Log Messages into Datadog

Not applicable

I am hoping to consolidate all of my logs into one system. I am planning on moving my Apigee logging from loggly to Datadog.

Has anyone been able to set up a MessageLogging policy with Datadog logs?

My policy looks something like:

<MessageLogging async="false" continueOnError="false" enabled="true" name="Log-Warnings">
    <DisplayName>Log-Warnings</DisplayName>
    <Syslog>
        <Message>APIKEY test</Message>
        <Host>intake.logs.datadoghq.com</Host>
        <Port>10514</Port>
        <Protocol>TCP</Protocol>
    </Syslog>
    <logLevel>WARNING</logLevel>
</MessageLogging>

It does not seem to work. I have not been able to view logs in Datdog. Is there a way I can debug the message sent in apigee?

I have also tried using the format Datadog defines for rsyslog:

"YOURAPIKEY <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% - - - %msg%\n"

I should be able to get that format by setting FormatMessage to true. However, am unable to set my Datadog API Key at the beginning of the message if I set it to true.

Datadog Docs: https://docs.datadoghq.com/logs/

1 13 2,805
13 REPLIES 13

dave_pickard
Participant III

Did you get anywhere with this? I've been trying to integrate to Datadog like this as well but with no success so far.

Dave, what problem did you encounter? Are you not able to embed your APIkey?

Can you elaborate on the problem?

Hi @Dino-at-Google, the problem is pretty much the same as Erik's above. I've put my API Key into the message and tried various options - format message=true|false, SSL / non SSL, various formats - nothing ends up coming through in Datadog logs. I believe for it to get into Datadog log the API key must be right at the start of the bytestream it receives. I've not idea what Edge is actually sending because obviously we don't have facility to trace network.


Supposedly there may be an issue with FormatMessage = false: https://community.apigee.com/comments/62761/view.html

Could be related.

Hi there,

At the moment, the Message Logging policy strictly conforms to the syslog spec which specifies all message starting with PRI (<14> for log messages). This will occur even when FormatMessage=false. I.e.

When FormatMessage=true:

<14>1 2016-02-23T09:24:39.039+0000 e49cd3a9-4cf6-48a7-abb9-7ftfe4d97d00 Apigee-Edge - - - Message starts here

When FormatMessage=false:

<14>2016-02-23T09:24:39.039+0000 INFO: Message starts here

So with FormatMessage=false, we still begin the message with the priority, date, and loglevel.

We have a number of customer issues with various syslog providers who need further customization. Please bear with us while we assess the options.

Cheers,

Mark

Thanks for the update. Looking forward to see future options.

Hi @Mark Eccles, do you guys have any updates about this issue?

Cheers,

Jaime

Yes @Jaime Munera, this will be fixed in the 190301 Apigee Edge SaaS release

the bug reference number is 68722102

Sweet, @Mark Eccles does it mean it's been fixed already given that the 190301 release was applied on Thursday, April 18, 2019. Is that right?

So if we set FormatMessage=false, the message will not include the priority value in front?

Cheers

I haven't managed to send logs into DataDog via the MessageLogging policy <over TCP> yet (@Mark Eccles can probably help us with this).

However I found a workaround using the ServiceCallout policy <over HTTP> (based on this post https://community.apigee.com/content/kbentry/13298/log-messages-into-splunk.html)

<ServiceCallout async="false" continueOnError="false" enabled="true" name="LogsToDD">
    <DisplayName>LogToDatadog</DisplayName>
    <Properties/>
    <Request clearPayload="true" variable="myRequest">
        <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
        <Set>
            <Payload contentType="application/json">
                {"host":"apigee", "service":"test", "message":"Hello World!"}
            </Payload>
            <Path>v1/input/{API-KEY}</Path>
            <Verb>POST</Verb>
        </Set>
    </Request>
    <Response>calloutResponse</Response>
    <HTTPTargetConnection>
        <Properties/>
        <URL>https://http-intake.logs.datadoghq.com</URL>
    </HTTPTargetConnection>
</ServiceCallout>

Hope this helps anyone in the main time Apigee adds support for Datadog integration.

Cheers.

As of today if you add PayloadOnly property like following , it works fine for public cloud


<Syslog>
	<Message><YOUR API KEY> test</Message>
	<Host>tcp-intake.logs.datadoghq.eu</Host>
	<Protocol>TCP</Protocol>
	<Port>1883</Port>
	<PayloadOnly>true</PayloadOnly>
</Syslog>

Hi,

We were using a javascript to send datadog logs but we just moved to using a message logging policy. This is setup in PostClientFlow so the client-sent variables are available. The json is parsed by datadog. I had an issues with using dots in values. I ended up change to dashes and is parsed better.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<MessageLogging async="false" continueOnError="true" enabled="true" name="logging">
    <DisplayName>logging-dd</DisplayName>
    <Syslog>
        <Message> <apikey> { "test": "testing", "success": "yes" }</Message>
        <Host>intake.logs.datadoghq.com</Host>
        <Port>10516</Port>
        <Protocol>TCP</Protocol>
        <PayloadOnly>true</PayloadOnly>
        <SSLInfo>
            <Enabled>true</Enabled>
        </SSLInfo>
    </Syslog>
</MessageLogging>

nice! I was not aware that Datadog exposed a syslog endpoint. This is really handy!