We recently noticed that swagger-stats appears to be missing some requests in the exposed swagger-stats/metrics route. The application in question is using Open API using express-openapi. We also have metrics for the HA proxies fronting the application as well as a bunyan middleware logging all requests within the same application that happens to also report request-finish events along with a status code.

Looking at the latest metrics, we see a little over 1.7M 200s and 100K 401s being reported by HA proxy, whereas swagger-stats is reporting a little less than 700K 200s and only 282 401s. The logs being written to by the bunyan middleware match what HA proxy is reporting.

We are looking specifically at the api_request_total metrics.

Our package versions are:

{
  "bunyan": "^1.8.12",
  "bunyan-middleware": "^1.0.0",
  "express": "^4.17.1",
  "express-async-handler": "^1.1.4",
  "express-openapi": "^6.0.0",
  "swagger-stats": "^0.95.17",
}

We are configuring the swagger-stats middleware as follows:

app.use(
  swStats.getMiddleware({
    swaggerSpec: apiDoc,
    swaggerOnly: true,
    authentication: true,
    onAuthenticate: (req, username, password) => {
        // check auth for metrics
    })
  })
);

In case that helps here is how we are configuring the bunyan middleware:

app.use(
  bunyanMiddleware({
    obscureHeaders: [],
    logger,
    requestStart: true,
  })
);

We are using version 12.16.2 of Node.js.

The application where swagger-stats is installed has been running for 10 days straight without a restart so we don't believe this is due to stats being reset due to a restart.

The issue is also not that some routes are not in the swagger definition and therefore not being kept track of as we do see some metrics for all routes, just nowhere near as many as we would expect to see.

The swagger-stats/metrics route is being scrapped by Prometheus against the application directly as opposed to going through HA Proxy so we also do not believe that is to blame for the discrepancies, nor would that explain the difference in 401s we are seeing.

We are at a loss as to why swagger-stats appears to be missing so many requests.

Any help tracking this down would be appreciated.