Stream logs to Datadog | Faustine Docs

A Datadog log stream sends each request of a gateway environment to Datadog Log Management as one log, about 30 seconds after the request ends.

Before you begin

A Datadog API key. An application key does not work. Create one under Organization Settings > API Keys in Datadog. See API and application keys in the Datadog docs.
Your Datadog site. It is the domain you sign in to: app.datadoghq.eu is EU1.

Add the stream

In the portal, go to Agent Gateway and select your gateway.
Select the Logs tab, then Log settings.
Under Log streams, select Add a stream.
Under Destination, select Datadog.
Fill in the fields in the table.
Select Send test event. Faustine sends one log marked test: true and shows Delivered when Datadog accepts it.
Select Continue.
Under What to send, choose All requests or Errors and denials, and turn on Discovery calls or Payloads if you want them. Select Continue.
Under Review and create, enter a Name and select Create stream.

Field	Value
Site	US1 (`app.datadoghq.com`), US3, US5, EU1 (`app.datadoghq.eu`), AP1, AP2 or US1-FED (`app.ddog-gov.com`).
API key	The Datadog API key.
Service	The service the logs appear under. Optional. Defaults to `faustine-gateway`.
Tags	Tags added to every log, such as `team:platform`. Up to 20.

The stream's page opens. The first log reaches Datadog about 30 seconds after the next request ends.

What Datadog receives

Faustine sends the requests to the logs intake of your site in batches, with one entry per request.

Attribute	Value
`ddsource`	`faustine`
`service`	The Service field.
`hostname`	The gateway's slug.
`ddtags`	`env:<environment>`, `gateway:<gateway>` and your tags.
`status`	`info` for a request that ended OK, `warn` for a denied or waiting one, `error` for the rest.
`message`	One line, such as `crm.deals.get ok 412 ms`.
`date`	When the request started.
`duration`	The duration in nanoseconds.
`trace_id`	The trace ID of the request.
`faustine`	The whole request: its calls, the exchanges with your API and, if the stream includes them, its payloads.

In Log Explorer, the fields of the request are attributes under @faustine, such as @faustine.tool, @faustine.status and @faustine.actor.name. For the full list, see Log streams.

An entry larger than 1 MB is sent without its payloads and has faustine.payloadsDropped set to true.

Troubleshooting

Symptom	Cause	Fix
The test shows "Datadog rejected the API key"	The key is an application key, was revoked, or belongs to an account on another site.	Enter an API key and select the site of your account.
Logs do not appear under the expected service	Service is empty, so logs use `faustine-gateway`.	Search for `service:faustine-gateway`, or set Service.

Next steps

Log streams: delivery, retries and the fields of a request.
Redact sensitive fields: decide what a stream can carry.
Set recording and retention: record the payloads a stream sends.