Heroku Log Drain
AppSignal can automatically ingest logs via Heroku Log Drain. We recommend using Logfmt
as your log format, but we also accept JSON
and Plaintext
logs. You can find more information on formatting in our Log Formatting Documentation.
Remove old log drains
Before creating a new log drain for AppSignal, you need to remove any pre-existing AppSignal log drains. You can check for any existing active log drains using the command below, where myapp
is the name of your Heroku application:
heroku drains -a myapp
If there are any active AppSignal log drains, you can remove them using the following command:
heroku drains:remove -a myapp <url>
Replace <url>
above with the URL of the log drain you are trying to remove
Add new log drain
Once any active log drains have been removed, follow the instructions to create a Heroku log source.
Once you have created a log source, use the command below to create a new log drain.
heroku drains:add "https://appsignal-endpoint.net/logplex?api_key=YOUR_LOG_SOURCE_API_KEY"
Replace YOUR_LOG_SOURCE_API_KEY
with the key provided when creating a log source.
When connected, logs should appear in AppSignal. If you still cannot see any logs, please contact us for support.
Severity parsing
By default, Heroku sends all logs with an INFO severity. And since the content of logdrain messages can depend on the source (add-ons, application, Heroku router etc.), there are a couple of ways to override the default severity.
Log format
Set a log format and override the severity.
You can set the format of your log lines in the source to "logfmt" and emit the following string in your logline severity=warning
. This will override the default INFO
severity to WARNING
.
Severity parsing
When adding a Heroku log source in AppSignal, there's a checkbox to enable "Severity parsing."
When checked, we will attempt to parse any valid severity string from the log message. We only do this when the alternatives have not yielded any results (e.g., if you set the source log format to logfmt and emit a severity attribute, that is used instead of the parsed severity).
The following strings are considered valid severities; they can be uppercase, lowercase, or mixed case:
- TRACE
- DEBUG
- INFO
- NOTICE
- WARNING
- WARN
- ERR
- ERROR
- CRIT
- CRITICAL
- ALERT
- EMERG
- PANIC
- FATAL
We will not consider these strings a severity, if they are part of a word. Severities encased in blocks are considered severities, for example:
These are parsed as severities:
[oban] [error] invalid query ERROR - My app is broken error something went wrong [Error] this is a valid error severity
Note that this means any lowercase severity string (info/debug/warning/trace/etc) anywhere in the log line will change the log severity.
These are not parsed as severities:
ErrorClass error: something went wrong The doctor was panicking just as much as the patient