---
url: https://simpledatalogs.com/docs/integrations/datadog.md
description: >-
  Point the Datadog Agent, Vector or Fluent Bit logs output at simpledatalogs
  and use the ingest key as the API key.
---

# Datadog logs

Anything that sends to Datadog's logs intake can send to simpledatalogs. Point the logs URL at ingest and use your ingest key as the API key.

::: code-group

```yaml [Datadog Agent]
# datadog.yaml
api_key: sdl_sec_…
logs_enabled: true
logs_config:
  logs_dd_url: edge.simpledatalogs.com:443
  force_use_http: true
  use_compression: true
  compression_kind: gzip
# Metrics and APM aren't stored, so turn them off.
enable_payloads:
  series: false
  events: false
  service_checks: false
  sketches: false
apm_config:
  enabled: false
```

```yaml [Vector]
sinks:
  simpledatalogs:
    type: datadog_logs
    inputs: [app_logs]
    endpoint: https://edge.simpledatalogs.com
    default_api_key: sdl_sec_…
    compression: gzip
```

```ini [Fluent Bit]
[OUTPUT]
    Name      datadog
    Match     *
    Host      edge.simpledatalogs.com
    TLS       On
    apikey    sdl_sec_…
    compress  gzip
```

:::

Tested with Datadog Agent 7.60.0, Vector 0.43.1 and Fluent Bit 3.2.2.

* The key travels in `DD-API-KEY`, or the `dd-api-key` query parameter. The query parameter takes only a public key (`sdl_pub_…`); a secret key there is refused with `401`. `GET /api/v1/validate` answers the sender's key check.
* `zstd` and `deflate` bodies are refused with `415`; set compression to gzip.
* Datadog metrics, APM and events answer `404`.

## How logs map

| Field | From the log |
|---|---|
| `message` | `message`, masked like a text line |
| `level` | `status`, else `level`, else `severity` |
| `ts` | `timestamp`, else `date` |
| `user_id` | `usr.id` |
| `event_id` | Derived from the log's content when it has a time, so a retried batch never counts twice |
| `props` | Every other attribute (`service`, `hostname`, `ddsource` …), `ddtags` as `tag.<name>`, and `usr.*` fields except email and name |

Success is `202 {}`. An unknown key is `403`, as Datadog answers.

## Next steps

* [Loki](/integrations/loki) and [Splunk HEC](/integrations/splunk): other drop-ins.
* [Text log lines](/api/log-lines#masking): what masking does.