Logs are searchable and queryable

OWASP A09 and NIST AU-7 (Audit Record Reduction and Report Generation) both require that logs be accessible for analysis — which means persisted, indexed, and queryable, not just emitted to stdout. On serverless platforms like Vercel, function logs visible in the dashboard are ephemeral and retained for only a short window (typically 1–24 hours) without a log drain configured. A structured JSON logger producing perfect output is useless if the output disappears before you need it. When an incident happens, you need to query log history across a time range, filter by user ID, or trace a specific error across multiple function invocations — none of which is possible with transient platform logs.

Ship logs to a persistent, queryable log platform. For Vercel-deployed apps, the fastest path is a native Vercel integration.

Better Stack: Install the Better Stack Vercel integration — logs stream automatically from all Vercel functions with no code changes.

Axiom: Install the Axiom Vercel integration, set AXIOM_DATASET and AXIOM_TOKEN env vars, and optionally add next-axiom for in-process shipping.

For Pino-based loggers, add a transport directly:

npm install @logtail/node @logtail/pino

import { Logtail } from '@logtail/node'
import { LogtailTransport } from '@logtail/pino'
const logtail = new Logtail(process.env.LOGTAIL_SOURCE_TOKEN!)
const logger = pino({ level: 'info' }, pino.multistream([
  { stream: process.stdout },
  { stream: new LogtailTransport(logtail) }
]))

Add the log service token to .env.example so it is documented as a required configuration.