Overview

For logs coming from the Datadog Agent, use this processor to exclude or include specific tags in the Datadog tags (ddtags) array. Tags that are excluded or not included are dropped and may reduce your outbound log volume.

Note: This processor only keeps or drops tags that already exist in the ddtags array. It does not add new tags or attributes to a log. To add a new attribute to a log, use the Edit Fields processor.

Setup

To set up the processor:

1. Define a filter query. See Logs Search Syntax for more information.
   • Only logs matching the filter are processed.
   • All logs, regardless of whether they match the filter query, are sent to the next step in the pipeline.
2. Optionally, input a Datadog tags array for the Configure tags section. The supported formats are ["key:value", "key"]. See Define Tags for more information about the key:value format.
3. In the Configure tags section, choose whether to Exclude tags or Include tags. If you provided a tag array in the previous step, select the tag keys you want to configure. You can also manually add tag keys. Note: You can select up to 100 tags.