Overview

The service remapper processor assigns one or more attributes to your logs as the official service.

Note: If multiple service remapper processors are applied to a given log within the pipeline, only the first one (according to the pipeline’s order) is taken into account.

Use cases

The Service Remapper is typically used to:

• Select another attribute as the service to be used for the log event, if it doesn’t match the default service attribute. For example, logs coming from Microsoft 365 use Workload as the service attribute. You can use a Service Remapper to set that attribute as the service.
• Select an attribute after grok parsing. For example, Bitdefender logs contain the service in the message attribute that first needs to be parsed.

API

Use the Datadog Log Pipeline API endpoint with the following log service remapper JSON payload:

{
  "type": "service-remapper",
  "name": "Define <SOURCE_ATTRIBUTE> as the official log service",
  "is_enabled": true,
  "sources": ["<SOURCE_ATTRIBUTE>"]
}

Further reading

Additional helpful documentation, links, and articles:

Discover Datadog PipelinesDOCUMENTATION