---
title: "JavaScript SDK: Network logs"
description: "Capture network requests to investigate bug reports with the Gleap JavaScript SDK. Follow the integration code examples."
url: https://docs.gleap.ai/en/articles/415-javascript-sdk-network-logs
collection: "JavaScript"
updated: 2026-11-01
language: en
---

# JavaScript SDK: Network logs

Capture network requests to investigate bug reports with the Gleap JavaScript SDK. Follow the integration code examples.

Gleap logs your page's `fetch` and `XMLHttpRequest` requests and attaches the most recent ones to every ticket, so you can see what went wrong. Enable **Network logs** in the **Developer options** of your project in the [Gleap dashboard](https://app.gleap.ai), or start them from code:

```javascript
Gleap.startNetworkLogger();
```

For each request Gleap logs the method, the absolute URL, request and response headers and bodies, the status, the duration and, for failed, aborted or timed-out requests, the error. Requests that were sent before the SDK started are listed with their timing (from the browser's resource timing). With **Include static resources** enabled, scripts, styles and images are listed as well.

Gleap never changes your requests or responses: bodies are read from a copy, and streaming responses such as server-sent events are never read at all.

## Filtering network logs

Gleap allows you to strip off specific key/value pairs from network logs. This empowers you to easily remove sensitive data like `tokens`, `passwords` or `usernames`.

### How does it work?

Open Settings → Developer → Developer options → Network logs and add keys under Ignored keys. Use Excluded domains for hosts whose requests should not be recorded. These settings load with the widget configuration and are applied on the device before a report is sent.

-   **Headers**: request and response headers with a matching name are removed (the name is matched case-insensitively).
    
-   **JSON bodies**: matching keys are removed from request and response bodies at any depth, including objects inside arrays. A key with dots, like `user.password`, also removes exactly that path.
    
-   **Form bodies and URL parameters**: matching `application/x-www-form-urlencoded` fields and query parameters are removed.
    

Independent of this list, the values of the `Authorization`, `Proxy-Authorization`, `Cookie` and `Set-Cookie` headers are always replaced by `[REDACTED]`.

> **Note:** Matching nested keys, form fields and URL parameters, and the masked credential headers, need SDK **v19.0.0** or newer. Older SDKs only remove top-level keys from headers and JSON bodies, and the Android SDK applied neither the ignored keys nor the blacklist before v19.0.0.

#### Example

To remove an API key header and every `password` field, add `x-api-key` and `password` to the list.

### Set filter with code

It's also possible to set the network log filters by code. Each call replaces the previous list. The keys set in the dashboard apply in addition.

```javascript
Gleap.setNetworkLogPropsToIgnore(["x-api-key", "password", "user.email"]);
```

## Blacklisting URLs

It is possible to blacklist URLs or parts of URLs. If a network request matches one of the entries in the blacklist, the network request won't be included in the network logs.

> **Info:** Requests to Gleap's own hosts (`gleap.io` and `gleap.ai`, the domain of the [US data region](https://gleap-developer-docs.gleap.help/en/articles/711-data-regions)) are always excluded from the network logs, so you don't need to blacklist them yourself. The JavaScript SDK does this since **v18.0.0**, the iOS, Android, React Native, Flutter and Ionic Capacitor SDKs since **v19.0.0**.

To add a new entry to the blacklist, open your project in the [Gleap dashboard](https://app.gleap.ai), go to **Developer options** and add the URLs under **Network logs → Excluded domains**.

### Set blacklist with code

It's also possible to set the network log blacklist by code. Each call replaces the previous list. The domains set in the dashboard apply in addition.

```javascript
Gleap.setNetworkLogsBlacklist(["analytics.example.com", "..."]);
```

## Limitations

By default Gleap captures the last 30 network requests. If you want to capture more network requests (up to 70), you can do so by calling the following method:

```javascript
// Sets the max network requests count
Gleap.setMaxNetworkRequests(50);
```

Please keep in mind that the more requests that are being captured, the longer it takes to send the feedback.

Request and response bodies are kept up to 150 KB; longer bodies are cut and marked with `… [truncated, <size> bytes]`. Binary bodies (images, files) are replaced by `[binary body omitted]`, streaming responses (server-sent events, NDJSON) by `[streaming body omitted]`, and a body that was still loading when the ticket was sent by `[body pending]`.

## Related

- [JavaScript SDK setup](https://docs.gleap.ai/en/articles/393-javascript-sdk-setup.md)
- [JavaScript SDK: Code snippet](https://docs.gleap.ai/en/articles/394-javascript-sdk-code-snippet.md)
- [JavaScript SDK: User identity](https://docs.gleap.ai/en/articles/395-javascript-sdk-user-identity.md)
- [JavaScript SDK: Callbacks](https://docs.gleap.ai/en/articles/396-javascript-sdk-callbacks.md)
- [JavaScript SDK: AI chatbar](https://docs.gleap.ai/en/articles/397-javascript-sdk-ai-chatbar.md)