> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Datadog Agent

> Configure your Datadog Agent to forward logs to Sazabi alongside or instead of Datadog, using logs_config.additional_endpoints or a dedicated Sazabi-only endpoint.

[All Datadog integration capabilities](https://docs.sazabi.com/catalogs/integrations/datadog)

## About

Forward logs from any Datadog Agent deployment into Sazabi. There are two modes: **dual-ship** keeps your existing Datadog logs pipeline intact and adds Sazabi as a secondary destination, and **Sazabi-only** replaces the Datadog logs endpoint with Sazabi entirely.

> [!WARNING]
>
> Do not combine the `additional_endpoints` (dual-ship) and `DD_LOGS_CONFIG_LOGS_DD_URL` (Sazabi-only) approaches in the same Agent. Use one or the other.

Datadog metrics, APM traces, and other Datadog product data are not supported — only the Agent's logs pipeline is forwarded.

## Prerequisites

* Datadog Agent v6.18 or later, or v7.18 or later
* Your Sazabi intake URL, shown above — open the log source and copy the **Intake URL** from its setup screen (the public key is embedded in the URL)

## Set up in the dashboard

Sazabi authenticates using the public key embedded in your intake host, so the Datadog `api_key` field is not used by Sazabi — but the Agent still requires a non-empty value there to start. In every option below, put your intake host (shown above) where indicated and leave the Datadog `api_key` as any non-empty value. Choose one of the four configuration options.

### Option A: Dual-ship via datadog.yaml

Keep your existing Datadog pipeline and add Sazabi as an additional logs endpoint. Use your intake host in the additional endpoint's `Host`:

```yaml title="datadog.yaml" theme={"system"}
# Enable logs collection if it is not already enabled.
logs_enabled: true

logs_config:
  force_use_http: true
  additional_endpoints:
    # Sazabi authenticates via the public key in the Host below, so this
    # api_key is unused by Sazabi. The Agent requires a non-empty value.
    - api_key: any-non-empty-value
      Host: <your intake hostname>
      Port: 443
```

Replace `<your intake hostname>` with the hostname from your intake URL shown above (without `https://`).

### Option B: Dual-ship via environment variables

```bash theme={"system"}
DD_LOGS_ENABLED=true
DD_LOGS_CONFIG_FORCE_USE_HTTP=true
DD_LOGS_CONFIG_ADDITIONAL_ENDPOINTS='[{"api_key":"any-non-empty-value","Host":"<your intake hostname>","Port":443}]'
```

### Option C: Sazabi-only via environment variables

Use a dedicated Agent or sidecar that sends logs only to Sazabi. Your intake URL carries your public key in the hostname:

```bash theme={"system"}
DD_API_KEY=any-non-empty-value
DD_LOGS_ENABLED=true
DD_LOGS_CONFIG_LOGS_DD_URL=https://<your intake hostname>
DD_LOGS_CONFIG_FORCE_USE_HTTP=true
```

### Option D: ECS Fargate sidecar

Run a dedicated Datadog Agent sidecar in ECS/Fargate for Sazabi logs:

```bash theme={"system"}
ECS_FARGATE=true
DD_API_KEY=any-non-empty-value
DD_LOGS_ENABLED=true
DD_LOGS_CONFIG_CONTAINER_COLLECT_ALL=true
DD_LOGS_CONFIG_LOGS_DD_URL=https://<your intake hostname>
DD_LOGS_CONFIG_FORCE_USE_HTTP=true
```

### Restart the Agent

After updating the configuration, restart or redeploy the Datadog Agent so it picks up the new settings.

### Hand off the change

If this configuration is version-controlled, commit it on a new branch, push it, and open a pull request. Otherwise apply it directly to your Datadog Agent. Keep the intake URL and any keys in environment variables or a secret store, and commit only configuration that references them.

## Set up with the CLI

You can also register the Datadog Agent log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):

```bash theme={"system"}
sazabi log-sources create datadog --mode manual
```

The command prints the intake URL for the new source — copy the whole URL and point your sender at it using the configuration shown above. Run `sazabi log-sources get <log-source-id>` at any time to reprint the endpoint, or `sazabi log-sources list` to see every log source in the project.

## Verify

Restart the Agent and wait for it to reconnect. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm logs from the **Datadog Agent** source appear within a minute or two. The Agent preserves log metadata including `message`, `status`, `timestamp`, `hostname`, `service`, and `tags`.

## Troubleshooting

**No logs after restarting** — Check the Agent log (`/var/log/datadog/agent.log`) for connection errors to the Sazabi intake hostname. Confirm the intake host is correct and that `logs_enabled` and `force_use_http` are set.

**Logs reach Datadog but not Sazabi** — If using Option A or B, confirm `additional_endpoints` is correctly nested under `logs_config`. A YAML indentation error can silently ignore the additional endpoint.

**Both approaches active at once** — Configuring both a Sazabi additional endpoint and a Sazabi-only logs URL in the same Agent can send duplicate logs. Use one approach only.

**Only logs are forwarded** — Datadog Agent metrics, APM traces, and other Datadog product data are not supported by this source. Only the logs pipeline is forwarded to Sazabi.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health.

> [card] [Fluent Bit](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/fluent-bit.md)
>
> Forward logs using Fluent Bit's OpenTelemetry output plugin.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.