Skip to content

Datadog Agent

Datadog Agent inputs use a file relay pattern with Fluent Bit + 10x to process events before the Datadog Agent ships them to Datadog. This approach keeps the Datadog Agent as the forwarder (handling buffering, retries, metadata enrichment) while 10x filters and (optionally) compacts events inline.

Architecture

graph LR
    A["<div style='font-size: 14px;'>📝 App Logs</div><div style='font-size: 10px;'>Folder A</div>"] --> B["<div style='font-size: 14px;'>🔧 Fluent Bit</div><div style='font-size: 10px;'>+ 10x sidecar</div>"]
    B --> C["<div style='font-size: 14px;'>📂 Processed</div><div style='font-size: 10px;'>Folder B</div>"]
    C --> D["<div style='font-size: 14px;'>📤 DD Agent</div><div style='font-size: 10px;'>monitors B</div>"]
    D --> E["<div style='font-size: 14px;'>🐶 Datadog</div><div style='font-size: 10px;'>Intake API</div>"]

    classDef logs fill:#2563eb,stroke:#1d4ed8,color:#ffffff,stroke-width:2px,rx:8,ry:8
    classDef fluentbit fill:#ea580c,stroke:#c2410c,color:#ffffff,stroke-width:2px,rx:8,ry:8
    classDef processed fill:#7c3aed,stroke:#6d28d9,color:#ffffff,stroke-width:2px,rx:8,ry:8
    classDef agent fill:#632CA6,stroke:#4F2684,color:#ffffff,stroke-width:2px,rx:8,ry:8
    classDef datadog fill:#16a34a,stroke:#15803d,color:#ffffff,stroke-width:2px,rx:8,ry:8

    class A logs
    class B fluentbit
    class C processed
    class D agent
    class E datadog

Data Flow

  • 📝 App Logs (Folder A) - Application writes logs to original location
  • 🔧 Fluent Bit + 10x - Reads from Folder A, filters and (optionally) compacts events
  • 📂 Processed Logs (Folder B) - 10x writes processed output to new location
  • 📤 Datadog Agent - Monitors Folder B with standard logs_config, handles forwarding
  • 🐶 Datadog - Receives processed events via standard Intake API

Why File Relay?

Benefit Description
🔧 Standard Agent No custom plugins, no protocol changes
🐶 Agent Handles Enrichment Tagging, host metadata, and service correlation stay with the Agent
🔒 Agent Handles Reliability Buffering, retries, and backpressure stay with the Agent
✅ Proven Pattern Uses existing Fluent Bit + 10x integration

When to Use

This module is recommended for VM/traditional infrastructure where the Datadog Agent is already deployed for metrics, APM, and logs. For Kubernetes environments, consider using Fluent Bit or OTel Collector as the log forwarder and sending to Datadog via their HTTP API output plugin.

Key Files

This module uses the Fluent Bit forwarder module under the hood:

File Purpose
fluentbit/conf/tenx-sidecar.conf Reference Fluent Bit config showing the 10x sidecar handoff

Config Files

To configure the Datadog Agent input module, Edit these files.

Below is the default configuration from: datadogAgent/config.yaml.

Edit Online

Edit config.yaml Locally 

# 🔟❎ 'run' Datadog Agent receiver configuration
#
# The Datadog Agent integration is a Fluent Bit file-relay (see doc.md for
# the data flow). The 10x leg uses the Fluent Bit module's options below.
#
# To learn more see https://doc.log10x.com/run/input/forwarder/datadogAgent/

tenx: run

# =============================== Dependencies ================================

include:
  - run/input/forwarder/config.yaml
  - run/modules/input/forwarder/fluentbit

# ============================= Fluent Bit Options ============================

fluentbit:

  # ----------------------------- Input Options -----------------------------

  input:

    # 'port' specifies the TCP port to listen on for events from Fluent Bit's
    #  forward output plugin.
    port: 24224

    # 'path' switches the input to a Unix domain socket instead of TCP.
    #  When set, takes precedence over 'port'.
    # path: /tmp/tenx-fluentbit-in.sock

    # 'messageField' is the name of the JSON field in each Fluent Bit record
    #  carrying the log line text.
    messageField: log

  # ----------------------------- Output Options ----------------------------

  output:

    # 'host' specifies the TCP host of Fluent Bit's forward input receiving
    #  processed events from Log10x.
    host: 127.0.0.1

    # 'port' specifies the TCP port of Fluent Bit's forward input. MUST differ
    #  from input.port or the two would collide on the same listener.
    port: 24225

    # 'path' switches the output to a Unix domain socket instead of TCP.
    #  When set, takes precedence over 'host'/'port'.
    # path: /tmp/tenx-fluentbit-out.sock

    # 'encodeType' is the on-wire format for the Forward record.
    #  - 'delimited': each top-level field of the rendered record becomes its
    #    own Forward record field — preserves the original record's structure.
    #  - 'json': the whole record is wrapped as one stringified field.
    encodeType: delimited


This module is defined in datadogAgent/module.yaml.