Aggregate logs from AWS Elastic Beanstalk instances (Java, PHP, Ruby, etc.) to Papertrail without a custom AMI. (DEPRECATED)

01papertrail.config

# DEPRECATED
# You probably want one of these newer, better examples:
# http://help.papertrailapp.com/kb/hosting-services/amazon-elastic-beanstalk

# Credits: 
# Jason Pirkey, Táve Corporation, http://www.tave.com/
# Jeremy Mickelson, https://github.com/CyborgMaster

# See http://help.papertrailapp.com/kb/hosting-services/amazon-elastic-beanstalk

packages:
  yum:
    rubygems: []
    ruby-devel: []
    openssl-devel: []
  rubygems:
    eventmachine: []
    remote_syslog: []
    json: []

files:
  "/etc/remote_applog.yml":
    mode: "00644"
    owner: root
    group: root
    encoding: plain
    content: |
      files:
        - <YOUR-TRACKED-FILES>
      hostname: <YOUR-APP-NAME>
      destination:
        host: <YOUR-LOG-DESTINATION>
        port: <YOUR-PORT-NUMBER>

  "/etc/init.d/remote_applog":
    mode: "00555"
    owner: root
    group: root
    encoding: plain
    content: |
      #!/bin/bash
      #
      # remote_syslog This shell script takes care of starting and stopping
      #               remote_syslog daemon
      #
      # chkconfig: - 58 74
      # description: papertrail/remote_syslog \
      #              https://github.com/papertrail/remote_syslog/blob/master/examples/remote_syslog.init.d

      ### BEGIN INIT INFO
      # Provides: remote_applog
      # Required-Start: $network $local_fs $remote_fs
      # Required-Stop: $network $local_fs $remote_fs
      # Should-Start: $syslog $named ntpdate
      # Should-Stop: $syslog $named
      # Short-Description: start and stop remote_errolog
      # Description: papertrail/remote_syslog
      #              https://github.com/papertrail/remote_syslog/blob/master/examples/remote_syslog.init.d
      ### END INIT INFO

      # Source function library.
      . /etc/init.d/functions

      # Source networking configuration.
      . /etc/sysconfig/network

      if [ -f /usr/bin/remote_syslog ]; then
        prog="/usr/bin/remote_syslog"
      else
        prog="/opt/elasticbeanstalk/bin/remote_syslog"
      fi

      config="/etc/remote_applog.yml"
      pid_dir="/var/run"

      EXTRAOPTIONS=""

      pid_file="$pid_dir/remote_applog.pid"

      PATH=/sbin:/bin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

      RETVAL=0

      is_running(){
        [ -e $pid_file ]
      }

      start(){
          echo -n $"Starting $prog: "
          unset HOME MAIL USER USERNAME
          $prog -c $config --tcp --pid-file $pid_file "$EXTRAOPTIONS"
          RETVAL=$?
          echo
          return $RETVAL
      }

      stop(){
          echo -n $"Stopping $prog: "
          if (is_running); then
            kill `cat $pid_file`
            RETVAL=$?
            echo
            return $RETVAL
          else
            echo "$pid_file not found"
          fi
      }

      status(){
          echo -n $"Checking for $pid_file: "

          if (is_running); then
            echo "found"
          else
            echo "not found"
          fi
      }

      reload(){
          restart
      }

      restart(){
          stop
          start
      }

      condrestart(){
          is_running && restart
          return 0
      }


      # See how we were called.
      case "$1" in
          start)
        start
        ;;
          stop)
        stop
        ;;
          status)
        status
        ;;
          restart)
        restart
        ;;
          reload)
        reload
        ;;
          condrestart)
        condrestart
        ;;
          *)
        echo $"Usage: $0 {start|stop|status|restart|condrestart|reload}"
        RETVAL=1
      esac

      exit $RETVAL

commands:
  01_enable_service:
    command: "/sbin/chkconfig remote_applog on"

  02_start_service:
    command: "/sbin/service remote_applog restart"
    ignoreErrors: true

Note: This didn't work for me until I changed the --tcp option to --tls

You can also get rid of the entire conditional section where you're setting prog and just set prog="remote_syslog" since you're already setting the PATH below.

This became an issue for me when remote_syslog was installed to /usr/local/bin instead of /usr/bin or /opt/elasticbeanstalk/bin

The Elastic Beanstalk yum repositories currently have a version mismatch between openssl and openssl-devel that prevents this from working. To make it work you need to remove openssl-devel and remote_syslog from the packages section and explicitly install them in the commands section. You will also need to install gcc and gcc-c++.

packages:
    yum:
        rubygems: []
        ruby-devel: []
        gcc: []
        gcc-c++: []
rubygems:
    json: []

commands:
  00_downgrade_openssl:
    command: "yum -y --skip-broken downgrade openssl-1.0.1g"

  01_install_openssldevel:
    command: "yum -y install openssl-devel"

  02_install_eventmachine:
    command: "gem install eventmachine"

  03_install_remote_syslog:
    command: "gem install remote_syslog"

  04_enable_service:
    command: "/sbin/chkconfig remote_applog on"

  05_start_service:
    command: "/sbin/service remote_applog restart"
    ignoreErrors: true

Additionally, if you are running Docker in Elastic Beanstalk and wish to aggregate the console logs from your application running inside Docker, set the files property in your /etc/remote_applog.yml to:

- /var/log/eb-docker/containers/eb-current-app/*.log