Weave Code
Laravel Http Logger Laravel Package
spatie/laravel-http-logger
This Laravel middleware logs incoming HTTP requests to your default log, so you can still access the original request data if something goes wrong. An extra safety net for critical user submissions like lead-generating forms, with configurable log profile, writer, and channel.
A Laravel package to log HTTP requests
Frequently asked questions about Laravel Http Logger
- What does spatie/laravel-http-logger do?
- It adds a Laravel middleware that writes incoming HTTP request data such as method, URL, headers, and body to your application log through Laravel's native Log facade. The purpose is a forensic safety net: if a request fails with a fatal error, timeout, or crash, you can still see exactly what the user submitted, which matters for lead-gen forms and other high-value endpoints. It is not an APM, audit trail, or replacement for Telescope, Pulse, or structured request logging. The default profile logs non-GET requests only, and both the decision to log and the write itself are swappable through interfaces.
- How do I install and register spatie/laravel-http-logger in a Laravel app?
- Run composer require spatie/laravel-http-logger, then optionally publish the config with php artisan vendor:publish --provider="Spatie\HttpLogger\HttpLoggerServiceProvider" --tag="config". Register Spatie\HttpLogger\Middlewares\HttpLogger as global middleware via withMiddleware() in bootstrap/app.php on Laravel 11+, or attach it to a specific route or group if you only want certain endpoints covered. No migrations or schema changes are involved, and rollback is removing the middleware line and the Composer entry.
- Which Laravel and PHP versions does spatie/laravel-http-logger support?
- Version 1.12.0 requires PHP 8.3 or newer and Laravel 12, dropping support for PHP below 8.3 and Laravel below 12 while adding QUERY method support. If you are on Laravel 10 or 11, you must pin 1.11.x, which means forgoing the 1.12.0 additions. Resolve this compatibility gate before adoption rather than after, since it directly affects your Composer constraint.
- How do I log only specific routes or requests with laravel-http-logger?
- The config's log_profile key points to a class implementing LogProfile, whose shouldLogRequest() method decides whether a request is logged. The package ships LogNonGetRequests, which logs everything except GET, and you can write a custom profile that checks the route name, path, or verb. You can also set the enabled flag via HTTP_LOGGER_ENABLED or register the middleware only on the routes or groups you care about.
- How do I stop sensitive data like passwords or emails from being logged?
- Defaults only exclude password and password_confirmation from logged input, and sanitize_headers ships empty, so emails, phone numbers, bearer tokens, and free-text fields are written verbatim unless you act. The cleanest approach is a custom LogWriter that redacts or truncates fields before emitting, or a custom LogProfile that skips endpoints that should never be logged. Remember that log storage usually has different access controls and retention than your database, so treat this as a compliance decision, not just a config tweak.
- Does spatie/laravel-http-logger slow down requests or risk failures?
- Logging happens synchronously in the request path before the response completes, so a slow or blocking channel such as remote syslog, an HTTP handler, or saturated disk adds latency directly to the request. Most Laravel log handlers propagate exceptions, so if the handler throws you can turn a successful request into a 500. There is also no size cap, sampling, or field truncation in the default writer, so verbose JSON or multipart bodies inflate log volume and storage cost nonlinearly with traffic. Use a fast local channel or an async handler if latency and volume matter.
- What is the difference between laravel-http-logger and Laravel Telescope or Pulse?
- Telescope and Pulse are debugging and observability tools that typically store data in memory or a database and are often disabled or sampled in production. laravel-http-logger writes the raw request to your log channel so it survives hard failures such as fatal errors, timeouts, and container crashes, where in-memory tooling loses the request. If you already run an APM or Telescope with request-body capture, adding this package means duplicate log volume and duplicate PII exposure for largely overlapping capability.
- How do I change the log channel or output format used by laravel-http-logger?
- Set the log_channel config key to any channel defined in config/logging.php, or leave it to use your application's default log. For structured JSON output, tenant tagging, or field-level redaction, implement LogWriter and swap it into the log_writer config key; its logRequest() method receives the request and is where you format or filter the payload. Both extension points are interface-bound, so you never need to modify vendor code.
- How can I test spatie/laravel-http-logger in my Laravel application?
- Because the package writes through Laravel's Log facade, you can assert behavior in HTTP tests with Log::spy() or Log::shouldReceive('info') and verify the request payload was passed. Register the middleware in the test or point the config at a fake channel, then hit a route and assert the log call. The package itself has a PHPUnit suite run through GitHub Actions, so you can inspect its tests for the expected payload shape.
- Is spatie/laravel-http-logger actively maintained, and what happens if it is abandoned?
- The package has roughly 673 GitHub stars but zero listed dependents and a small code surface, so third-party battle-testing is limited. The mitigating factor is that the whole thing is about 50 lines of middleware plus two interfaces, so forking or reimplementing it in-house is realistic if Spatie ever abandons it. Pin your Composer constraint and keep the middleware registration isolated so removal stays a one-line change.
Weaver
How can I help you explore Laravel packages today?