# Stream logs to Datadog

A Datadog log stream sends each request of a gateway environment to Datadog Log Management as one log, about 30 seconds after the request ends.

## Before you begin

- A Datadog API key. An application key does not work. Create one under **Organization Settings** > **API Keys** in Datadog. See [API and application keys](https://docs.datadoghq.com/account_management/api-app-keys/) in the Datadog docs.
- Your Datadog site. It is the domain you sign in to: `app.datadoghq.eu` is EU1.

## Add the stream

1. In the portal, go to [**Agent Gateway**](https://auth.faustine.ai/go?to=%2Fintegrations%2Fagent-gateway) and select your gateway.
2. Select the **Logs** tab, then **Log settings**.
3. Under **Log streams**, select **Add a stream**.
4. Under **Destination**, select **Datadog**.
5. Fill in the fields in the table.
6. Select **Send test event**. Faustine sends one log marked `test: true` and shows **Delivered** when Datadog accepts it.
7. Select **Continue**.
8. Under **What to send**, choose **All requests** or **Errors and denials**, and turn on **Discovery calls** or **Payloads** if you want them. Select **Continue**.
9. Under **Review and create**, enter a **Name** and select **Create stream**.

| Field | Value |
| --- | --- |
| **Site** | **US1** (`app.datadoghq.com`), **US3**, **US5**, **EU1** (`app.datadoghq.eu`), **AP1**, **AP2** or **US1-FED** (`app.ddog-gov.com`). |
| **API key** | The Datadog API key. |
| **Service** | The service the logs appear under. Optional. Defaults to `faustine-gateway`. |
| **Tags** | Tags added to every log, such as `team:platform`. Up to 20. |

The stream's page opens. The first log reaches Datadog about 30 seconds after the next request ends.

## What Datadog receives

Faustine sends the requests to the logs intake of your site in batches, with one entry per request.

| Attribute | Value |
| --- | --- |
| `ddsource` | `faustine` |
| `service` | The **Service** field. |
| `hostname` | The gateway's slug. |
| `ddtags` | `env:<environment>`, `gateway:<gateway>` and your tags. |
| `status` | `info` for a request that ended OK, `warn` for a denied or waiting one, `error` for the rest. |
| `message` | One line, such as `crm.deals.get ok 412 ms`. |
| `date` | When the request started. |
| `duration` | The duration in nanoseconds. |
| `trace_id` | The trace ID of the request. |
| `faustine` | The whole request: its calls, the exchanges with your API and, if the stream includes them, its payloads. |

In Log Explorer, the fields of the request are attributes under `@faustine`, such as `@faustine.tool`, `@faustine.status` and `@faustine.actor.name`. For the full list, see [Log streams](https://docs.faustine.ai/agent-gateway/log-streams/).

An entry larger than 1 MB is sent without its payloads and has `faustine.payloadsDropped` set to `true`.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| The test shows "Datadog rejected the API key" | The key is an application key, was revoked, or belongs to an account on another site. | Enter an API key and select the site of your account. |
| Logs do not appear under the expected service | **Service** is empty, so logs use `faustine-gateway`. | Search for `service:faustine-gateway`, or set **Service**. |

## Next steps

- [Log streams](https://docs.faustine.ai/agent-gateway/log-streams/): delivery, retries and the fields of a request.
- [Redact sensitive fields](https://docs.faustine.ai/agent-gateway/redact-sensitive-fields/): decide what a stream can carry.
- [Set recording and retention](https://docs.faustine.ai/agent-gateway/retention/): record the payloads a stream sends.