Better Stack

betterstackMonitoring32 lines

Uptime monitoring, log management and on-call alerting.

Current — as published in v1.3.2. Written by hand for Better Stack, not generated.

The rule

Logging

  • Structured objects, not interpolated strings: logger.info('Subscription renewed', { userId, plan }). The fields are what make a log searchable six months later.
  • Never log personal data, tokens, passwords, session ids, API keys, or whole request bodies that might contain them. Logs are retained, replicated and broadly readable.
  • Log levels mean something: error is actionable, warn is suspicious, info is a business event. Do not log everything at error.
  • Flush before process exit, or buffered logs die with the process.

Health endpoints

  • A health check verifies dependencies — database reachable, migrations applied — and returns non-200 when they fail.
  • One that unconditionally returns 200 monitors only that the web server is running, which is rarely the thing that breaks.

Alerts

  • Alert on symptoms users feel: down, elevated error rate, latency doubled.
  • Require consecutive failures. A single failed check is a network blip.
  • Every alert must be actionable. If nobody would act at 3am, it belongs on a dashboard.

Never

  • Never route alerts to a shared inbox with no owner.
  • Never disable a noisy alert without fixing or retuning it.

As each tool receives it

The same guidance, in the shape each editor reads. Cursor and Claude Code are written separately by hand; the rest are derived from the Cursor rule.

→ .cursor/rules/betterstack.mdchand-written for this tool
.cursor/rules/betterstack.mdc
---
description: Better Stack monitoring and logging conventions
globs: ["server/**", "api/**", "src/services/monitoring/**"]
alwaysApply: false
---

# Better Stack

## Logging

- Structured objects, not interpolated strings:
  `logger.info('Subscription renewed', { userId, plan })`. The fields are what
  make a log searchable six months later.
- **Never log** personal data, tokens, passwords, session ids, API keys, or
  whole request bodies that might contain them. Logs are retained, replicated
  and broadly readable.
- Log levels mean something: `error` is actionable, `warn` is suspicious,
  `info` is a business event. Do not log everything at `error`.
- Flush before process exit, or buffered logs die with the process.

## Health endpoints

- A health check verifies dependencies — database reachable, migrations applied
  — and returns non-200 when they fail.
- One that unconditionally returns 200 monitors only that the web server is
  running, which is rarely the thing that breaks.

## Alerts

- Alert on symptoms users feel: down, elevated error rate, latency doubled.
- Require consecutive failures. A single failed check is a network blip.
- Every alert must be actionable. If nobody would act at 3am, it belongs on a
  dashboard.

## Never

- Never route alerts to a shared inbox with no owner.
- Never disable a noisy alert without fixing or retuning it.

What else this module writes

Selecting Better Stack contributes more than a rule file — all of it merged with every other module you pick, with conflicts resolved rather than duplicated.

Environment
BETTERSTACK_SOURCE_TOKENrequiredLog source token. Server-side only.
BETTERSTACK_INGESTING_HOSToptionalRegion-specific ingest host, if your source specifies one.
HEALTHCHECK_PATHoptionalPath the uptime monitor calls. Must verify real dependencies.
Dependencies
@logtail/node^0.5.0
Folders
server/monitoring/
Put this in your repo

Adds Better Stack to a project this tool generated, without starting over. Files you have hand-edited are left alone.