feat(logging): add log capture with native transport injection

[litianningdatadog]

Background:

The AWS Serverless team is exploring an approach that leverages dd-trace log injection to collect logs without depending on CloudWatch or the Log Forwarder. This would:
• Simplify the Datadog log ingestion setup
• Provide customers with potential cost savings

What does this PR do?

This PR implements native logger transport injection that automatically forwards application logs to a custom intake service by injecting HTTP transports/streams directly into Winston, Bunyan, and Pino loggers.

Implements automatic log forwarding for Winston, Bunyan, and Pino by injecting native HTTP transports/streams directly into logger instances.

Component Architecture

Key Features:

• Zero-configuration automatic injection via diagnostic channels
• Native transport/stream injection for Winston, Bunyan, and Pino
• Full trace correlation - logs include trace_id, span_id, service, env, version
• Non-invasive - logs still go to original destinations (stdout, files, etc.)
• Single intake endpoint with automatic format detection
• Configurable batching (default: 1000 logs or 5 seconds, whichever comes first)
• Exit handlers ensure logs are flushed on process exit (critical for Lambda/serverless)

Implementation Approach:

1. Winston: Uses native winston.transports.Http with batching
2. Bunyan: Custom Writable stream in object mode with synchronous injection
3. Pino: Custom transport with NDJSON parsing and post-create multistream combination

Performance:

• <5% overhead per log (benchmark-verified)
• ~20-110 KB memory usage (typical)
• Non-blocking async I/O
• 725k-755k logs/sec throughput (Winston)

Test Coverage:

• 26 comprehensive test scenarios covering all user configurations
• Tests validate injection works with: no transports, Console, File, multiple transports, pino-pretty, custom destinations, multistream, serializers, child loggers, dynamic
  additions
• Exit handler verification test
• Performance benchmark tool

Motivation

Business Value:

• Streamline Datadog log ingestion: Eliminate the need for a Log Forwarder to collect logs from CloudWatch
• Potential cost savings for customers: By bypassing AWS CloudWatch in the log ingestion path, customers may reduce log storage costs
• Faster time to value - no code changes required
• Lower maintenance burden - works with all logger configurations
• Improved reliability - native implementation, exit handlers prevent log loss
• Better developer experience - transparent, automatic, performant

Why Native Transport Injection?

1. Zero Developer Burden

• Works automatically with existing logger configurations
• No code changes required
• Supports ALL logger features and configurations
• Drop-in replacement for wrapper approach

2. Native Performance

• <5% overhead per log call (negligible)
• Leverages logger-native transport mechanisms
• Async I/O doesn't block application
• Minimal memory footprint (~20-110 KB typical)

3. Critical for Lambda/Serverless

• Exit handlers ensure logs are flushed on process termination
• No logs lost when functions exit (30-second runtime example)
• Configurable flush intervals (fast for tests, optimal for production)
• Guaranteed delivery even if flush interval hasn't elapsed

4. Production Ready

• Comprehensive test coverage (26 scenarios)
• Benchmark-verified performance metrics
• Supports all user transport configurations for Winston/Bunyan/Pino
• Silent failures - never crashes user applications

Use Cases:

• High-volume production applications (10k+ logs/min)
• Lambda/serverless functions with short runtimes
• Applications that can't modify logging code
• Applications using advanced logger features (child loggers, custom transports, etc.)
• Teams wanting centralized log management without code changes

[github-actions]

Overall package size

Self size: 4.64 MB
Deduped: 5.47 MB
No deduping: 5.47 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 2.0.6 | 81.92 kB | 813.08 kB | | dc-polyfill | 0.1.10 | 26.73 kB | 26.73 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

[datadog-official]

⚠️ Tests

✨ Fix all issues with Cursor

⚠️ Warnings

🧪 4 Tests failed

    initialize.mjs "after all" hook in "initialize.mjs" from initialize.mjs (Fix with Cursor)

initialize.mjs "before all" hook in "initialize.mjs" from initialize.mjs (Datadog) (Fix with Cursor)

Timeout of 300000ms exceeded. For async tests and hooks, ensure "done()" is called; if returning a Promise, ensure it resolves. (/home/runner/work/dd-trace-js/dd-trace-js/integration-tests/init.spec.js)

Error: Timeout of 300000ms exceeded. For async tests and hooks, ensure "done()" is called; if returning a Promise, ensure it resolves. (/home/runner/work/dd-trace-js/dd-trace-js/integration-tests/init.spec.js)
    at listOnTimeout (node:internal/timers:573:17)
    at process.processTimers (node:internal/timers:514:7)

    init.js "after all" hook in "init.js" from init.js (Fix with Cursor)

    init.js "before all" hook in "init.js" from init.js (Fix with Cursor)

View all

ℹ️ Info

❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 97d90fa | Docs | Datadog PR Page | Was this helpful? Give us feedback!}

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-02-13 20:11:54

Comparing candidate commit 97d90fa in PR branch tianning.li/log-network-transport-patch with baseline commit c589ad4 in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 228 metrics, 32 unstable metrics.