Edge Datadog

Edge distribution for Datadog log and metric ingestion

Edge Datadog targets environments that send telemetry to Datadog. It supports the Datadog Logs API and Metrics API.

Supported Endpoints

Endpoint	Method	Description
/api/v2/logs	POST	Datadog log ingestion
/api/v1/series	POST	Datadog metrics ingestion
/health	GET	Health check

Configuration

config.json

{
  "listen_address": "0.0.0.0",
  "listen_port": 8080,
  "upstream_url": "https://agent-http-intake.logs.datadoghq.com",
  "metrics_url": "https://api.datadoghq.com",
  "log_level": "info",
  "policy_providers": [
    {
      "id": "local",
      "type": "file",
      "path": "policies.json"
    }
  ]
}

Regional Endpoints

Set upstream_url and metrics_url based on your Datadog region:

Region	Logs URL	Metrics URL
US1	https://agent-http-intake.logs.datadoghq.com	https://api.datadoghq.com
US3	https://agent-http-intake.logs.us3.datadoghq.com	https://api.us3.datadoghq.com
US5	https://agent-http-intake.logs.us5.datadoghq.com	https://api.us5.datadoghq.com
EU1	https://agent-http-intake.logs.datadoghq.eu	https://api.datadoghq.eu
AP1	https://agent-http-intake.logs.ap1.datadoghq.com	https://api.ap1.datadoghq.com

Running

Docker

docker run -d \
  --name edge-datadog \
  -p 8080:8080 \
  -v $(pwd)/config.json:/etc/edge/config.json \
  -v $(pwd)/policies.json:/etc/edge/policies.json \
  ghcr.io/usetero/edge-datadog:latest \
  /etc/edge/config.json

./edge-datadog config.json

zig build run-datadog -- config.json

Datadog Agent Configuration

Point your Datadog Agent at Edge instead of Datadog.

Logs

In datadog.yaml:

logs_config:
  logs_dd_url: "edge-host:8080"
  use_http: true
  use_compression: true

Or via environment variables:

DD_LOGS_CONFIG_LOGS_DD_URL=edge-host:8080
DD_LOGS_CONFIG_USE_HTTP=true

Metrics

In datadog.yaml:

dd_url: "http://edge-host:8080"

Or via environment variable:

DD_DD_URL=http://edge-host:8080

Log Format

Edge expects Datadog’s log format:

[
  {
    "message": "Log message content",
    "status": "info",
    "hostname": "host-1",
    "service": "my-service",
    "ddsource": "python",
    "ddtags": "env:production,version:1.2.3"
  }
]

Field Mapping

Datadog fields map to policy matchers:

Datadog Field	Policy Matcher
message	log_field: body
status	log_field: severity_text
hostname	resource_attribute: host.name
service	resource_attribute: service.name
ddsource	log_attribute: ddsource
ddtags	Parsed into individual log_attribute entries

Example Policies

Drop Debug Logs

{
  "id": "drop-debug",
  "name": "Drop debug logs",
  "log": {
    "match": [{ "log_field": "severity_text", "regex": "^(debug|DEBUG)$" }],
    "keep": "none"
  }
}

Filter by Service

{
  "id": "sample-checkout",
  "name": "Sample checkout service logs",
  "log": {
    "match": [{ "resource_attribute": "service.name", "exact": "checkout" }],
    "keep": "10%"
  }
}

Drop Health Checks

{
  "id": "drop-health-checks",
  "name": "Drop health check logs",
  "log": {
    "match": [{ "log_field": "body", "regex": "GET /health" }],
    "keep": "none"
  }
}

Drop Noisy Metrics

{
  "id": "drop-system-load",
  "name": "Drop system load metrics",
  "metric": {
    "match": [{ "metric_field": "name", "regex": "^system\\.load" }],
    "keep": false
  }
}

Compression

Edge supports gzip and zstd compression for both incoming requests and outgoing requests to Datadog. The Datadog Agent sends compressed payloads by default. Edge accepts those compressed requests and forwards them to Datadog.

Next Steps

Log Filter

All log filtering options

Log Transform

Redact and transform logs