Request and Response Logging Filter in Servlet Applications

As applications grow, debugging without centralized request logging quickly becomes difficult. Modern servlet applications often process thousands of requests every minute. Developers need visibility into incoming requests, outgoing responses, execution time, and potential failures.

A Request and Response Logging Filter acts as a monitoring layer between clients and business logic. It captures traffic, enriches logs with contextual information, and helps teams diagnose problems faster.

If you're building a larger filter architecture, it is also useful to connect this implementation with your homepage (Servlet Filters Hub), Filter Chain Processing, Exception Handling Filter, and CORS Servlet Filter Configuration.

Why Request and Response Logging Matters (Informational Intent)

Without logging, developers often rely on guesswork.

Imagine an API returning HTTP 500 errors intermittently. The problem may come from:

• Invalid headers
• Broken JSON payloads
• Authentication failures
• External service timeouts
• Database latency
• Incorrect response generation

Logging filters provide a timeline.

Instead of asking "Why did it fail?", developers can answer:

• Who sent the request?
• When was it received?
• Which endpoint was called?
• How long did processing take?
• What status code was returned?
• What exception occurred?

How a Request and Response Logging Filter Works (Informational Intent)

The filter sits inside the servlet filter chain.

Execution flow:

1. Client sends HTTP request.
2. Filter intercepts request.
3. Metadata is collected.
4. Request continues.
5. Business logic executes.
6. Response is generated.
7. Filter captures response data.
8. Log entry is stored.

Typical Flow Diagram

Browser → Logging Filter → Authentication Filter → Controller → Service → Database → Response → Logging Filter → Browser

Data That Should Be Logged

Example Filter Implementation

@WebFilter("/*")
public class LoggingFilter implements Filter {

@Override
public void doFilter(
ServletRequest request,
ServletResponse response,
FilterChain chain
) throws IOException, ServletException {

long start = System.currentTimeMillis();

HttpServletRequest req =
(HttpServletRequest) request;

HttpServletResponse res =
(HttpServletResponse) response;

chain.doFilter(request,response);

long duration =
System.currentTimeMillis()-start;

System.out.println(
req.getMethod() +
" " +
req.getRequestURI() +
" " +
res.getStatus() +
" " +
duration + "ms"
);

}
}

Explanation of Key Concepts That Actually Matter

Request Body Logging Challenges

The servlet input stream can only be consumed once.

If a filter reads the body, controllers may receive an empty stream.

The solution is wrapping requests.

ContentCachingRequestWrapper
ContentCachingResponseWrapper

These wrappers store content in memory for multiple reads.

Mistakes Developers Frequently Make

• Logging passwords
• Logging JWT tokens
• Logging binary files
• Logging entire PDF documents
• Using synchronous file writes
• Ignoring payload limits
• Duplicating logs in multiple filters

What Most Tutorials Don't Explain

Many examples work in development environments but fail in production.

The biggest hidden problems are:

• Disk space consumption
• Memory pressure
• GDPR compliance
• Log retention costs
• Sensitive data exposure
• Cloud storage expenses

Local Statistics

Masking Sensitive Data

Never expose:

• Passwords
• Access tokens
• Refresh tokens
• Credit card numbers
• Social security identifiers
• Personal addresses

Masking example:

Before:

password=secret123

After:

password=********

Performance Optimization Strategies

Payload Truncation Example

if(body.length()>2000){

body=body.substring(0,2000);

}

Large payloads can crash systems if left unrestricted.

Using Correlation IDs

A correlation ID follows a request across services.

X-Correlation-ID:
A7D4-B21E-9912

Benefits:

• Faster debugging
• Distributed tracing
• Error tracking
• Log aggregation

Decision Matrix for Different Projects

Integrating With Other Filters

Logging should not exist independently.

A common sequence:

1. CORS Filter
2. Authentication Filter
3. Logging Filter
4. Exception Handling Filter

Practical Tips

1. Keep log entries under 4 KB whenever possible.
2. Use JSON formatting.
3. Separate application and audit logs.
4. Add server instance identifiers.
5. Never store raw credentials.

Brainstorming Questions

• Which requests fail most often?
• Which endpoint is slowest?
• Can large payloads be avoided?
• How long are logs retained?
• Who has access to logs?
• Are credentials properly masked?
• Can logging be disabled per environment?

Frequently Asked Questions

1. Should every request be logged?

No. Health checks and static resources are often excluded.

2. Is body logging mandatory?

No. Many systems only log metadata.

3. Why use wrappers?

Servlet streams are readable only once.

4. Should JWT tokens be stored?

No.

5. What is a correlation ID?

A unique request identifier.

6. Can logging reduce performance?

Yes, especially with large payloads.

7. Should logs be asynchronous?

Yes, in production.

8. How long should logs be stored?

Based on compliance requirements.

9. Is response logging always necessary?

No. Metadata may be sufficient.

10. Should file uploads be logged?

No. Only metadata.

11. Which status codes are most useful?

4xx and 5xx errors.

12. Can logging be environment-specific?

Yes.

13. Should internal IP addresses be logged?

Only when necessary.

14. Can logs become security risks?

Yes.

15. What is the biggest anti-pattern?

Logging sensitive information.

16. What if documentation becomes difficult to organize?

Structured editorial support can help maintain consistency across technical projects.

Get full assistance with PaperCoach

17. What should be prioritized during incidents?

Correlation IDs, timestamps, and execution duration.