Question

I would like to send my heroku logs to a remote linux machine and having them filtered into their own separate file in /var/log/

On the heroku side I issued this command:

heroku drains:add syslog://my_linux_ip:514

On my ubuntu machine I edited /etc/rsyslog.conf and uncommented these lines:

# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

Now I will see heroku log output in /var/log/messages

It is tagged with the hostname d.d423cb4b…….

How do I get all of the heroku messages to be collected in /var/log/heroku?

Answer 1

Simply add this line to your rsyslog.conf

if $hostname startswith 'd.d423cb4b' then /var/log/heroku
& ~

Obviously you need to match d.d423cb4b with the actual hostname you observed in your own logs.

The & ~ line instructs rsyslog to not duplicate this output in any other log. So, you should see your output in /var/log/heroku and nowhere else.