Send logs to Datadog

Create a stream that sends the logs of your applications to a Datadog log intake URL, in Azion Console or with the Azion API, and confirm the delivery.

Last updated

View as Markdown Agent setup

You can send the logs of a stream to Datadog from Azion Console or with the Azion API.

Data Stream sends each batch of log lines to the log intake URL of your Datadog account and authenticates with a Datadog API key. In the stream form, the endpoint is set in the field labeled Connector, and Datadog is its Datadog option. For every field and its bounds, refer to Endpoints.

In this guide, the stream reads the requests that one workload receives, through the Applications data source.

Choose Console or API here. Every section of the page follows that choice.

Prerequisites

  • An Azion account with the Edit Data Stream permission. For the permissions, refer to Stream settings.
  • A workload on the account that receives requests.
  • A Datadog account.
  • The log intake URL of your Datadog account, with its scheme, such as https://http-intake.logs.datadoghq.com/v1/input.
  • A Datadog API key, created in the Datadog dashboard.

Create the stream

A workload filter limits the stream to the workload you pick. Unlike a stream with sampling, a stream with a workload filter leaves your other streams active.

Send a POST request to https://api.azion.com/v4/workspace/stream/streams. In the body, put the ID of your workload in place of <workload-id>, and your intake URL and API key in the outputs entry. Use your personal token in place of [TOKEN VALUE]:

Shell
01curl -X POST 'https://api.azion.com/v4/workspace/stream/streams' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d {
05 "name": "logs-to-datadog",
06 "active": true,
07 "inputs": [
08 { "type": "raw_logs", "attributes": { "data_source": "workloads" } }
09 ],
10 "transform": [
11 { "type": "filter_workloads", "attributes": { "workloads": [<workload-id>] } },
12 { "type": "render_template", "attributes": { "template": 2 } }
13 ],
14 "outputs": [
15 {
16 "type": "datadog",
17 "attributes": {
18 "url": "https://http-intake.logs.datadoghq.com/v1/input",
19 "api_key": "[API KEY]"
20 }
21 }
22 ]
23 }

In the body, workloads is the API name of the Applications data source, and template 2 is Applications Event Collector. A 201 response returns the stream as Azion stored it:

JSON
01{
02 "state": "executed",
03 "data": {
04 "id": 12354,
05 "name": "logs-to-datadog",
06 "last_editor": "user@example.com",
07 "created": "2026-01-01T12:10:37.000000Z",
08 "last_modified": "2026-01-01T12:10:37.000000Z",
09 "product_version": "1.0",
10 …
11 "outputs": [
12 {
13 "type": "datadog",
14 "attributes": {
15 "url": "https://http-intake.logs.datadoghq.com/v1/input",
16 "api_key": "[API KEY]"
17 }
18 }
19 ]
20 }
21}

The id identifies the stream in every later request, such as /v4/workspace/stream/streams/12354. For every key of the body, refer to Stream settings.

To create the stream in Azion Console:

Open Data Stream

Access Azion Console > Data Stream.

Select + Stream
Name the stream

In the General section, enter a Name. For example: logs-to-datadog.

Select the data source

In the Input section, select Applications in Data Source.

Turn off Sampling

In the Transform section, turn off Sampling while Option is still All Current and Future Workloads, its starting value. A stream cannot carry sampling and a workload filter together.

Choose the workload

In the Transform section, set Option to Filter Workloads. In Available Workload, select your workload and move it to Chosen Workload with the arrow.

Select the template

In the Render Template section, select Applications Event Collector in Template.

Select the Datadog endpoint

In the Output section, select Datadog in Connector.

Enter the intake URL

In URL, enter the log intake URL of your Datadog account. For example: https://http-intake.logs.datadoghq.com/v1/input.

Enter the API key

In API Key, enter your Datadog API key.

Keep the stream active

In the Status section, keep Active turned on.

Select Save

The Console shows Your data stream has been created. The stream appears in the Data Stream list with Datadog in the Connector column and the Active status.

Neither the Console nor the API contacts Datadog when you save. A mistyped URL or an invalid API key shows up only as a failed send. The stream starts to send one to two minutes after you activate it.

Confirm the delivery

Each attempt of the stream to send a batch, successful or not, appears in Real-Time Events with the status code Datadog returned. Make a few requests to the workload and allow about a minute. The stream sends a batch every 60 seconds, or earlier when the batch holds 2,000 log lines.

To read the sends with the API, query the dataStreamedEvents dataset of the Real-Time Events GraphQL API. Replace the dates with a range that covers the activation of the stream:

Shell
01curl -X POST 'https://api.azion.com/v4/events/graphql' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d '{"query":"query { dataStreamedEvents(limit: 20, filter: {tsRange: {begin: \"2026-01-01T12:00:00\", end: \"2026-01-01T12:45:00\"}}, orderBy: [ts_DESC]) { ts endpointType statusCode streamedLines dataStreamed } }"}'

The API answers 200 with one record for each send, the latest first:

JSON
01{
02 "data": {
03 "dataStreamedEvents": [
04 {
05 "ts": "2026-01-01T12:02:04Z",
06 "endpointType": "DATADOG",
07 "statusCode": 200,
08 "streamedLines": 2,
09 "dataStreamed": 2797
10 }
11 ]
12 }
13}

A send to Datadog carries DATADOG in endpointType. A statusCode of 200 means Datadog accepted the batch, and streamedLines and dataStreamed give its size in log lines and bytes. An empty dataStreamedEvents list means the stream has not sent in the range. For every field, refer to Real-Time Events GraphQL fields.

To find the sends in Azion Console:

Open Real-Time Events

Access Azion Console > Real-Time Events.

Select the Data Stream data source
Read the latest sends

Each row is one send. Find the rows with DATADOG in Endpoint Type, and read their Status Code.

A Status Code of 200 means Datadog accepted the batch. Streamed Lines gives the number of log lines in the batch.

Any status other than 200 is the answer of Datadog, except 503, which means Data Stream found the endpoint unavailable. For the causes, refer to Troubleshoot Data Stream.

Next steps

EndpointsEvery field of the Datadog endpoint, with its type, bounds, and API name.Templates and payloadChoose the variables each log line carries to Datadog.Edit, stop, or delete a streamReplace the API key or the intake URL, turn the stream off, or delete it.Troubleshoot Data StreamRead what a status other than 200 means and how to fix the stream.