Logs Custom Destinations

Custom Destinations forward all the logs ingested to an external destination.

Note: Log forwarding is not available for the Government (US1-FED) site. Contact your account representative for more information.

See the Custom Destinations Page for a list of the custom destinations currently configured in web UI.

GET https://api.ap1.datadoghq.com/api/v2/logs/config/custom-destinationshttps://api.datadoghq.eu/api/v2/logs/config/custom-destinationshttps://api.ddog-gov.com/api/v2/logs/config/custom-destinationshttps://api.datadoghq.com/api/v2/logs/config/custom-destinationshttps://api.us3.datadoghq.com/api/v2/logs/config/custom-destinationshttps://api.us5.datadoghq.com/api/v2/logs/config/custom-destinations

Overview

Get the list of configured custom destinations in your organization with their definitions. This endpoint requires any of the following permissions:

  • logs_read_data
  • logs_read_config

  • Response

    OK

    The available custom destinations.

    Expand All

    Field

    Type

    Description

    data

    [object]

    A list of custom destinations.

    attributes

    object

    The attributes associated with the custom destination.

    enabled

    boolean

    Whether logs matching this custom destination should be forwarded or not.

    default: true

    forward_tags

    boolean

    Whether tags from the forwarded logs should be forwarded or not.

    default: true

    forward_tags_restriction_list

    [string]

    List of keys of tags to be filtered.

    An empty list represents no restriction is in place and either all or no tags will be forwarded depending on forward_tags_restriction_list_type parameter.

    default:

    forward_tags_restriction_list_type

    enum

    How forward_tags_restriction_list parameter should be interpreted. If ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded.

    BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. Allowed enum values: ALLOW_LIST,BLOCK_LIST

    default: ALLOW_LIST

    forwarder_destination

     <oneOf>

    A custom destination's location to forward logs.

    Option 1

    object

    The HTTP destination.

    auth [required]

     <oneOf>

    Authentication method of the HTTP requests.

    Option 1

    object

    Basic access authentication.

    type [required]

    enum

    Type of the basic access authentication. Allowed enum values: basic

    default: basic

    Option 2

    object

    Custom header access authentication.

    header_name [required]

    string

    The header name of the authentication.

    type [required]

    enum

    Type of the custom header access authentication. Allowed enum values: custom_header

    default: custom_header

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the HTTP destination. Allowed enum values: http

    default: http

    Option 2

    object

    The Splunk HTTP Event Collector (HEC) destination.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the Splunk HTTP Event Collector (HEC) destination. Allowed enum values: splunk_hec

    default: splunk_hec

    Option 3

    object

    The Elasticsearch destination.

    auth [required]

    object

    Basic access authentication.

    <any-key>

    Basic access authentication.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    index_name [required]

    string

    Name of the Elasticsearch index (must follow Elasticsearch's criteria).

    index_rotation

    string

    Date pattern with US locale and UTC timezone to be appended to the index name after adding - (that is, ${index_name}-${indexPattern}). You can customize the index rotation naming pattern by choosing one of these options:

    • Hourly: yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)
    • Daily: yyyy-MM-dd (as an example, it would render: 2022-10-19)
    • Weekly: yyyy-'W'ww (as an example, it would render: 2022-W42)
    • Monthly: yyyy-MM (as an example, it would render: 2022-10)

    If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation).

    type [required]

    enum

    Type of the Elasticsearch destination. Allowed enum values: elasticsearch

    default: elasticsearch

    name

    string

    The custom destination name.

    query

    string

    The custom destination query filter. Logs matching this query are forwarded to the destination.

    id

    string

    The custom destination ID.

    type

    enum

    The type of the resource. The value should always be custom_destination. Allowed enum values: custom_destination

    default: custom_destination

    {
      "data": [
        {
          "attributes": {
            "enabled": true,
            "forward_tags": true,
            "forward_tags_restriction_list": [
              "datacenter",
              "host"
            ],
            "forward_tags_restriction_list_type": "ALLOW_LIST",
            "forwarder_destination": {
              "auth": {
                "type": "basic"
              },
              "endpoint": "https://example.com",
              "type": "http"
            },
            "name": "Nginx logs",
            "query": "source:nginx"
          },
          "id": "be5d7a69-d0c8-4d4d-8ee8-bba292d98139",
          "type": "custom_destination"
        }
      ]
    }

    Forbidden

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Too many requests

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Code Example

    # Get all custom destinations returns "OK" response
    
    require "datadog_api_client"
    api_instance = DatadogAPIClient::V2::LogsCustomDestinationsAPI.new
    p api_instance.list_logs_custom_destinations()
    

    Instructions

    First install the library and its dependencies and then save the example to example.rb and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" rb "example.rb"

    POST https://api.ap1.datadoghq.com/api/v2/logs/config/custom-destinationshttps://api.datadoghq.eu/api/v2/logs/config/custom-destinationshttps://api.ddog-gov.com/api/v2/logs/config/custom-destinationshttps://api.datadoghq.com/api/v2/logs/config/custom-destinationshttps://api.us3.datadoghq.com/api/v2/logs/config/custom-destinationshttps://api.us5.datadoghq.com/api/v2/logs/config/custom-destinations

    Overview

    Create a custom destination in your organization. This endpoint requires the logs_write_forwarding_rules permission.

    Request

    Body Data (required)

    The definition of the new custom destination.

    Expand All

    Field

    Type

    Description

    data

    object

    The definition of a custom destination.

    attributes [required]

    object

    The attributes associated with the custom destination.

    enabled

    boolean

    Whether logs matching this custom destination should be forwarded or not.

    default: true

    forward_tags

    boolean

    Whether tags from the forwarded logs should be forwarded or not.

    default: true

    forward_tags_restriction_list

    [string]

    List of keys of tags to be filtered.

    An empty list represents no restriction is in place and either all or no tags will be forwarded depending on forward_tags_restriction_list_type parameter.

    default:

    forward_tags_restriction_list_type

    enum

    How forward_tags_restriction_list parameter should be interpreted. If ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded.

    BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. Allowed enum values: ALLOW_LIST,BLOCK_LIST

    default: ALLOW_LIST

    forwarder_destination [required]

     <oneOf>

    A custom destination's location to forward logs.

    Option 1

    object

    The HTTP destination.

    auth [required]

     <oneOf>

    Authentication method of the HTTP requests.

    Option 1

    object

    Basic access authentication.

    password [required]

    string

    The password of the authentication. This field is not returned by the API.

    type [required]

    enum

    Type of the basic access authentication. Allowed enum values: basic

    default: basic

    username [required]

    string

    The username of the authentication. This field is not returned by the API.

    Option 2

    object

    Custom header access authentication.

    header_name [required]

    string

    The header name of the authentication.

    header_value [required]

    string

    The header value of the authentication. This field is not returned by the API.

    type [required]

    enum

    Type of the custom header access authentication. Allowed enum values: custom_header

    default: custom_header

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the HTTP destination. Allowed enum values: http

    default: http

    Option 2

    object

    The Splunk HTTP Event Collector (HEC) destination.

    access_token [required]

    string

    Access token of the Splunk HTTP Event Collector. This field is not returned by the API.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the Splunk HTTP Event Collector (HEC) destination. Allowed enum values: splunk_hec

    default: splunk_hec

    Option 3

    object

    The Elasticsearch destination.

    auth [required]

    object

    Basic access authentication.

    password [required]

    string

    The password of the authentication. This field is not returned by the API.

    username [required]

    string

    The username of the authentication. This field is not returned by the API.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    index_name [required]

    string

    Name of the Elasticsearch index (must follow Elasticsearch's criteria).

    index_rotation

    string

    Date pattern with US locale and UTC timezone to be appended to the index name after adding - (that is, ${index_name}-${indexPattern}). You can customize the index rotation naming pattern by choosing one of these options:

    • Hourly: yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)
    • Daily: yyyy-MM-dd (as an example, it would render: 2022-10-19)
    • Weekly: yyyy-'W'ww (as an example, it would render: 2022-W42)
    • Monthly: yyyy-MM (as an example, it would render: 2022-10)

    If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation).

    type [required]

    enum

    Type of the Elasticsearch destination. Allowed enum values: elasticsearch

    default: elasticsearch

    name [required]

    string

    The custom destination name.

    query

    string

    The custom destination query and filter. Logs matching this query are forwarded to the destination.

    type [required]

    enum

    The type of the resource. The value should always be custom_destination. Allowed enum values: custom_destination

    default: custom_destination

    {
      "data": {
        "attributes": {
          "enabled": false,
          "forward_tags": false,
          "forward_tags_restriction_list": [
            "datacenter",
            "host"
          ],
          "forward_tags_restriction_list_type": "ALLOW_LIST",
          "forwarder_destination": {
            "auth": {
              "password": "datadog-custom-destination-password",
              "type": "basic",
              "username": "datadog-custom-destination-username"
            },
            "endpoint": "https://example.com",
            "type": "http"
          },
          "name": "Nginx logs",
          "query": "source:nginx"
        },
        "type": "custom_destination"
      }
    }
    {
      "data": {
        "attributes": {
          "enabled": false,
          "forward_tags": false,
          "forward_tags_restriction_list": [
            "datacenter",
            "host"
          ],
          "forward_tags_restriction_list_type": "ALLOW_LIST",
          "forwarder_destination": {
            "auth": {
              "header_value": "my-secret",
              "type": "custom_header",
              "header_name": "MY-AUTHENTICATION-HEADER"
            },
            "endpoint": "https://example.com",
            "type": "http"
          },
          "name": "Nginx logs",
          "query": "source:nginx"
        },
        "type": "custom_destination"
      }
    }
    {
      "data": {
        "attributes": {
          "enabled": false,
          "forward_tags": false,
          "forward_tags_restriction_list": [
            "datacenter",
            "host"
          ],
          "forward_tags_restriction_list_type": "ALLOW_LIST",
          "forwarder_destination": {
            "access_token": "my-access-token",
            "endpoint": "https://example.com",
            "type": "splunk_hec"
          },
          "name": "Nginx logs",
          "query": "source:nginx"
        },
        "type": "custom_destination"
      }
    }

    Response

    OK

    The custom destination.

    Expand All

    Field

    Type

    Description

    data

    object

    The definition of a custom destination.

    attributes

    object

    The attributes associated with the custom destination.

    enabled

    boolean

    Whether logs matching this custom destination should be forwarded or not.

    default: true

    forward_tags

    boolean

    Whether tags from the forwarded logs should be forwarded or not.

    default: true

    forward_tags_restriction_list

    [string]

    List of keys of tags to be filtered.

    An empty list represents no restriction is in place and either all or no tags will be forwarded depending on forward_tags_restriction_list_type parameter.

    default:

    forward_tags_restriction_list_type

    enum

    How forward_tags_restriction_list parameter should be interpreted. If ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded.

    BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. Allowed enum values: ALLOW_LIST,BLOCK_LIST

    default: ALLOW_LIST

    forwarder_destination

     <oneOf>

    A custom destination's location to forward logs.

    Option 1

    object

    The HTTP destination.

    auth [required]

     <oneOf>

    Authentication method of the HTTP requests.

    Option 1

    object

    Basic access authentication.

    type [required]

    enum

    Type of the basic access authentication. Allowed enum values: basic

    default: basic

    Option 2

    object

    Custom header access authentication.

    header_name [required]

    string

    The header name of the authentication.

    type [required]

    enum

    Type of the custom header access authentication. Allowed enum values: custom_header

    default: custom_header

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the HTTP destination. Allowed enum values: http

    default: http

    Option 2

    object

    The Splunk HTTP Event Collector (HEC) destination.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the Splunk HTTP Event Collector (HEC) destination. Allowed enum values: splunk_hec

    default: splunk_hec

    Option 3

    object

    The Elasticsearch destination.

    auth [required]

    object

    Basic access authentication.

    <any-key>

    Basic access authentication.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    index_name [required]

    string

    Name of the Elasticsearch index (must follow Elasticsearch's criteria).

    index_rotation

    string

    Date pattern with US locale and UTC timezone to be appended to the index name after adding - (that is, ${index_name}-${indexPattern}). You can customize the index rotation naming pattern by choosing one of these options:

    • Hourly: yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)
    • Daily: yyyy-MM-dd (as an example, it would render: 2022-10-19)
    • Weekly: yyyy-'W'ww (as an example, it would render: 2022-W42)
    • Monthly: yyyy-MM (as an example, it would render: 2022-10)

    If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation).

    type [required]

    enum

    Type of the Elasticsearch destination. Allowed enum values: elasticsearch

    default: elasticsearch

    name

    string

    The custom destination name.

    query

    string

    The custom destination query filter. Logs matching this query are forwarded to the destination.

    id

    string

    The custom destination ID.

    type

    enum

    The type of the resource. The value should always be custom_destination. Allowed enum values: custom_destination

    default: custom_destination

    {
      "data": {
        "attributes": {
          "enabled": true,
          "forward_tags": true,
          "forward_tags_restriction_list": [
            "datacenter",
            "host"
          ],
          "forward_tags_restriction_list_type": "ALLOW_LIST",
          "forwarder_destination": {
            "auth": {
              "type": "basic"
            },
            "endpoint": "https://example.com",
            "type": "http"
          },
          "name": "Nginx logs",
          "query": "source:nginx"
        },
        "id": "be5d7a69-d0c8-4d4d-8ee8-bba292d98139",
        "type": "custom_destination"
      }
    }

    Bad Request

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Forbidden

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Conflict

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Too many requests

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Code Example

    # Create a Basic HTTP custom destination returns "OK" response
    
    require "datadog_api_client"
    api_instance = DatadogAPIClient::V2::LogsCustomDestinationsAPI.new
    
    body = DatadogAPIClient::V2::CustomDestinationCreateRequest.new({
      data: DatadogAPIClient::V2::CustomDestinationCreateRequestDefinition.new({
        attributes: DatadogAPIClient::V2::CustomDestinationCreateRequestAttributes.new({
          enabled: false,
          forward_tags: false,
          forward_tags_restriction_list: [
            "datacenter",
            "host",
          ],
          forward_tags_restriction_list_type: DatadogAPIClient::V2::CustomDestinationAttributeTagsRestrictionListType::ALLOW_LIST,
          forwarder_destination: DatadogAPIClient::V2::CustomDestinationForwardDestinationHttp.new({
            auth: DatadogAPIClient::V2::CustomDestinationHttpDestinationAuthBasic.new({
              password: "datadog-custom-destination-password",
              type: DatadogAPIClient::V2::CustomDestinationHttpDestinationAuthBasicType::BASIC,
              username: "datadog-custom-destination-username",
            }),
            endpoint: "https://example.com",
            type: DatadogAPIClient::V2::CustomDestinationForwardDestinationHttpType::HTTP,
          }),
          name: "Nginx logs",
          query: "source:nginx",
        }),
        type: DatadogAPIClient::V2::CustomDestinationType::CUSTOM_DESTINATION,
      }),
    })
    p api_instance.create_logs_custom_destination(body)
    
    # Create a Custom Header HTTP custom destination returns "OK" response
    
    require "datadog_api_client"
    api_instance = DatadogAPIClient::V2::LogsCustomDestinationsAPI.new
    
    body = DatadogAPIClient::V2::CustomDestinationCreateRequest.new({
      data: DatadogAPIClient::V2::CustomDestinationCreateRequestDefinition.new({
        attributes: DatadogAPIClient::V2::CustomDestinationCreateRequestAttributes.new({
          enabled: false,
          forward_tags: false,
          forward_tags_restriction_list: [
            "datacenter",
            "host",
          ],
          forward_tags_restriction_list_type: DatadogAPIClient::V2::CustomDestinationAttributeTagsRestrictionListType::ALLOW_LIST,
          forwarder_destination: DatadogAPIClient::V2::CustomDestinationForwardDestinationHttp.new({
            auth: DatadogAPIClient::V2::CustomDestinationHttpDestinationAuthCustomHeader.new({
              header_value: "my-secret",
              type: DatadogAPIClient::V2::CustomDestinationHttpDestinationAuthCustomHeaderType::CUSTOM_HEADER,
              header_name: "MY-AUTHENTICATION-HEADER",
            }),
            endpoint: "https://example.com",
            type: DatadogAPIClient::V2::CustomDestinationForwardDestinationHttpType::HTTP,
          }),
          name: "Nginx logs",
          query: "source:nginx",
        }),
        type: DatadogAPIClient::V2::CustomDestinationType::CUSTOM_DESTINATION,
      }),
    })
    p api_instance.create_logs_custom_destination(body)
    
    # Create a Splunk custom destination returns "OK" response
    
    require "datadog_api_client"
    api_instance = DatadogAPIClient::V2::LogsCustomDestinationsAPI.new
    
    body = DatadogAPIClient::V2::CustomDestinationCreateRequest.new({
      data: DatadogAPIClient::V2::CustomDestinationCreateRequestDefinition.new({
        attributes: DatadogAPIClient::V2::CustomDestinationCreateRequestAttributes.new({
          enabled: false,
          forward_tags: false,
          forward_tags_restriction_list: [
            "datacenter",
            "host",
          ],
          forward_tags_restriction_list_type: DatadogAPIClient::V2::CustomDestinationAttributeTagsRestrictionListType::ALLOW_LIST,
          forwarder_destination: DatadogAPIClient::V2::CustomDestinationForwardDestinationSplunk.new({
            access_token: "my-access-token",
            endpoint: "https://example.com",
            type: DatadogAPIClient::V2::CustomDestinationForwardDestinationSplunkType::SPLUNK_HEC,
          }),
          name: "Nginx logs",
          query: "source:nginx",
        }),
        type: DatadogAPIClient::V2::CustomDestinationType::CUSTOM_DESTINATION,
      }),
    })
    p api_instance.create_logs_custom_destination(body)
    

    Instructions

    First install the library and its dependencies and then save the example to example.rb and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" rb "example.rb"

    GET https://api.ap1.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.datadoghq.eu/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.ddog-gov.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.us3.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.us5.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}

    Overview

    Get a specific custom destination in your organization. This endpoint requires any of the following permissions:

  • logs_read_data
  • logs_read_config

  • Arguments

    Path Parameters

    Name

    Type

    Description

    custom_destination_id [required]

    string

    The ID of the custom destination.

    Response

    OK

    The custom destination.

    Expand All

    Field

    Type

    Description

    data

    object

    The definition of a custom destination.

    attributes

    object

    The attributes associated with the custom destination.

    enabled

    boolean

    Whether logs matching this custom destination should be forwarded or not.

    default: true

    forward_tags

    boolean

    Whether tags from the forwarded logs should be forwarded or not.

    default: true

    forward_tags_restriction_list

    [string]

    List of keys of tags to be filtered.

    An empty list represents no restriction is in place and either all or no tags will be forwarded depending on forward_tags_restriction_list_type parameter.

    default:

    forward_tags_restriction_list_type

    enum

    How forward_tags_restriction_list parameter should be interpreted. If ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded.

    BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. Allowed enum values: ALLOW_LIST,BLOCK_LIST

    default: ALLOW_LIST

    forwarder_destination

     <oneOf>

    A custom destination's location to forward logs.

    Option 1

    object

    The HTTP destination.

    auth [required]

     <oneOf>

    Authentication method of the HTTP requests.

    Option 1

    object

    Basic access authentication.

    type [required]

    enum

    Type of the basic access authentication. Allowed enum values: basic

    default: basic

    Option 2

    object

    Custom header access authentication.

    header_name [required]

    string

    The header name of the authentication.

    type [required]

    enum

    Type of the custom header access authentication. Allowed enum values: custom_header

    default: custom_header

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the HTTP destination. Allowed enum values: http

    default: http

    Option 2

    object

    The Splunk HTTP Event Collector (HEC) destination.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the Splunk HTTP Event Collector (HEC) destination. Allowed enum values: splunk_hec

    default: splunk_hec

    Option 3

    object

    The Elasticsearch destination.

    auth [required]

    object

    Basic access authentication.

    <any-key>

    Basic access authentication.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    index_name [required]

    string

    Name of the Elasticsearch index (must follow Elasticsearch's criteria).

    index_rotation

    string

    Date pattern with US locale and UTC timezone to be appended to the index name after adding - (that is, ${index_name}-${indexPattern}). You can customize the index rotation naming pattern by choosing one of these options:

    • Hourly: yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)
    • Daily: yyyy-MM-dd (as an example, it would render: 2022-10-19)
    • Weekly: yyyy-'W'ww (as an example, it would render: 2022-W42)
    • Monthly: yyyy-MM (as an example, it would render: 2022-10)

    If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation).

    type [required]

    enum

    Type of the Elasticsearch destination. Allowed enum values: elasticsearch

    default: elasticsearch

    name

    string

    The custom destination name.

    query

    string

    The custom destination query filter. Logs matching this query are forwarded to the destination.

    id

    string

    The custom destination ID.

    type

    enum

    The type of the resource. The value should always be custom_destination. Allowed enum values: custom_destination

    default: custom_destination

    {
      "data": {
        "attributes": {
          "enabled": true,
          "forward_tags": true,
          "forward_tags_restriction_list": [
            "datacenter",
            "host"
          ],
          "forward_tags_restriction_list_type": "ALLOW_LIST",
          "forwarder_destination": {
            "auth": {
              "type": "basic"
            },
            "endpoint": "https://example.com",
            "type": "http"
          },
          "name": "Nginx logs",
          "query": "source:nginx"
        },
        "id": "be5d7a69-d0c8-4d4d-8ee8-bba292d98139",
        "type": "custom_destination"
      }
    }

    Bad Request

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Forbidden

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Not Found

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Too many requests

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Code Example

    # Get a custom destination returns "OK" response
    
    require "datadog_api_client"
    api_instance = DatadogAPIClient::V2::LogsCustomDestinationsAPI.new
    
    # there is a valid "custom_destination" in the system
    CUSTOM_DESTINATION_DATA_ID = ENV["CUSTOM_DESTINATION_DATA_ID"]
    p api_instance.get_logs_custom_destination(CUSTOM_DESTINATION_DATA_ID)
    

    Instructions

    First install the library and its dependencies and then save the example to example.rb and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" rb "example.rb"

    PATCH https://api.ap1.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.datadoghq.eu/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.ddog-gov.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.us3.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.us5.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}

    Overview

    Update the given fields of a specific custom destination in your organization. This endpoint requires the logs_write_forwarding_rules permission.

    Arguments

    Path Parameters

    Name

    Type

    Description

    custom_destination_id [required]

    string

    The ID of the custom destination.

    Request

    Body Data (required)

    New definition of the custom destination’s fields.

    Expand All

    Field

    Type

    Description

    data

    object

    The definition of a custom destination.

    attributes

    object

    The attributes associated with the custom destination.

    enabled

    boolean

    Whether logs matching this custom destination should be forwarded or not.

    default: true

    forward_tags

    boolean

    Whether tags from the forwarded logs should be forwarded or not.

    default: true

    forward_tags_restriction_list

    [string]

    List of keys of tags to be restricted from being forwarded. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on forward_tags_restriction_list_type parameter.

    default:

    forward_tags_restriction_list_type

    enum

    How forward_tags_restriction_list parameter should be interpreted. If ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded.

    BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. Allowed enum values: ALLOW_LIST,BLOCK_LIST

    default: ALLOW_LIST

    forwarder_destination

     <oneOf>

    A custom destination's location to forward logs.

    Option 1

    object

    The HTTP destination.

    auth [required]

     <oneOf>

    Authentication method of the HTTP requests.

    Option 1

    object

    Basic access authentication.

    password [required]

    string

    The password of the authentication. This field is not returned by the API.

    type [required]

    enum

    Type of the basic access authentication. Allowed enum values: basic

    default: basic

    username [required]

    string

    The username of the authentication. This field is not returned by the API.

    Option 2

    object

    Custom header access authentication.

    header_name [required]

    string

    The header name of the authentication.

    header_value [required]

    string

    The header value of the authentication. This field is not returned by the API.

    type [required]

    enum

    Type of the custom header access authentication. Allowed enum values: custom_header

    default: custom_header

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the HTTP destination. Allowed enum values: http

    default: http

    Option 2

    object

    The Splunk HTTP Event Collector (HEC) destination.

    access_token [required]

    string

    Access token of the Splunk HTTP Event Collector. This field is not returned by the API.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the Splunk HTTP Event Collector (HEC) destination. Allowed enum values: splunk_hec

    default: splunk_hec

    Option 3

    object

    The Elasticsearch destination.

    auth [required]

    object

    Basic access authentication.

    password [required]

    string

    The password of the authentication. This field is not returned by the API.

    username [required]

    string

    The username of the authentication. This field is not returned by the API.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    index_name [required]

    string

    Name of the Elasticsearch index (must follow Elasticsearch's criteria).

    index_rotation

    string

    Date pattern with US locale and UTC timezone to be appended to the index name after adding - (that is, ${index_name}-${indexPattern}). You can customize the index rotation naming pattern by choosing one of these options:

    • Hourly: yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)
    • Daily: yyyy-MM-dd (as an example, it would render: 2022-10-19)
    • Weekly: yyyy-'W'ww (as an example, it would render: 2022-W42)
    • Monthly: yyyy-MM (as an example, it would render: 2022-10)

    If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation).

    type [required]

    enum

    Type of the Elasticsearch destination. Allowed enum values: elasticsearch

    default: elasticsearch

    name

    string

    The custom destination name.

    query

    string

    The custom destination query and filter. Logs matching this query are forwarded to the destination.

    id [required]

    string

    The custom destination ID.

    type [required]

    enum

    The type of the resource. The value should always be custom_destination. Allowed enum values: custom_destination

    default: custom_destination

    {
      "data": {
        "attributes": {
          "name": "Nginx logs (Updated)",
          "query": "source:nginx",
          "enabled": false,
          "forward_tags": false,
          "forward_tags_restriction_list_type": "BLOCK_LIST"
        },
        "type": "custom_destination",
        "id": "be5d7a69-d0c8-4d4d-8ee8-bba292d98139"
      }
    }

    Response

    OK

    The custom destination.

    Expand All

    Field

    Type

    Description

    data

    object

    The definition of a custom destination.

    attributes

    object

    The attributes associated with the custom destination.

    enabled

    boolean

    Whether logs matching this custom destination should be forwarded or not.

    default: true

    forward_tags

    boolean

    Whether tags from the forwarded logs should be forwarded or not.

    default: true

    forward_tags_restriction_list

    [string]

    List of keys of tags to be filtered.

    An empty list represents no restriction is in place and either all or no tags will be forwarded depending on forward_tags_restriction_list_type parameter.

    default:

    forward_tags_restriction_list_type

    enum

    How forward_tags_restriction_list parameter should be interpreted. If ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded.

    BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. Allowed enum values: ALLOW_LIST,BLOCK_LIST

    default: ALLOW_LIST

    forwarder_destination

     <oneOf>

    A custom destination's location to forward logs.

    Option 1

    object

    The HTTP destination.

    auth [required]

     <oneOf>

    Authentication method of the HTTP requests.

    Option 1

    object

    Basic access authentication.

    type [required]

    enum

    Type of the basic access authentication. Allowed enum values: basic

    default: basic

    Option 2

    object

    Custom header access authentication.

    header_name [required]

    string

    The header name of the authentication.

    type [required]

    enum

    Type of the custom header access authentication. Allowed enum values: custom_header

    default: custom_header

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the HTTP destination. Allowed enum values: http

    default: http

    Option 2

    object

    The Splunk HTTP Event Collector (HEC) destination.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    type [required]

    enum

    Type of the Splunk HTTP Event Collector (HEC) destination. Allowed enum values: splunk_hec

    default: splunk_hec

    Option 3

    object

    The Elasticsearch destination.

    auth [required]

    object

    Basic access authentication.

    <any-key>

    Basic access authentication.

    endpoint [required]

    string

    The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.

    index_name [required]

    string

    Name of the Elasticsearch index (must follow Elasticsearch's criteria).

    index_rotation

    string

    Date pattern with US locale and UTC timezone to be appended to the index name after adding - (that is, ${index_name}-${indexPattern}). You can customize the index rotation naming pattern by choosing one of these options:

    • Hourly: yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)
    • Daily: yyyy-MM-dd (as an example, it would render: 2022-10-19)
    • Weekly: yyyy-'W'ww (as an example, it would render: 2022-W42)
    • Monthly: yyyy-MM (as an example, it would render: 2022-10)

    If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation).

    type [required]

    enum

    Type of the Elasticsearch destination. Allowed enum values: elasticsearch

    default: elasticsearch

    name

    string

    The custom destination name.

    query

    string

    The custom destination query filter. Logs matching this query are forwarded to the destination.

    id

    string

    The custom destination ID.

    type

    enum

    The type of the resource. The value should always be custom_destination. Allowed enum values: custom_destination

    default: custom_destination

    {
      "data": {
        "attributes": {
          "enabled": true,
          "forward_tags": true,
          "forward_tags_restriction_list": [
            "datacenter",
            "host"
          ],
          "forward_tags_restriction_list_type": "ALLOW_LIST",
          "forwarder_destination": {
            "auth": {
              "type": "basic"
            },
            "endpoint": "https://example.com",
            "type": "http"
          },
          "name": "Nginx logs",
          "query": "source:nginx"
        },
        "id": "be5d7a69-d0c8-4d4d-8ee8-bba292d98139",
        "type": "custom_destination"
      }
    }

    Bad Request

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Forbidden

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Not Found

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Conflict

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Too many requests

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Code Example

    # Update a custom destination returns "OK" response
    
    require "datadog_api_client"
    api_instance = DatadogAPIClient::V2::LogsCustomDestinationsAPI.new
    
    # there is a valid "custom_destination" in the system
    CUSTOM_DESTINATION_DATA_ID = ENV["CUSTOM_DESTINATION_DATA_ID"]
    
    body = DatadogAPIClient::V2::CustomDestinationUpdateRequest.new({
      data: DatadogAPIClient::V2::CustomDestinationUpdateRequestDefinition.new({
        attributes: DatadogAPIClient::V2::CustomDestinationUpdateRequestAttributes.new({
          name: "Nginx logs (Updated)",
          query: "source:nginx",
          enabled: false,
          forward_tags: false,
          forward_tags_restriction_list_type: DatadogAPIClient::V2::CustomDestinationAttributeTagsRestrictionListType::BLOCK_LIST,
        }),
        type: DatadogAPIClient::V2::CustomDestinationType::CUSTOM_DESTINATION,
        id: CUSTOM_DESTINATION_DATA_ID,
      }),
    })
    p api_instance.update_logs_custom_destination(CUSTOM_DESTINATION_DATA_ID, body)
    

    Instructions

    First install the library and its dependencies and then save the example to example.rb and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" rb "example.rb"

    DELETE https://api.ap1.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.datadoghq.eu/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.ddog-gov.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.us3.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}https://api.us5.datadoghq.com/api/v2/logs/config/custom-destinations/{custom_destination_id}

    Overview

    Delete a specific custom destination in your organization. This endpoint requires the logs_write_forwarding_rules permission.

    Arguments

    Path Parameters

    Name

    Type

    Description

    custom_destination_id [required]

    string

    The ID of the custom destination.

    Response

    OK

    Bad Request

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Forbidden

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Not Found

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Too many requests

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Code Example

    # Delete a custom destination returns "OK" response
    
    require "datadog_api_client"
    api_instance = DatadogAPIClient::V2::LogsCustomDestinationsAPI.new
    
    # there is a valid "custom_destination" in the system
    CUSTOM_DESTINATION_DATA_ID = ENV["CUSTOM_DESTINATION_DATA_ID"]
    api_instance.delete_logs_custom_destination(CUSTOM_DESTINATION_DATA_ID)
    

    Instructions

    First install the library and its dependencies and then save the example to example.rb and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" rb "example.rb"