How to get Serilog json-formatted logs to appear correctly in Datadog

Question

I have been asked to implement a centralized monitoring and logging system using DataDog that will receive information from various services and applications, some running as Windows Services on virtual machines and some running inside a Kubernetes cluster. In order to implement the logging aspect so that DataDog can correctly ingest the logs, I'm using Serilog to do the logging.

My plan is currently to write the logs to the console in json format and have the DataDog agent installed on each server or k8s node capture and ship them to DataDog. This works, at least for the k8s node where I've implemented it so far. (I'm trying to avoid using the custom Serilog sink for DataDog as that's discouraged in the DataDog documentation).

My problem is that I cannot get logs ingested correctly on the DataDog side. DataDog expects the json to contain a property call Message but Serilog names this property RenderedMessage (if I use JsonFormatter(renderMessage: true)) or @m (if I use RenderedCompactJsonFormatter()).

How can I get my logs shipped to DataDog and ingested correctly on the DataDog end?

Lamarlamarck

Answer 1

Answering my own question.

The DataDog logging page has a Configuration section. On that page the "Pre processing for JSON logs" section allows you to specify alternate property names for a few of the major log message properties. If you add @m to the Message attributes section and @l to the Status attributes section you will correctly ingest JSON messages from the RenderedCompactJsonFormatter formatter. If you add RenderedMessage and Level respectively you will correctly ingest JsonFormatter(renderMessage: true) formatter. You can specify multiple attributes in each section, so you can simultaneously support both formats.

Lamarlamarck

In my case, the JSON formatter was PascalCase instead of camelCase which meant that the attribute did not match any of the default aliases. Once I added Level to status attribute aliases, everything worked as expected. – Vicechairman