How to do Logging in Phoenix/Elixir Apps?

Our apps deployed to Heroku have request and error logging included which is great.
But if we are going to deploy our apps to _any_ infrastructure #59, logging is _essential_.

## Story

As a developer
I want to have complete system and application logs
So that I can monitor aggregate usage of the app and understand issues when they appear.

As a product owner
I want application logging
So that I can see where faults appear
and get them fixed so people don't abandon the product!

# Todo

+ [ ] Research how to do Logging in Elixir/Phoenix Apps
+ [ ] https://hexdocs.pm/logger/Logger.html & https://hexdocs.pm/phoenix/Phoenix.Logger.html
+ [ ] https://stackoverflow.com/questions/30958616/how-to-log-in-controller-phoenix
+ [ ] https://timber.io/blog/the-ultimate-guide-to-logging-in-elixir
+ [ ] Investigate our options for Open Source logging solutions. - the obvious advantage of running our own logging is **privacy**. We don't need to run any code that ships logs to a remote server outside of our control and there's far lower risk leaking any data.
+ [ ] Read https://devcenter.heroku.com/articles/logging for details on Heroku logs

+ [ ] Requirements for our Logging Solution
+ [ ] Logs should be viewable in near-realtime so they can be monitored during a request.
+ [ ] Logs should be viewable in a Web Browser (_with authentication_)
+ [ ] _Ideally_ Logs should be viewable in a CLI with "tail"
+ [ ] Avoid logging any sensitive data such as [PII](https://en.wikipedia.org/wiki/Personal_data) or API keys etc.

## Commercial Options

+ [ ] While not Open Source, I think https://timber.io is worth considering as their Free tier is absurdly generous and they appear to be Elixir-focussed. see: https://timber.io/blog/the-ultimate-guide-to-logging-in-elixir/ and https://timber.io/pricing ... obvs Timber want to get people "hooked" so they will pay for the service, this is model used by many SaaS providers. I don't think we will have more than `1GB` of logs for the foreseeable future. And provided we are strict with ourselves about not logging any sensitive data I think this could be a _really_ good tool in the short/medium term.