Datadog Agent

About

Forward logs from any Datadog Agent deployment into Sazabi. There are two modes: dual-ship keeps your existing Datadog logs pipeline intact and adds Sazabi as a secondary destination, and Sazabi-only replaces the Datadog logs endpoint with Sazabi entirely.

Datadog metrics, APM traces, and other Datadog product data are not supported — only the Agent's logs pipeline is forwarded.

Prerequisites

• Datadog Agent v6.18 or later, or v7.18 or later
• Your Sazabi intake URL, shown above — open the log source and copy the Intake URL from its setup screen (the public key is embedded in the URL)

Set up in the dashboard

Sazabi authenticates using the public key embedded in your intake host, so the Datadog api_key field is not used by Sazabi — but the Agent still requires a non-empty value there to start. In every option below, put your intake host (shown above) where indicated and leave the Datadog api_key as any non-empty value. Choose one of the four configuration options.

Option A: Dual-ship via datadog.yaml

Keep your existing Datadog pipeline and add Sazabi as an additional logs endpoint. Use your intake host in the additional endpoint's Host:

# Enable logs collection if it is not already enabled.
logs_enabled: true

logs_config:
  force_use_http: true
  additional_endpoints:
    # Sazabi authenticates via the public key in the Host below, so this
    # api_key is unused by Sazabi. The Agent requires a non-empty value.
    - api_key: any-non-empty-value
      Host: <your intake hostname>
      Port: 443

Replace <your intake hostname> with the hostname from your intake URL shown above (without https://).

Option B: Dual-ship via environment variables

DD_LOGS_ENABLED=true
DD_LOGS_CONFIG_FORCE_USE_HTTP=true
DD_LOGS_CONFIG_ADDITIONAL_ENDPOINTS='[{"api_key":"any-non-empty-value","Host":"<your intake hostname>","Port":443}]'

Option C: Sazabi-only via environment variables

Use a dedicated Agent or sidecar that sends logs only to Sazabi. Your intake URL carries your public key in the hostname:

DD_API_KEY=any-non-empty-value
DD_LOGS_ENABLED=true
DD_LOGS_CONFIG_LOGS_DD_URL=https://<your intake hostname>
DD_LOGS_CONFIG_FORCE_USE_HTTP=true

Option D: ECS Fargate sidecar

Run a dedicated Datadog Agent sidecar in ECS/Fargate for Sazabi logs:

ECS_FARGATE=true
DD_API_KEY=any-non-empty-value
DD_LOGS_ENABLED=true
DD_LOGS_CONFIG_CONTAINER_COLLECT_ALL=true
DD_LOGS_CONFIG_LOGS_DD_URL=https://<your intake hostname>
DD_LOGS_CONFIG_FORCE_USE_HTTP=true

Restart the Agent

After updating the configuration, restart or redeploy the Datadog Agent so it picks up the new settings.

Set up with the CLI

You can also register the Datadog Agent log source with the Sazabi CLI (installed and authenticated — see CLI reference).

Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):

sazabi log-sources create datadog --mode connectionless

The command prints the intake URL for the new source — copy the whole URL and point your sender at it using the configuration shown above. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint, or sazabi log-sources list to see every log source in the project.

Verify

Restart the Agent and wait for it to reconnect. Open the Intake page in the Sazabi dashboard and confirm logs from the Datadog Agent source appear within a minute or two. The Agent preserves log metadata including message, status, timestamp, hostname, service, and tags.

Troubleshooting

No logs after restarting — Check the Agent log (/var/log/datadog/agent.log) for connection errors to the Sazabi intake hostname. Confirm the intake host is correct and that logs_enabled and force_use_http are set.

Logs reach Datadog but not Sazabi — If using Option A or B, confirm additional_endpoints is correctly nested under logs_config. A YAML indentation error can silently ignore the additional endpoint.

Both approaches active at once — Configuring both a Sazabi additional endpoint and a Sazabi-only logs URL in the same Agent can send duplicate logs. Use one approach only.

Only logs are forwarded — Datadog Agent metrics, APM traces, and other Datadog product data are not supported by this source. Only the logs pipeline is forwarded to Sazabi.

Further reading