cadecairos / heroku-syslog-parser

A tool for parsing rfc5424 formatted syslog messages from Heroku

heroku-syslog-parser

This utility can be used to parse syslogs sent over HTTPS from Heroku (see log drains). You'll need to parse out the bytes per log line ahead of time, since Heroku can batch logs together in a single POST request to your log endpoint.

usage

from heroku_syslog_parser import HerokuLogParser, ParseError

log_line='<40>1 2017-05-10T06:45:29+00:00 host app web.3 - State changed from starting to up'

try:
    log_dict = HerokuLogParser.parse(log_line)
except ParseError:
    # handle error

print(log_dict['pri'])        # 40
print(log_dict['version'])    # 1
print(log_dict['timestamp'])  # 2017-05-10T06:45:29+00:00
print(log_dict['hostname'])   # host
print(log_dict['appname'])    # app
print(log_dict['procname'])   # web.3
print(log_dict['msg'])        # State changed from starting to up

if msg is in the logfmt format (key=value), use the parse_dict class method to convert it into a dict:

from heroku_syslog_parser import HerokuLogParser, ParseError

log_line='<40>1 2017-05-10T06:45:29+00:00 host app web.3 - at=info method=GET'

try:
    log_dict = HerokuLogParser.parse(log_line)
except ParseError:
    # handle error

# will be logfmt value if procname is 'router'
if log_dict['procname'] == 'router':
    try:
        log_dict['msg'] = HerokuLogParser.parse_dict(log_dict['msg'])
    except: ParseError:
        # handle error

print(log_dict['pri'])        # 40
print(log_dict['version'])    # 1
print(log_dict['timestamp'])  # 2017-05-10T06:45:29+00:00
print(log_dict['hostname'])   # host
print(log_dict['appname'])    # app
print(log_dict['procname'])   # web.3
print(log_dict['msg'])        # {'at': 'info', 'method': 'GET'}