Logs
The fields of a GoRunner log line, what each level means, and what is scrubbed first.
This page is for self-hosted installations. On GoRunner Cloud, GoRunner runs this for you.
Each container writes its lines to its output (docker compose logs), and to your OTLP endpoint when one is set. LOG_LEVEL sets how much; LOG_FORMAT sets the shape.
The shape
text, the default, is key=value. json is one object per line, for a log collector:
{"time":"2026-10-03T10:02:14.311Z","level":"WARN","msg":"step failed","step":"notify_sales","piece":"slack","error":"channel_not_found","run_id":"0b7c…","workflow_id":"19a4…","org_id":"7f3e…","trace_id":"4bf92f3577b34da6a3ce929d0e0e4736","span_id":"00f067aa0ba902b7"}Over OTLP, each line is a log record with its level as the severity, its fields as attributes, and its trace and span ids set.
The fields
Every line has time, level and msg. Then, where they apply:
request_id- The API request, also returned as
X-Request-ID, and carried into the queue and the worker. org_id,workspace_id- The organization and workspace.
workflow_id,run_id- On every line a run writes.
step,piece- The step’s name and its app, on every line a step writes.
trace_id,span_id- While tracing is on.
component- The part that wrote it, when not obvious:
telemetry,opentelemetry,browser. error- What went wrong, scrubbed.
The API writes one http request line per request, with method, route (the pattern), status and duration_ms, plus client_request_id when the caller sent its own X-Request-ID. A browser error from the dashboard is a WARN with component=browser. Lines don’t name the process; Docker prefixes each with its container.
Levels
ERROR- GoRunner itself is failing, and someone must act: a refused write, a 5xx, a crash. Also sent to Sentry.
WARN- Something slowed or retried, or a workflow failed: its author fixes that, not you.
INFO- A process started; a run started and finished.
DEBUG- Detail for an investigation, with
LOG_LEVEL=debug.
The level changes on the Monitoring page without a restart, so you can turn on debug while you look.
What is scrubbed
Before a line is written anywhere, these become [redacted]: bearer and Basic credentials, GoRunner’s tokens and signing secrets, provider API keys, private keys, the password in any address, every query string, and any field named like a secret (password, token, cookie, api_key…). A webhook token in a path is cut to 8 characters. Email addresses stay: they say who did something, and grant nothing.
A monitoring connection that keeps failing says so at most once a minute, on the container output only: never through the connection that fails.