Let's start by installing Morgan with the usual method:

 npm install morgan --save

Now we must include it in our server, and we'll also require the fs package in order to write Morgan's logs to a file. Note that I'm adding to our previous server, so the Winston parts will be in place, unchanged from what we saw in the previous section:

// Source file: src/morgan_server.js

/* @flow */
"use strict";

const express = require("express");
const winston = require("winston");
const morgan = require("morgan");
const fs = require("fs");

const app = express();

// continues...

We want to do some general logging to a file, and also all errors (HTTP status code 400 and higher) to the console, so we'll have to add morgan twice to our middleware stack. The first parameter to morgan defines how the log messages will be formed: you have to provide either a function to generate the message that will be logged, or a string with tokens that morgan will replace at runtime. In the following code snippet, I used both styles, just for variety: a function for the file output, and a string for the console:

// ...continued

const morganStream = fs.createWriteStream("serv_http_errors.log", {
    flags: "a"
});

app.use(
    morgan(
        (tokens, req, res) =>
            `${new Date().toISOString()} [http] ` +
            `${tokens.method(req, res)} ${tokens.url(req, res)}`,
        {
            immediate: true,
            stream: morganStream
        }
    )
);

app.use(
    morgan(
        `:date[iso] [http] ` +
            `:method :url (:status) :res[content-length] - :response-time ms`,
        {
            skip: (req, res) => res.statusCode < 400
        }
    )
);

// continues...

The second option to morgan lets you add some options, such as the following:

• immediate, meaning that requests will be logged as soon as they come in (immediate:true) or after they've been processed (immediate:false). The advantage of the former is that you are sure that all requests will be logged, even in the case of a serious crash, but the latter provides more information.
• skip(), a function that lets you decide whether to log a given request or not. In our case, we'll use it to just log requests that get a 400 or higher status.
• stream, to which the output should be written.

When specifying the output format, you have access to several pieces of data, called tokens in Morgan's parlance, such as the following, but check the documentation for the full list:

You can see that I used several of these tokens when setting up Morgan's output. Now, let's see this works.