Menu

Heroku Log Drain

Do not send Personal Identifiable Information (PII) to AppSignal. Filter PII (e.g., names, emails) from logs and use an ID, hash, or pseudonymized identifier instead.

For HIPAA-covered entities, more information about signing a Business Associate Agreement (BAA) can be found in our Business Add-Ons documentation.

AppSignal can automatically ingest logs via Heroku Log Drain. We recommend using Logfmt as your log format, but we also accept JSON and Plaintext logs. You can find more information on formatting in our Log Formatting Documentation.

Remove old log drains

This Heroku log drain setup will send both logs and metrics to AppSignal. To send only metrics to AppSignal, follow the Heroku log drain setup in our Heroku documentation instead.

Before creating a new log drain for AppSignal, you need to remove any pre-existing AppSignal log drains. You can check for any existing active log drains using the command below, where myapp is the name of your Heroku application:

Shell
heroku drains -a myapp

If there are any active AppSignal log drains, you can remove them using the following command:

Shell
heroku drains:remove -a myapp <url>

Replace <url> above with the URL of the log drain you are trying to remove

Add new log drain

Once any active log drains have been removed, follow the instructions to create a Heroku log source.

Once you have created a log source, use the command below to create a new log drain.

Shell
heroku drains:add "https://appsignal-endpoint.net/logplex?api_key=YOUR_LOG_SOURCE_API_KEY"

Replace YOUR_LOG_SOURCE_API_KEY with the key provided when creating a log source.

When connected, logs should appear in AppSignal. If you still cannot see any logs, please contact us for support.

Severity parsing

By default, Heroku sends all logs with an INFO severity. And since the content of logdrain messages can depend on the source (add-ons, application, Heroku router etc.), there are a couple of ways to override the default severity.

Log format

Set a log format and override the severity.

You can set the format of your log lines in the source to "logfmt" and emit the following string in your logline severity=warning. This will override the default INFO severity to WARNING.

Severity parsing

When adding a Heroku log source in AppSignal, there's a checkbox to enable "Severity parsing."

When checked, we will attempt to parse any valid severity string from the log message. We only do this when the alternatives have not yielded any results (e.g., if you set the source log format to logfmt and emit a severity attribute, that is used instead of the parsed severity).

The following strings are considered valid severities; they can be uppercase, lowercase, or mixed case:

  • TRACE
  • DEBUG
  • INFO
  • NOTICE
  • WARNING
  • WARN
  • ERR
  • ERROR
  • CRIT
  • CRITICAL
  • ALERT
  • EMERG
  • PANIC
  • FATAL

We will not consider these strings a severity, if they are part of a word. Severities encased in blocks are considered severities, for example:

These are parsed as severities:

Shell
[oban] [error] invalid query
ERROR  - My app is broken
error something went wrong
[Error] this is a valid error severity

Note that this means any lowercase severity string (info/debug/warning/trace/etc) anywhere in the log line will change the log severity.

These are not parsed as severities:

Shell
ErrorClass
error: something went wrong
The doctor was panicking just as much as the patient