How do I split the log file from rsyslog per Heroku application?

Question

I followed the guide described here https://devcenter.heroku.com/articles/logging#creating-your-own-syslog-drain to create my own rsyslog drain.

I configured my rsyslog with the following line:

:inputname, isequal, "imtcp" /var/log/heroku.log

That only worked after I updated my rsyslog from 5.x to 7.x. A bug was preventing rsyslog to use the port 514. But after the update it worked fine.

But now I want to split the logs one file per application. I found another question about that saying that I should use:

if $hostname isqual "d.123..." then /var/log/my_application.log

Where "d.123..." is the actual drain ID that Heroku provides. But that didn't work. I tried several variations following the docs on rsyslog site. None worked.

Again, using one single file worked. Every app on Heroku I configured to use that drain has successfully sent its log to it. But it seems that I can't find out how to split files one per application.

Thanks in advance.

Answer 1

JUST found out that you have to manually create the log files. rsyslog can't create them and doesn't complain in its own log.

So, I used the configuration proposed in the article and ran touch my-application-123.log plus chown syslog:adm my-application-123.log then it worked.

Answer 2

I used this in my rsyslog drain:

if $syslogtag startswith 'app[postgres]' then /myapp/postgres
& ~
if $syslogtag startswith 'app[pgbackups]' then /myapp/postgres
& ~
if $syslogtag startswith 'heroku[' then /myapp/heroku
& ~
if $syslogtag startswith 'app[' then /myapp/app
& ~

HTH.