The Datadog Agent logs pipeline is enabled by default in the Datadog Exporter in v0.108.0. This may cause a breaking change if logs::dump_payloads is in use while upgrading, since this option is invalid when the Datadog Agent logs pipeline is enabled. To avoid this issue, remove the logs::dump_payloads config option or temporarily disable the exporter.datadogexporter.UseLogsAgentExporter feature gate.
For a collector deployed on the same host as the log files to be collected, specify the paths of the log files to collect in your Collector configuration:
receivers:filelog:include_file_path:truepoll_interval:500msinclude:- /var/log/*/app.logoperators:- type:json_parser# Layout must match log timestamp format. If this section is removed, timestamp will correspond to the time of log intake by Datadog.- type:time_parserparse_from:attributes.timelayout:'%Y-%m-%dT%H:%M:%S%z'
The filelog receiver needs access to the file paths. The preset mounts the necessary volumes to the collector container for /var/log/pods and collects all logs from /var/log/pods/*/*/*.log. See Important components for Kubernetes for a full list of settings set by the preset.
Collector configuration sets up a list of operators to parse the logs based on different formats: