1

How can logback be configured to add tags,so that datadog can recognize the source?

I have the following logback.xml:

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE configuration>
<configuration>
    <springProperty scope="local" name="DATADOG_API_KEY" source="datadog.api-key" />
    <appender name="datadog" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>intake.logs.datadoghq.com:10514</destination>
        <keepAliveDuration>1 minute</keepAliveDuration>
        <includeCallerData>true</includeCallerData>
        <encoder class="net.logstash.logback.encoder.LogstashEncoder">
            <includeCallerData>true</includeCallerData>
            <includeTags>true</includeTags>
            <customFields>{"ddtags": "source:java"}</customFields>
            <prefix class="ch.qos.logback.core.encoder.LayoutWrappingEncoder">
                <layout class="ch.qos.logback.classic.PatternLayout">
                    <pattern>${DATADOG_API_KEY} %mdc{weJustNeedSthEmptyHereSoTheXMLParserWillKeepAWhitespace}</pattern>
                </layout>
            </prefix>
        </encoder>
    </appender>
    <root>
        <appender-ref ref="datadog"/>
    </root>
</configuration

Where the custom field ddtags is supposed to set tags for datadog.

The logs show up in datadog and everything works as expected, despite the source-tag. The log messages sent from my service show up with two tags in datadog: source:java and source:undefined:

tags as they show up in datadog

How do I get rid of the source:undefined tag so that datadog correctly recognizes the source?

fragmentedreality
  • 1,287
  • 9
  • 31

1 Answers1

4

Try this

<encoder class="net.logstash.logback.encoder.LogstashEncoder">
        <customFields>
            {"service":"ServiceName","ddsource":"java"}
        </customFields>...
</encoder>
Trevor Kramer
  • 78
  • 4
  • So basically using the key `"ddsource":"java"` instead of `"ddtags":"source:java"` is supposed to work? Unfortunately I don't have access to the system in question anymore to verify. But still, could you link a source to verify you suggestion, please? Thank you! – fragmentedreality Jan 27 '21 at 20:26
  • 2
    This came from datadog support and I verified it works for us – Trevor Kramer Jan 28 '21 at 14:35