Logstash format not working on Heroku

[collimarco]

I have a Rails application hosted on Heroku that ships logs to ELK (logz.io).

The problem is that, with the default format, many fields are included in the log message, but they are not indexed. For this reason I want to produce the logs using the JSON/Logstash format, so that they can be properly indexed.

I have added 'logstash-event':

# production.rb

Rails.application.configure do
  config.lograge.enabled = true
  config.lograge.formatter = Lograge::Formatters::Logstash.new
end

# Gemfile
gem 'lograge'
gem 'logstash-event'

The problem is that now I get this log messages:

I, [2020-06-25T11:05:48.357804 #15]  INFO -- : [0aca977c-a2ed-405-a319-d438ddcbe] {"method":"GET","path":"/9090","format":"html","controller":"RestaurantsController","action":"page","status":200,"duration":5.47,"view":1.58,"db":1.02,"@timestamp":"2020-06-25T11:05:48.357Z","@version":"1","message":"[200] GET /9090 (RestaurantsController#page)"}

The message is still not recognized as JSON... it's still seen as a paragraph of text. I think that the problem is the part before the JSON, probably appended by Heroku.

What should I do in order to properly index fields like format, controller, duration, db, etc?

[bf4]

that's just the actual rails logger formatter

[bmorrall]

Building on the answer from @bf4, the prefix of your message (I, [2020-06-25T11:05:48.357804 #15] INFO -- : [0aca977c-a2ed-405-a319-d438ddcbe]) is added by the standard rails Logger.

While running on Heroku, I've found providing Lograge with a custom Logger piped directly to STDOUT removes the standard rails tagging.

config.lograge.logger = ActiveSupport::Logger.new(STDOUT)

Just make sure you include the RequestID in the Lograge payload, as it's no longer included with each log message:

config.lograge.custom_options = lambda do |event|
  {
    request_id: event.payload[:headers]['action_dispatch.request_id'],
  }.compact
end

Or don't; but it helps a lot with putting other logged messages into context.

[iloveitaly]

Would be great to add this snippet to the documentation. PRs are welcome!