Best practice to centralize rails logs

[cutmedia]

Hi All,

I would like to know what is the best way to centralize rails productions logs across multiple server. So far I have gathered:

1. Simply monitoring log/production.log. - Physically works, but it get all the fields wrong.
2. Rails app - This works great when I can point it to a local log/production.log.

I'm using a universal forwarder to send the current production.log to the indexing server, but without properly understanding of the fields of the logs it gets all the data wrong.

What would you suggest to use to get data from universal forwarders into a readable format?

Thanks!
Justin

[mikelanghorst · Accepted solution]

Use #1, you can control how field extractions occur. What sourcetype is being detected for your input? You may need to override it either in inputs.conf or props.conf on the forwarder. Then setup your own field extractions either with the UI or directly in props.conf doc here