I set up a heroku log drain, which sends messages to port 514 on my logging instance. The log server sends the messages /var/log/syslog, though, and I'd like it to send them to /var/log/appname.log or something so that they're isolated.

How do I do this? I read something about splitting based on hostname, but I'm not sure how to determine which hostname heroku would be sending over.

  • I recommend looking in /etc/rsyslog.d/* for example configurations. – Jay Taylor Jul 30 '12 at 22:30

Heroku ties a "Drain id" to each log drain that you set up and sends that as the hostname. It'll stay constant until you remove the drain.

You can get the drain id with:

heroku drains
> syslog://your-url (drain-id)

Then it's just a matter of configuring /etc/rsyslog.conf. This hostname filter works for me

if $hostname isequal 'drain-id' then /var/log/app-name.log
& ~

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.