Laravel Request Logger Middleware: Full HTTP Observability

Schema::create('request_logs', function (Blueprint $table): void { $table->id(); $table->string('request_id', 36)->unique(); // UUID (unique() is also the index) $table->string('method', 10); $table->string('url', 2048); $table->string('ip_address', 45)->nullable(); $table->unsignedBigInteger('user_id')->nullable(); $table->string('user_type', 50)->nullable(); // which guard $table->unsignedSmallInteger('status_code'); $table->unsignedInteger('duration_ms'); $table->timestamp('created_at'); $table->index(['user_id', 'user_type']); $table->index('created_at'); }); 

// app/Http/Middleware/RequestLogger.php <?php declare(strict_types=1); namespace App\Http\Middleware; use App\Models\RequestLog; use Closure; use Illuminate\Http\Request; use Illuminate\Support\Facades\Context; use Illuminate\Support\Facades\Log; use Illuminate\Support\Str; use Symfony\Component\HttpFoundation\Response; use Throwable; class RequestLogger { public const X_REQUEST_ID = 'X-Request-ID'; /** * Paths to skip entirely (health checks, tooling, CSP reports). * CSP reports can arrive in floods; logging each one can exhaust PHP-FPM. */ private const SKIP_PATHS = [ 'up', 'health', '_ignition', 'telescope', 'horizon', 'favicon.ico', 'api/csp-violation-report', ]; private const GUARDS = ['admin', 'merchandiser', 'employee', 'web']; public function handle(Request $request, Closure $next): Response { if ($request->is(...self::SKIP_PATHS)) { return $next($request); } // Always generate the ID on the server. Never trust an incoming // X-Request-ID: clients could forge it or collide with the unique index. $requestId = (string) Str::uuid(); $request->headers->set(self::X_REQUEST_ID, $requestId); $request->attributes->set('request_started_at', microtime(true)); // Every log line (and every job dispatched in this request) gets the ID. Context::add('request_id', $requestId); $response = $next($request); // Add the ID to the response so API clients can reference it $response->headers->set(self::X_REQUEST_ID, $requestId); return $response; } /** * Runs after the response has been sent, so logging never slows the user down. */ public function terminate(Request $request, Response $response): void { $startedAt = $request->attributes->get('request_started_at'); if ($startedAt === null) { return; // skipped path } // Logging is bookkeeping: a failure here is reported, never thrown. try { $durationMs = (int) round((microtime(true) - $startedAt) * 1000); [$userId, $guard] = $this->resolveActor(); $this->log($request, $response, $durationMs, $userId, $guard); RequestLog::create([ 'request_id' => $request->headers->get(self::X_REQUEST_ID), 'method' => $request->method(), 'url' => substr($request->fullUrl(), 0, 2048), 'ip_address' => $request->ip(), 'user_id' => $userId, 'user_type' => $guard, 'status_code' => $response->getStatusCode(), 'duration_ms' => $durationMs, 'created_at' => now(), ]); } catch (Throwable $e) { report($e); } } private function log(Request $request, Response $response, int $durationMs, ?int $userId, ?string $guard): void { $level = match (true) { $response->getStatusCode() >= 500 => 'error', $response->getStatusCode() >= 400 => 'warning', $durationMs > 3000 => 'warning', // slow request default => 'info', }; // request_id is added automatically from Context Log::channel('request')->{$level}('Request', [ 'method' => $request->method(), 'path' => $request->path(), 'status' => $response->getStatusCode(), 'duration_ms' => $durationMs, 'user_id' => $userId, 'guard' => $guard, 'ip' => $request->ip(), ]); } /** * The user id and the guard it came from, read from the same guard. * * @return array{0: int|null, 1: string|null} */ private function resolveActor(): array { foreach (self::GUARDS as $guard) { if (config("auth.guards.{$guard}") !== null && auth($guard)->check()) { return [(int) auth($guard)->id(), $guard]; } } return [null, null]; } } 

Context::add('request_id', $requestId); // Laravel 10 and earlier: Log::shareContext(['request_id' => $requestId]); 

{"message":"Processing payment","request_id":"550e8400-e29b-41d4-a716-446655440000","order_id":1234} {"message":"Payment confirmed","request_id":"550e8400-e29b-41d4-a716-446655440000","stripe_intent":"pi_abc"} {"message":"Inventory reserved","request_id":"550e8400-e29b-41d4-a716-446655440000","items":3} 

->withMiddleware(function (Middleware $middleware): void { $middleware->append(\App\Http\Middleware\RequestLogger::class); }) 

// What happened during a specific request? $logs = RequestLog::where('request_id', $id)->first(); // All slow requests in the last 24 hours RequestLog::where('duration_ms', '>', 2000) ->where('created_at', '>', now()->subHours(24)) ->orderByDesc('duration_ms') ->get(); // All 500 errors for a specific user RequestLog::where('user_id', $userId) ->where('status_code', '>=', 500) ->latest() ->get(); // Cross-reference with ModelChangeLog $modelChanges = ModelChangeLog::where('request_id', $requestId)->get();