticket volume and MTTR before committing engineering time — that business case stands or falls independently of this package.
• Compliance and audit surface area. If there are regulated audit-trail obligations (who called what, when, with which credentials), the deliverable is a policy — what must be logged, what must be redacted, how long it is retained — that we can defend in a review. This package encodes no policy and its redaction behavior is unverified; it does not unblock that decision.
• Scoping outbound integration debugging. Third-party API calls (payments, shipping, CRM) are the highest-value slice of this capability. Scoping that narrowly — outbound only, structured, sampled — delivers most of the benefit at a fraction of the surface area and cost of a wholesale HTTP logging layer.

When to Consider This Package

Adoption criteria — all of which must hold before spending engineering time:

• You are on Symfony, not Laravel. The -bundle suffix and Symfony bundle conventions (Kernel::registerBundles(), a DI Extension) are a structural mismatch with Laravel’s service-provider and package-discovery model. Laravel auto-discovery will not register it; you would write the wiring yourself regardless.
• Legal has cleared the NOASSERTION license. This is the hard, stop-the-line blocker. GitHub could not detect a recognized license, and absent a clear grant of rights the default is all-rights-reserved. Many organizations cannot approve this at all until counsel reads the actual LICENSE text — or confirms there isn’t one.
• You can accept zero community signal. 0 stars and 0 dependents mean no evidence of production use, no issue history to mine for known failure modes, no downstream projects surfacing breakage, and no upstream responsiveness if a PHP or Guzzle minor version breaks it. Assume a bus factor of one.
• You can absorb full maintenance ownership. Plan to fork, vendor, and likely replace within a year. Budget for PHP version bumps, Guzzle majors, and Laravel upgrade cycles on code you did not write. Name an internal SME as owner before adoption; without one there is no support path.
• The requirement is genuinely commodity — no custom schema contract, no compliance certification, no vendor-specific sink format.

Look elsewhere — or build — when:

• You’re on Laravel. Use Illuminate\Http\Middleware, the HTTP client’s RequestSending / ResponseReceived / ConnectionFailed events (or Http::global() middleware), Telescope or Pulse for dev/staging visibility, and a Monolog tap in production. All first-party, all maintained, all licensed cleanly.
• You need PII or credential redaction you can defend. Authorization headers, cookies, tokens, and request bodies are exactly what this class of logger touches. Redaction logic must be yours and reviewed; inheriting it from an unvetted dependency is a compliance liability, not a mitigation.
• You need SLIs/SLOs, tracing, or sampling. Reach for OpenTelemetry PHP or your APM agent’s native integration. A log-only shim covers none of this and creates a second, parallel observability story to maintain.
• Any timeline pressure exists. The integration cost of an unsupported Symfony bundle in a Laravel app — characterization, shim, verification on every dependency bump — exceeds the cost of writing the middleware.
• You want to read it, not install it. A 1–2 hour source read to extract field choices and middleware shape is a legitimate use. Adoption is a separate and, on current evidence, unjustifiable decision.

How to Pitch It (Stakeholders)

To executives. We evaluated this package and recommend against adoption. Three independent risk flags stack against something that would sit in the request path of every user interaction: it is a Symfony component in a Laravel estate (wrong architecture), it has zero adoption and no maintenance signal, and its license is unclassifiable — meaning we may not even have the right to use it commercially. The capability it provides is small and commodity; we can build an equivalent in-house in under a week and own it outright, with redaction rules we wrote and can defend. Recommendation: close out this evaluation and fund a scoped logging-standard workstream — capture schema, redaction rules, sink, retention, sampling. The decision this unblocks is what we log and where it goes; the library choice is downstream of that and should not gate it.

To engineering. Useful as a design reference for field selection and middleware shape — method, URI, status, latency, correlation ID, redacted headers and bodies. Not a dependency. Concrete alternative: a Laravel middleware for inbound plus a listener on Illuminate\Http\Client events (or a Guzzle middleware) for outbound, both writing to a dedicated Monolog channel with a correlation-ID processor and a redaction tap. Ensure the logging layer cannot fail the outbound call, cap body capture, and buffer or queue emission so we don’t add synchronous latency to the request path. Estimated 2–4 days including tests and redaction review. If a requirement later pushes us toward third-party, revisit with OpenTelemetry PHP rather than a single-purpose logger — that also covers tracing and sampling, which this cannot.

Ask. Approval to close out this evaluation and timebox the in-house implementation. Escalate the license question to counsel only if a stakeholder insists on reuse — and note that even a favorable ruling leaves the architectural and maintenance findings unchanged.