Datadog

Datadog Expertise

RapDev is a Datadog Premier Partner focused on accelerating our customers’ time to value.
600
Implementations
110
US-Based Engineers
68
Datadog Certifications

Security & Managed SOC

Quickly and seamlessly implement Cloud SIEM, ASM, SCA, and Cloud Security Posture Management to power a modern DevSecOps strategy

Incident Management

Transform data into high-confidence, actionable incidents using AI-driven detection, clear ownership models, and automated remediation

Marketplace Integrations

RapDev is proud to offer more Datadog Marketplace integrations than any other partner

ServiceNow

ServiceNow Expertise

RapDev is a ServiceNow Elite partner focused on helping you drive business outcomes with the ITx suite.
4.7
CSAT Score
136
Product Line Certs.
67k
AI Agents Discovered

Agentic AI & AI Governance

Deploy and scale production-ready agentic AI to automate workflows and accelerate ServiceNow outcomes

Enterprise Architecture

Connect your technology landscape to business strategy to optimize investments, reduce risk, and accelerate modernization

ServiceNow Store

Leverage RapDev’s certified apps and AI Agents to expedite operations on the Now Platform
Blog
Company

About RapDev

RapDev is powered by a team of experienced, U.S. based engineers focused on redefining service operations through AI, automation, and modern observability.

Join the RapDev team

Our no-frills approach to collaborating is what allows us to deliver the best. Our team is growing and we’re looking for the best in the game.

Press

Latest news and announcements from RapDev

Events & Webinars

From hands-on workshops to industry-leading conferences

Resources

Back to blog

Generating Datadog Events Using Vector

Don’t miss critical events in your logs by using Vector to send them to Datadog as Events

X

min read

September 16, 2024

Aaron Rhodes

Vector is a popular observability pipeline tool that can be used to transform data as it traverses your ecosystem. Commonly we use it to filter logs or convert those logs to metrics, but recently we have started using it to turn logs into Datadog Events.

Compared to logs, Datadog Events have a more rigid object structure which enables Datadog to use them for features like Watchdog and Event Correlation. They are best suited for sparse events, like when an application is started or stopped, a new configuration is loaded, or an unexpected fault that results in application crash and/or restart. Datadog includes 500 events per host per month as part of its Pro plan and 1,000 events per host per month as part of its Enterprise plan.

Critical events like these are often buried in log files that are filled with other verbose messages. With Vector, you can watch for specific log events and generate a Datadog Event with the relevant Title, Status, and Service tag. These events can then be used for Monitors, Dashboard Overlays, or Triggering Workflows.

Demo

Here is an example where we use Vector to watch our logs for three specific messages and publish an event into Datadog with varying status levels.


sources:
demo_logs:
type: demo_logs
format: syslog

transforms:
logs_to_events:
type: remap
inputs:
- demo_logs
source: |
msg = to_string(.message) ?? ""
if contains(msg, "We're gonna need a bigger boat") {
. = {
"title": "Demo service is starting",
"text": .message,
"tags": ["service:" + .service ?? ""],
"source_type_name": .source_type,
"host": "demo-host",
"alert_type": "info",
}
} else if contains(msg, "what just happened") {
. = {
"title": "Demo service has unexpectedly restarted",
"text": .message,
"tags": ["service:" + .service ?? ""],
"source_type_name": .source_type,
"host": "demo-host",
"alert_type": "warning",
}
} else if contains(msg, "There's a breach in the warp core") {
. = {
"title": "Demo service has crashed",
"text": .message,
"tags": ["service:" + .service ?? ""],
"source_type_name": .source_type,
"host": "demo-host",
"alert_type": "error",
}
} else {
# Returning an empty array output will drop all other log events
. = []
}

sinks:
print:
type: console
inputs:
- logs_to_events
encoding:
codec: json
datadog_events:
type: datadog_events
inputs:
- logs_to_events
default_api_key: ${DD_API_KEY}

With Vector's powerful transformation capabilities, you can seamlessly convert critical log data into actionable Datadog Events. Try it yourself and see how it can enhance your monitoring and response efficiency.

Have questions or want to learn more? Reach out to our team at chat@rapdev.io to learn more.