Splitting rsyslog messages into files based on source (heroku drain)

Question

I set up a heroku log drain, which sends messages to port 514 on my logging instance. The log server sends the messages /var/log/syslog, though, and I'd like it to send them to /var/log/appname.log or something so that they're isolated.

How do I do this? I read something about splitting based on hostname, but I'm not sure how to determine which hostname heroku would be sending over.

Answer 1

Heroku ties a "Drain id" to each log drain that you set up and sends that as the hostname. It'll stay constant until you remove the drain.

You can get the drain id with:

heroku drains > syslog://your-url (drain-id) 

Then it's just a matter of configuring /etc/rsyslog.conf. This hostname filter works for me

if $hostname isequal 'drain-id' then /var/log/app-name.log & ~