AutoGineer
Generated banner for Spring Observability
Generated logo for Spring Observability

Spring Observability

GitHubOfficialFirst committed by jduboisDistributed by GitHub

  • Skill
  • Tool integration
  • Software development
  • MIT
  • No issues found
Download ZIP

From the author

Add and review observability in Spring Boot 3/4 apps: Actuator exposure and health probes, Micrometer metrics, Observation API, OpenTelemetry tracing and OTLP/Prometheus export, structured logging with correlation ids, and safe use of heapdump/threaddump. Use when instrumenting, monitoring or troubleshooting a Spring Boot service.
— the description by jdubois

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured approach to implementing observability in Spring Boot 3 and 4 services. It covers the configuration of Actuator endpoints, health probes, Micrometer metrics, OpenTelemetry tracing, and structured logging. It emphasizes security best practices, particularly regarding the exposure of sensitive endpoints like heapdump and threaddump, and provides guidance on integrating these tools to monitor and troubleshoot production services effectively.

What it does

  • Configures Spring Boot Actuator endpoints and health probes for Kubernetes and general environments.
  • Sets up Micrometer metrics with Prometheus or OTLP export.
  • Implements OpenTelemetry tracing and the Observation API for distributed request tracking.
  • Enables structured logging with correlation IDs for improved log analysis.
  • Provides security guidelines for exposing and protecting sensitive management endpoints.
  • Offers best practices for safe runtime diagnosis using heap and thread dumps.

When to use it

  • When instrumenting a new Spring Boot service for production monitoring.
  • When configuring health checks and liveness/readiness probes for containerized deployments.
  • When setting up distributed tracing to debug microservice interactions.
  • When auditing existing Spring Boot applications for secure observability configurations.
  • When troubleshooting performance issues using metrics and runtime diagnostics.

Advantages

  • Ensures consistent observability patterns across Spring Boot services.
  • Promotes secure-by-default configurations for sensitive management endpoints.
  • Provides clear guidance on avoiding common pitfalls like high-cardinality metrics.
  • Aligns with modern standards like OpenTelemetry and Micrometer.
  • Helps maintain production stability through proper health probe configuration.

Usage examples

“How do I expose Prometheus metrics in my Spring Boot 3 application?”
The agent provides the necessary dependency configuration and the management.endpoints.web.exposure.include property to safely expose the prometheus endpoint.
“What is the secure way to enable heap dumps for troubleshooting?”
The agent explains the risks of heap dumps, provides the configuration to restrict access to an admin role, and emphasizes using a separate management port.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/github/spring-observability/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip spring-observability.zip -d .agents/skills

Documentation by jdubois

Spring Boot observability

Covers Actuator, Micrometer, the Observation API, tracing, and logging. Details in references/. For JDK-level diagnosis (thread dumps, JFR, heap analysis) see the java-diagnostics skill; for securing endpoints see spring-security.

Safety rules

  • Never read or print secrets (.env, credentials, tokens) while inspecting configuration or /actuator/env.

  • Never expose heapdump or threaddump over public HTTP. The only exception is a temporary, user-consented window with authentication, TLS and network restriction, removed afterwards (same policy in java-diagnostics).

  • Never expose env, configprops, loggers, or shutdown in production without authentication and network restrictions.

  • Pin dependency versions via the Boot BOM; do not add explicit versions for Boot-managed artifacts.

Detect first

Check the Boot version (3.x or 4.x) and what is already present (spring-boot-starter-actuator, micrometer-registry-*, tracing/OTel dependencies, logback-spring.xml). Boot 4 modularized observability (spring-boot-micrometer-*, spring-boot-opentelemetry) but starters still bring them in.

Quick start

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
management:
  endpoints:
    web:
      exposure:
        include: health,info,prometheus   # allow-list, never "*" in production
  endpoint:
    health:
      probes:
        enabled: true                     # /actuator/health/liveness and /readiness
      show-details: when-authorized

Topics

Checklist

  • [ ] Only needed endpoints exposed and secured; separate management port if possible.

  • [ ] Liveness/readiness probes configured for the platform (Kubernetes); readiness group includes critical dependencies only.

  • [ ] Metrics exported to the chosen backend; common tags (application, env) set; no high-cardinality tags (user ids, URLs with ids).

  • [ ] Tracing sampling probability set deliberately (Boot default 10%).

  • [ ] Logs carry trace/span ids; JSON structured logs in production.

  • [ ] Custom observations/metrics have tests.

Local runtime insights (optional)

For a local-only developer console (and an opt-in MCP server) that shows a running Spring Boot or Quarkus app's runtime state, see BootUI: https://github.com/jdubois/boot-ui and https://www.julien-dubois.com/boot-ui/. Its agent skill can be installed with gh skill install jdubois/boot-ui skills/bootui.

  • Ask the user for consent before adding any dependency.

  • Use it only in a dev/local profile (for example a Maven/Gradle profile or developmentOnly configuration); never ship it to production.

  • Follow BootUI's own documentation for coordinates and setup rather than copying them here.

See also: https://docs.spring.io/spring-boot/reference/actuator/observability.html and https://docs.micrometer.io/micrometer/reference/.

Files

references/logging.md

Logging

Structured logging (Boot 3.4+)

Built in; no extra dependency for ECS, Logstash and GELF formats.

logging:
  structured:
    format:
      console: ecs        # also: logstash, gelf
      file: ecs
    ecs:
      service:
        name: orders
        version: 1.4.0
        environment: prod

  • Customize JSON with logging.structured.json.include/exclude/rename/add.*. For code-based customization, implement StructuredLoggingJsonMembersCustomizer and register its fully qualified class name with logging.structured.json.customizer, or list the implementation under org.springframework.boot.logging.structured.StructuredLoggingJsonMembersCustomizer in META-INF/spring.factories. A Spring @Bean alone is not discovered: logging initializes before the application context.

  • Custom format: implement StructuredLogFormatter<E> and set logging.structured.format.console to its class name.

  • Use plain text locally and JSON in production profiles (application-prod.yml).

  • Stack trace shaping: logging.structured.json.stacktrace.*.

Correlation ids

  • With tracing on the classpath, traceId and spanId are put in the MDC and appear in the default log pattern and in structured output.

  • Without tracing, set a correlation id yourself (servlet filter putting a header value into MDC, cleared in finally).

  • Customize the pattern: logging.pattern.correlation=[%X{traceId:-},%X{spanId:-}] ; include with logging.include-application-name/logging.include-application-group (Boot 3.4+).

  • Propagate the id to downstream calls (automatic for tracing-enabled clients).

Practices

  • Never log secrets, tokens, passwords, or full personal data.

  • Change levels at runtime only via a secured loggers endpoint.

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

First committed by
GitHub avatar of jduboisjdubois
Publisher
GitHub (Official)
Distributed by
GitHub
Source
github/awesome-copilot · skills/spring-observability · commit 797337f
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Contributors
jdubois

AutoGineer is not affiliated with or endorsed by jdubois or GitHub.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download spring-observability.zip