winston2 installation is required for using the WinstonInstrumentation

[kenodressel]

What version of OpenTelemetry are you using?

    "@opentelemetry/api": "^1.0.4",
    "@opentelemetry/exporter-jaeger": "^1.0.1",
    "@opentelemetry/instrumentation-express": "^0.28.0",
    "@opentelemetry/instrumentation-http": "^0.27.0",
    "@opentelemetry/instrumentation-pg": "^0.28.0",
    "@opentelemetry/instrumentation-winston": "^0.27.1",
    "@opentelemetry/resources": "^1.0.1",
    "@opentelemetry/sdk-node": "^0.27.0",
    "@opentelemetry/semantic-conventions": "^1.0.1",
    "opentelemetry-instrumentation-typeorm": "^0.27.0",
    (...)
    "winston": "^3.5.1"

What version of Node are you using?

v16.13.2

What did you do?

I set up my SDK with typescript 4.5.5 as follows:

 const sdk = new NodeSDK({
    resource: new Resource({
      [SemanticResourceAttributes.SERVICE_NAME]: <name>,
    }),
    traceExporter: new JaegerExporter({
      host: process.env.JAEGER_HOST,
      port: parseInt(process.env.JAEGER_PORT, 10),
    }),
    instrumentations: [
      new HttpInstrumentation(),
      new ExpressInstrumentation(),
      new PgInstrumentation(),
      new TypeormInstrumentation(),
      new WinstonInstrumentation(),
    ],
  });

then installed the above mentioned dependencies and ran tsc.

What did you expect to see?

A compiled js file without warnings.

What did you see instead?

 tsc --build
./node_modules/@opentelemetry/instrumentation-winston/build/src/types.d.ts:4:87 - error TS2307: Cannot find module 'winston2' or its corresponding type declarations.

4 import type { LoggerInstance as Winston2Logger, LogMethod as Winston2LogMethod } from 'winston2';
                                                                                                                                                    ~~~~~~~~~~


Found 1 error.

Additional context

This happens because the winston instrumentation requires both, winston 2 and winston 3 to be installed as both types are exposed. A common hack in the community is to add "winston2": "npm:winston@2.4.5" as a dev dependency. But winston2 (required here) is only the alias for winston version 2 in your package.json. The npm package winston2 has recently seen a surge in popularity which could probably linked to this.

[Flarna]

This sounds very similar to issues reported with graphql - either it doesn't compile (if it is removed from deps) or it causes that a second version is installed (if included in deps).

see e.g. #746 and #802

[dyladan]

We are seeing more and more of these issues recently. I think we will need to add @types/{package} or even the actual package in some cases to regular dependencies of our instrumentations if we want to avoid vendoring our own types for them.

[Flarna]

Actually for winston it seems to be easy to solve as the winston types are only needed internally. created #932