Skip to content
Osuite Osuite Docs

Collect Heroku logs in Osuite

Overview

Section titled “Overview”

Heroku’s Logplex router streams every app and system log line off the platform as a syslog drain. You add a drain that points at an OpenTelemetry Collector, and the Collector’s syslog receiver parses each RFC 5424 message and forwards it to Osuite through the otlp/osuite exporter.

Prerequisites

Section titled “Prerequisites”
  • An OpenTelemetry Collector reachable from the internet over TCP. Heroku drains do not authenticate, so restrict access with network controls and prefer a TLS drain.
  • Your Osuite ingest endpoint and token.
  • The Heroku CLI, authenticated to the app you want to drain.

Collector config

Section titled “Collector config”

This configuration listens for TLS syslog on port 6514 and forwards the parsed records to Osuite. For a plaintext drain, drop the tls block and listen on 514.

receivers:
  syslog:
    tcp:
      listen_address: 0.0.0.0:6514
      tls:
        cert_file: /etc/otel/server.crt
        key_file: /etc/otel/server.key
    protocol: rfc5424


processors:
  batch:


exporters:
  otlp/osuite:
    endpoint: ingest.<region>.osuite.io:443
    tls:
      insecure: false
    headers:
      x-osuite-ingest-token: <your-ingest-token>


service:
  pipelines:
    logs:
      receivers: [syslog]
      processors: [batch]
      exporters: [otlp/osuite]

The RFC 5424 parser maps the syslog timestamp, hostname, app name, and severity onto each record. Heroku sets the app name to the dyno (for example web.1, router, heroku), so you can filter by process in the explorer.

Add the drain in Heroku

Section titled “Add the drain in Heroku”

Point the drain at the Collector’s public address and the port from the config. Use a TLS drain in production:

Terminal window
heroku drains:add syslog+tls://<your-collector-host>:6514 -a <your-app>

For a plaintext drain against port 514:

Terminal window
heroku drains:add syslog://<your-collector-host>:514 -a <your-app>

Each drain is issued a token (d.<uuid>) that appears in the delivered messages; use it to distinguish apps when several drain to the same Collector.

Verify in Osuite

Section titled “Verify in Osuite”

What you should see

Heroku log lines appear in the Logs Explorer within a minute, tagged with the dyno or process name and the drain’s severity. Restarting a dyno or hitting the app produces router and app records you can filter by process.

Troubleshooting

Section titled “Troubleshooting”

If no logs arrive, confirm the drain was added (heroku drains -a <your-app>) and that the Collector’s port is reachable from the public internet. A TLS handshake failure means the certificate does not match the drain hostname — Heroku verifies certificates on syslog+tls drains. If records arrive but timestamps or severity look wrong, confirm protocol: rfc5424; Heroku does not emit RFC 3164.

No data in Osuite after a few minutes? Work through these checks.

  • Endpoint — confirm the exporter targets exactly ingest.<region>.osuite.io:443 for your region, over TLS.
  • Token — confirm the ingest header carries a valid <your-ingest-token> and has not been rotated.
  • Pipeline — confirm the signal you expect (traces, logs, or metrics) is wired into an active pipeline with the otlp/osuite exporter attached.
  • Export errors — check the application or Collector logs for OTLP export failures (auth, DNS, TLS, connection refused).
  • Network — confirm the host has outbound access to the ingest endpoint on port 443.
  • Timing — allow up to a minute for the first data to appear before assuming a failure.

Still stuck? Ask the Investigation Agent or contact support.

Next steps

Section titled “Next steps”