All Apps and Add-ons

Best practice to centralize rails logs

cutmedia
Engager

Hi All,

I would like to know what is the best way to centralize rails productions logs across multiple server. So far I have gathered:

  1. Simply monitoring log/production.log. - Physically works, but it get all the fields wrong.
  2. Rails app - This works great when I can point it to a local log/production.log.

I'm using a universal forwarder to send the current production.log to the indexing server, but without properly understanding of the fields of the logs it gets all the data wrong.

What would you suggest to use to get data from universal forwarders into a readable format?

Thanks!
Justin

1 Solution

mikelanghorst
Motivator

Use #1, you can control how field extractions occur. What sourcetype is being detected for your input? You may need to override it either in inputs.conf or props.conf on the forwarder. Then setup your own field extractions either with the UI or directly in props.conf doc here

View solution in original post

mikelanghorst
Motivator

Use #1, you can control how field extractions occur. What sourcetype is being detected for your input? You may need to override it either in inputs.conf or props.conf on the forwarder. Then setup your own field extractions either with the UI or directly in props.conf doc here

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...