Logging FiveM server events to Discord

Staff cannot watch the console all day. Sending important events — bans, big money transfers, admin commands, suspicious activity — to Discord channels gives the team a searchable record. Done carelessly, it leaks webhook URLs, floods channels and exposes player data.

local HOOK = GetConvar('logs_webhook_admin', '')

local function log(title, description, color, fields)
    if HOOK == '' then return end
    local body = json.encode({
        username = 'Server Logs',
        embeds = { {
            title = title:sub(1, 256),
            description = description:sub(1, 4096),
            color = color or 3447003,
            fields = fields,
            timestamp = os.date('!%Y-%m-%dT%H:%M:%SZ'),
        } },
    })
    PerformHttpRequest(HOOK, function(status)
        if status == 429 then print('[logs] rate limited by Discord') end
    end, 'POST', body, { ['Content-Type'] = 'application/json' })
end

log('Ban', 'Player banned for RDM', 15158332, {
    { name = 'Player', value = 'Name (license:abc…)', inline = true },
    { name = 'Admin', value = 'StaffName', inline = true },
})

color is a decimal integer (15158332 is red). HTTP details: PerformHttpRequest.

Anyone with a webhook URL can post into your channel. Put it in server.cfg with set logs_webhook_admin "https://discord.com/api/webhooks/..." — set, not setr, so it never reaches clients — and never in shared or client scripts. If one leaks, delete the webhook in Discord and create a new one.

• Discord rate-limits webhooks; on HTTP 429, wait before retrying.
• Queue frequent events (item moves, kills) and send one message every few seconds with several lines or embeds.
• Split channels by topic: admin actions, economy, anticheat, joins.
• Truncate long text to the documented field limits.

IP addresses and identifiers are personal data; restrict those channels to senior staff. Detection ideas: anticheat basics.