Datadog logs

Anything that sends to Datadog's logs intake can send to simpledatalogs. Point the logs URL at ingest and use your ingest key as the API key.

Datadog Agent

# datadog.yaml
api_key: sdl_sec_…
logs_enabled: true
logs_config:
  logs_dd_url: edge.simpledatalogs.com:443
  force_use_http: true
  use_compression: true
  compression_kind: gzip
# Metrics and APM aren't stored, so turn them off.
enable_payloads:
  series: false
  events: false
  service_checks: false
  sketches: false
apm_config:
  enabled: false

Vector

sinks:
  simpledatalogs:
    type: datadog_logs
    inputs: [app_logs]
    endpoint: https://edge.simpledatalogs.com
    default_api_key: sdl_sec_…
    compression: gzip

Fluent Bit

[OUTPUT]
    Name      datadog
    Match     *
    Host      edge.simpledatalogs.com
    TLS       On
    apikey    sdl_sec_…
    compress  gzip

Tested with Datadog Agent 7.60.0, Vector 0.43.1 and Fluent Bit 3.2.2.

• The key travels in DD-API-KEY, or the dd-api-key query parameter. The query parameter takes only a public key (sdl_pub_…); a secret key there is refused with 401. GET /api/v1/validate answers the sender's key check.
• zstd and deflate bodies are refused with 415; set compression to gzip.
• Datadog metrics, APM and events answer 404.

How logs map

Field	From the log
message	message, masked like a text line
level	status, else level, else severity
ts	timestamp, else date
user_id	usr.id
event_id	Derived from the log's content when it has a time, so a retried batch never counts twice
props	Every other attribute (service, hostname, ddsource …), ddtags as tag.<name>, and usr.* fields except email and name

Success is 202 {}. An unknown key is 403, as Datadog answers.

Next steps

• Loki and Splunk HEC: other drop-ins.
• Text log lines: what masking does.