Configuring Splunk for Django¶

Configuring Django¶

Django needs to be setup to log files in a particular way for Splunk to read in a way that they can be parsed. To do so, set a formatter to output the time and severity to the logs messages using a formatter of "%(asctime)s [%(levelname)s] %(name)s: %(message)s".

Below is a logging configuration that can be used with the app, add it to your settings file:

LOGGING = {
    'version': 1,
    'disable_existing_loggers': False,
    'formatters': {
        'standard': {
            'format': '%(asctime)s [%(levelname)s] %(name)s: %(message)s'
        },
    },
    'filters': {
        'require_debug_false': {
            '()': 'django.utils.log.RequireDebugFalse'
        }
    },
    'handlers': {
        'null': {
            'level':'DEBUG',
            'class':'django.utils.log.NullHandler',
        },
        'console':{
            'level':'DEBUG',
            'class':'logging.StreamHandler'
        },
        'default': {
            'level':'DEBUG',
            'class':'logging.handlers.RotatingFileHandler',
            'filename': '../var/log/app.log', # Make sure that this path exists, change as necessary
            'maxBytes': 1024*1024*5, # 5 MB
            'backupCount': 5,
            'formatter':'standard',
        }
    },
    'loggers': {
        'django.db': {
            'handlers': ['default'],
            'level': 'DEBUG',
            'propagate': True, # Set this to false on production hosts since the database logs are very verbose
        },
        '': {
            'handlers': ['default'],
            'level': 'DEBUG',
            'propagate': True,
        },
        'django.request': {
            'handlers': ['default'],
            'level': 'ERROR',
            'propagate': True,
        },
    }
}

Configuring Splunk¶

Setup Splunk to monitor the logs files from your Django installation. Make sure to set the sourcetype to "django". See docs.splunk.com for details on how to monitor files with Splunk.