> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gleap.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# JavaScript SDK: Network logs

> Capture network requests to investigate bug reports with the Gleap JavaScript SDK. Follow the integration code examples.

Gleap logs your page's `fetch` and `XMLHttpRequest` requests and attaches the most recent ones to every ticket, so you can see what went wrong. Enable **Network logs** in the **Developer options** of your project in the [Gleap dashboard](https://app.gleap.ai), or start them from code:

```javascript theme={null}
Gleap.startNetworkLogger();
```

For each request Gleap logs the method, the absolute URL, request and response headers and bodies, the status, the duration and, for failed, aborted or timed-out requests, the error. Requests that were sent before the SDK started are listed with their timing (from the browser's resource timing). With **Include static resources** enabled, scripts, styles and images are listed as well.

Gleap never changes your requests or responses: bodies are read from a copy, and streaming responses such as server-sent events are never read at all.

## Filtering network logs

Gleap allows you to strip off specific key/value pairs from network logs. This empowers you to easily remove sensitive data like `tokens`, `passwords` or `usernames`.

### How does it work?

Open your project in the [Gleap dashboard](https://app.gleap.ai), go to **Developer options** and add the keys to exclude under **Network logs → Ignored keys**. The keys are loaded together with the widget configuration, and the SDK removes them on the device before a report is sent, so this data never leaves the client application:

* **Headers**: request and response headers with a matching name are removed (the name is matched case-insensitively).
* **JSON bodies**: matching keys are removed from request and response bodies at any depth, including objects inside arrays. A key with dots, like `user.password`, also removes exactly that path.
* **Form bodies and URL parameters**: matching `application/x-www-form-urlencoded` fields and query parameters are removed.

Independent of this list, the values of the `Authorization`, `Proxy-Authorization`, `Cookie` and `Set-Cookie` headers are always replaced by `[REDACTED]`.

<Note>
  Matching nested keys, form fields and URL parameters, and the masked credential headers, need SDK **v19.0.0** or newer. Older SDKs only remove top-level keys from headers and JSON bodies, and the Android SDK applied neither the ignored keys nor the blacklist before v19.0.0.
</Note>

#### Example

To remove an API key header and every `password` field, add `x-api-key` and `password` to the list.

### Set filter with code

It's also possible to set the network log filters by code. Each call replaces the previous list. The keys set in the dashboard apply in addition.

```javascript theme={null}
Gleap.setNetworkLogPropsToIgnore(["x-api-key", "password", "user.email"]);
```

## Blacklisting URLs

It is possible to blacklist URLs or parts of URLs. If a network request matches one of the entries in the blacklist, the network request won't be included in the network logs.

<Info>
  Requests to Gleap's own hosts (`gleap.io` and `gleap.ai`, the domain of the [US data region](/documentation/guides/data-regions)) are always excluded from the network logs, so you don't need to blacklist them yourself. The JavaScript SDK does this since **v18.0.0**, the iOS, Android, React Native, Flutter and Ionic Capacitor SDKs since **v19.0.0**.
</Info>

To add a new entry to the blacklist, open your project in the [Gleap dashboard](https://app.gleap.ai), go to **Developer options** and add the URLs under **Network logs → Excluded domains**.

### Set blacklist with code

It's also possible to set the network log blacklist by code. Each call replaces the previous list. The domains set in the dashboard apply in addition.

```javascript theme={null}
Gleap.setNetworkLogsBlacklist(["analytics.example.com", "..."]);
```

## Limitations

By default Gleap captures the last 30 network requests. If you want to capture more network requests (up to 70), you can do so by calling the following method:

```javascript theme={null}
// Sets the max network requests count
Gleap.setMaxNetworkRequests(50);
```

Please keep in mind that the more requests that are being captured, the longer it takes to send the feedback.

Request and response bodies are kept up to 150 KB; longer bodies are cut and marked with `… [truncated, <size> bytes]`. Binary bodies (images, files) are replaced by `[binary body omitted]`, streaming responses (server-sent events, NDJSON) by `[streaming body omitted]`, and a body that was still loading when the ticket was sent by `[body pending]`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.