VOOZH about

URL: https://docs.datadoghq.com/byoc-logs/ingest/agent/

⇱ Send logs to BYOC Logs with the Datadog Agent

For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/byoc-logs/ingest/agent.md. A documentation index is available at /llms.txt.

Send logs to BYOC Logs with the Datadog Agent

This product is not supported for your selected Datadog site. ().

Overview

This document provides configuration steps for using the Datadog Agent to send logs to a Datadog BYOC (Bring Your Own Cloud) Logs deployment. Unlike the Datadog SaaS platform, BYOC Logs requires specific Agent configurations to ensure logs are enriched with necessary host-level tags and sent to the correct endpoint. This guide covers how to set these configurations for the most common deployment methods.

Key requirements

To send logs with the Datadog Agent to BYOC Logs, you must configure two environment variables:

DD_LOGS_CONFIG_LOGS_DD_URL
Set this to your BYOC Logs indexer endpoint, usually http://<RELEASE_NAME>-indexer.<NAMESPACE_NAME>.svc.cluster.local:7280. This tells the Agent where to send the logs
DD_LOGS_CONFIG_EXPECTED_TAGS_DURATION
(Optional) This is an optional but highly recommended variable. Set it to a large value, like “100000” (approximately 5 years). This ensures the Agent adds host-level tags to every log it sends. The Datadog SaaS platform automatically enriches logs with these tags after ingestion, but BYOC Logs requires the Agent to add them upfront.

Proxy

If you have configured the Datadog Agent to use a proxy and BYOC Logs is hosted in your internal network, you need to configure the no_proxy setting so the Agent can send logs directly to BYOC Logs without passing through the proxy.

# In the no_proxy section, add the BYOC Logs DNSno_proxy:- http://<RELEASE_NAME>-indexer.<NAMESPACE_NAME>.svc.cluster.local:7280

Additionally, you need to set DD_NO_PROXY_NONEXACT_MATCH to true. For more details, see Datadog Agent Proxy Configuration.

Send Kubernetes logs with the Datadog Operator

To deploy the Agent on Kubernetes using the Datadog Operator, follow the Getting Started with Datadog Operator guide. When you reach Step 3, use the following datadog-agent.yaml configuration instead of the example provided in the guide.

apiVersion:datadoghq.com/v2alpha1kind:DatadogAgentmetadata:name:datadogspec:global:clusterName:<CLUSTER_NAME>site:datadoghq.comcredentials:apiSecret:secretName:datadog-secretkeyName:api-keyenv:- name:DD_LOGS_CONFIG_LOGS_DD_URLvalue:http://<RELEASE_NAME>-indexer.<NAMESPACE_NAME>.svc.cluster.local:7280- name:DD_LOGS_CONFIG_EXPECTED_TAGS_DURATIONvalue:"100000"features:logCollection:enabled:truecontainerCollectAll:trueotlp:receiver:protocols:grpc:enabled:trueendpoint:0.0.0.0:4417prometheusScrape:enabled:trueenableServiceEndpoints:true

Configuration options

Endpoint configuration

The Datadog Agent can be configured to send logs to BYOC Logs using different endpoints:

Additional Agent configuration

You can also configure additional features to send cluster metadata to Datadog:

Alternative deployment methods

If you are not using the Datadog Operator, you can deploy the Agent using one of these common methods:

Helm chart deployment

Run the following command to deploy the Agent using the Helm chart, setting the log-specific environment variables directly.

helm install datadog-agent datadog/datadog \
 --set datadog.apiKey=<YOUR_API_KEY> \
 --set datadog.logs.enabled=true \
 --set datadog.logs.containerCollectAll=true \
 --set datadog.logsConfigContainerCollectAll=true \
 --set agents.containers.agent.env[0].name=DD_LOGS_CONFIG_LOGS_DD_URL \
 --set agents.containers.agent.env[0].value=http://<RELEASE_NAME>-indexer.<NAMESPACE_NAME>.svc.cluster.local:7280

DaemonSet deployment

For custom deployments, set the environment variable in your DaemonSet:

apiVersion:apps/v1kind:DaemonSetmetadata:name:datadog-agentspec:template:spec:containers:- name:agentimage:registry.datadoghq.com/agent:latestenv:- name:DD_API_KEYvalue:<YOUR_API_KEY>- name:DD_LOGS_ENABLEDvalue:"true"- name:DD_LOGS_CONFIG_CONTAINER_COLLECT_ALLvalue:"true"- name:DD_LOGS_CONFIG_LOGS_DD_URLvalue:"http://<RELEASE_NAME>-indexer.<NAMESPACE_NAME>.svc.cluster.local:7280"

Verification

After the Agent is deployed, you can verify that logs are being sent and received correctly.

Check Agent status

Use kubectl exec to check the Agent’s status and confirm it is configured to send logs.

# Check Agent status and logs configuration
kubectl exec -it <datadog-agent-pod> -- agent status | grep -A 10 "Logs Agent"
# Check Agent logs for BYOC Logs connection
kubectl logs <datadog-agent-pod> | grep -i cloudprem

Check logs are indexed in BYOC Logs

Run this command to query the BYOC Logs searcher and verify that it’s indexing the JSON logs.

kubectl exec -it <RELEASE_NAME>-searcher-0 -n <NAMESPACE_NAME> -- curl 'http://localhost:7280/api/v1/datadog/search?query='

Troubleshooting

Agent not sending logs:

  • Verify the DD_LOGS_CONFIG_LOGS_DD_URL environment variable is set correctly
  • Check Agent pod logs: kubectl logs <datadog-agent-pod>
  • Ensure log collection is enabled: DD_LOGS_ENABLED=true

BYOC Logs not receiving logs:

  • Check BYOC Logs indexer logs: kubectl logs -n <NAMESPACE_NAME> -l app=<RELEASE_NAME>-indexer
  • Verify network connectivity between Agent and BYOC Logs indexer
  • Confirm BYOC Logs service is running: kubectl get pods -n <NAMESPACE_NAME>

Further reading