Configure rsyslog for Rails on Elastic Beanstalk

Use an Elastic Beanstalk .ebextensions file to install a persistent rsyslog configuration on each environment instance. First make sure Rails actually writes to syslog: an rsyslog rule selecting the rails program name does not automatically read Rails' log files.

Send Rails logs to local syslog

For a Rails application using Ruby's syslog logger, configure the logger in the appropriate environment file:

require "syslog/logger"
config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new("rails"))

Check compatibility with your Rails/Ruby versions and the application's existing logging configuration. The instance needs a functioning local syslog input. If the application continues writing to a file, use rsyslog's imfile input instead of assuming that $programname will discover it. A remote-syslog logger library is another option, but its transport and failure behavior need separate configuration.

Provision the forwarding rule

For an Amazon Linux platform where the rsyslog package is available through the package mechanism, this .ebextensions/rsyslog.config creates a TCP forwarding rule:

packages:
  yum:
    rsyslog: []

files:
  "/etc/rsyslog.d/10-rails-logs.conf":
    mode: "000644"
    owner: root
    group: root
    content: |
      if $programname == "rails" then {
        action(type="omfwd"
               target="logserver.internal"
               port="514"
               protocol="tcp"
               queue.type="LinkedList")
        stop
      }

container_commands:
  01_validate_and_start_rsyslog:
    command: "rsyslogd -N1 && systemctl enable rsyslog && systemctl restart rsyslog"

Replace the destination with a reachable receiver that accepts TCP syslog. This example uses plain TCP and an in-memory action queue; configure TLS and durable queuing when the network and delivery requirements call for them. The legacy shorthand @@host:514 means TCP; @host:514 means UDP.

stop prevents matching events from reaching later rules. It cannot undo a local write performed by an earlier rule, and it does not delete Rails' existing files. Remove it if later rules should also process the event.

Check platform differences and deployment logs

Package availability and default logging services vary across Elastic Beanstalk platform branches, particularly between Amazon Linux 2 and Amazon Linux 2023. Validate this configuration on the exact platform version in a test environment. Do not assume that rsyslog is preinstalled or that restarting its service is the only required step.

Inspect /var/log/cfn-init.log and /var/log/eb-engine.log for provisioning errors. Then send a tagged test message and verify it at the central receiver:

logger -t rails "Rails syslog forwarding check"

When CloudWatch is simpler

Elastic Beanstalk can stream its configured instance logs to CloudWatch Logs. That may remove the need for a separate syslog receiver. Confirm which files your platform streams; custom Rails logs may need additional configuration. An omfwd syslog action does not send directly to CloudWatch Logs.

References: Elastic Beanstalk customization, instance logging, and rsyslog forwarding.