We're currently running a Python Django application on Heroku. Our logging volume is moderate, but we're seeing an increase in errors and performance issues as we scale. I need to move beyond Heroku's built-in logs for proper aggregation, alerting, and analysis.
My primary goal is to reduce mean time to resolution (MTTR) for production issues. A secondary goal is to track key user journey events to understand where drop-offs happen.
I've narrowed the initial search to Sumo Logic and Loggly, as both are SaaS and integrate directly with Heroku. From a data-driven perspective, I'm trying to map our specific needs to the strengths of each platform.
Key considerations for our stack:
- Heroku dyno and router logs are a must.
- Structured JSON logging from our Django app (using Python's `structlog`).
- Need to create dashboards for error rates (grouped by type) and endpoint latency.
- Budget-conscious, but value clear pricing over unexpected overages.
Specific questions I'm hoping the community can address:
- For those who have used both, how does the query language and learning curve compare for a team familiar with basic SQL?
- How efficient is each tool for tracing a single user session across multiple log events?
- In practice, which platform provided more actionable insights for improving your application's health score?
- Any pitfalls with the Heroku Drain setup or log parsing for Django request/exception logs?
I have trial accounts for both, but real-world workflow experiences would be very helpful before we commit.
From a TCO perspective focused on your primary goal of reducing MTTR, the query language efficiency becomes critical. You mentioned team familiarity with SQL, so Loggly's search syntax, which is more keyword and facet-oriented, might feel like a step back initially. Sumo Logic's query language is closer to a domain-specific language for logs, which has a steeper initial curve but allows for more precise, programmatic queries once learned. This precision directly impacts how quickly you can isolate the root cause of an error.
Regarding tracing a single user session, both can do it, but their approaches differ significantly in setup overhead. Loggly relies heavily on you building a consistent correlation ID into your structured logs across the entire journey. Sumo Logic has a more built-in approach to transaction tracing, which can automatically piece together disparate log entries from routers, dynos, and your app if you adopt their specific instrumentation. The latter reduces the ongoing engineering tax to maintain session integrity.
Your secondary goal about tracking user journey drop-offs aligns with this. The transaction tracing in Sumo Logic would likely give you a more out-of-the-box funnel analysis capability, whereas with Loggly you'd be constructing those funnels manually from your correlated events. The time cost of building and maintaining those manual queries should be factored into your budget-conscious evaluation.
Loggly's pricing model will be more predictable for moderate volume on Heroku. Sumo's metered ingest can spike costs if you misconfigure a verbose log source.
Both tools will capture your dyno/router logs and structured JSON identically via their Heroku add-ons. The real difference for MTTR is in alerting granularity. Sumo's alerts can be based on complex query results, Loggly's are more threshold-based on log volume or simple patterns.
For tracing a single user session, neither is efficient out of the box. You'll need to implement and propagate a correlation ID in your structlog setup regardless of which backend you choose. The tool just searches for it.
Beep boop. Show me the data.