--- title: "Datadog Agent Input" description: "receive and optimize events before shipping to Datadog via Datadog Agent" source: "https://github.com/log-10x/modules/tree/main/pipelines/run/modules/input/forwarder/datadogAgent/module.yaml" icon: "simple/datadog" --- Datadog Agent inputs use a **file relay pattern** with [Fluent Bit + 10x](../fluentbit/) to process events _before_ the Datadog Agent ships them to Datadog. This approach keeps the Datadog Agent as the forwarder (handling buffering, retries, metadata enrichment) while 10x filters and (optionally) compacts events inline. ## Architecture

```mermaid graph LR A["

📝 App Logs

Folder A

"] --> B["

🔧 Fluent Bit

+ 10x sidecar

"] B --> C["

📂 Processed

Folder B

"] C --> D["

📤 DD Agent

monitors B

"] D --> E["

🐶 Datadog

Intake API

"] classDef logs fill:#2563eb,stroke:#1d4ed8,color:#ffffff,stroke-width:2px,rx:8,ry:8 classDef fluentbit fill:#ea580c,stroke:#c2410c,color:#ffffff,stroke-width:2px,rx:8,ry:8 classDef processed fill:#7c3aed,stroke:#6d28d9,color:#ffffff,stroke-width:2px,rx:8,ry:8 classDef agent fill:#632CA6,stroke:#4F2684,color:#ffffff,stroke-width:2px,rx:8,ry:8 classDef datadog fill:#16a34a,stroke:#15803d,color:#ffffff,stroke-width:2px,rx:8,ry:8 class A logs class B fluentbit class C processed class D agent class E datadog ```

### Data Flow - 📝 **App Logs (Folder A)** - Application writes logs to original location - 🔧 **Fluent Bit + 10x** - Reads from Folder A, filters and (optionally) compacts events - 📂 **Processed Logs (Folder B)** - 10x writes processed output to new location - 📤 **Datadog Agent** - Monitors Folder B with standard `logs_config`, handles forwarding - 🐶 **Datadog** - Receives processed events via standard Intake API ### Why File Relay? |Benefit|Description| |---|---| |🔧 **Standard Agent**|No custom plugins, no protocol changes| |🐶 **Agent Handles Enrichment**|Tagging, host metadata, and service correlation stay with the Agent| |🔒 **Agent Handles Reliability**|Buffering, retries, and backpressure stay with the Agent| |✅ **Proven Pattern**|Uses existing [Fluent Bit + 10x](../fluentbit/) integration| ### When to Use This module is recommended for **VM/traditional infrastructure** where the Datadog Agent is already deployed for metrics, APM, and logs. For Kubernetes environments, consider using [Fluent Bit](../fluentbit/) or [OTel Collector](../otel-collector/) as the log forwarder and sending to Datadog via their HTTP API output plugin. ??? tenx-keyfiles "Key Files" This module uses the [Fluent Bit forwarder module](../fluentbit/) under the hood: | File | Purpose | |------|---------| | [`fluentbit/conf/tenx-sidecar.conf`](https://github.com/log-10x/modules/blob/main/pipelines/run/modules/input/forwarder/fluentbit/conf/tenx-sidecar.conf) | Reference Fluent Bit config showing the 10x sidecar handoff | ## :material-wrench-outline: Config Files To configure the Datadog Agent input module, [:material-cog: Edit](https://doc.log10x.com/config/app/#module-config "Learn how to edit app and module configurations") these files. Below is the default configuration from: [datadogAgent/config.yaml](https://github.dev/log-10x/config/blob/main/pipelines/run/input/forwarder/datadogAgent/config.yaml "datadogAgent/config.yaml"){target="\_blank"}.

Edit Online

```yaml # 🔟❎ 'run' Datadog Agent receiver configuration # # The Datadog Agent integration is a Fluent Bit file-relay (see doc.md for # the data flow). The 10x leg uses the Fluent Bit module's options below. # # Every endpoint setting below reads an environment variable first and falls # back to the shipped default, so a deployment can move a port, a host or a # socket path without editing this file. The variable name is the launch # option name in upper snake case with a TENX_ prefix, and because this # integration drives the Fluent Bit module the names are the Fluent Bit ones, # for example the `fluentbitInputPort` option reads TENX_FLUENTBIT_INPUT_PORT. # # To learn more see https://doc.log10x.com/run/input/forwarder/datadogAgent/ tenx: run # =============================== Dependencies ================================ include: - run/input/forwarder/config.yaml - run/modules/input/forwarder/fluentbit # ============================= Fluent Bit Options ============================ fluentbit: # ----------------------------- Input Options ----------------------------- input: # 'port' specifies the TCP port to listen on for events from Fluent Bit's # forward output plugin. # Env var: TENX_FLUENTBIT_INPUT_PORT port: $=TenXEnv.get("TENX_FLUENTBIT_INPUT_PORT", 24224) # 'path' switches the input to a Unix domain socket instead of TCP. # When set, takes precedence over 'port'. Empty means TCP. # Env var: TENX_FLUENTBIT_INPUT_PATH path: $=TenXEnv.get("TENX_FLUENTBIT_INPUT_PATH", "") # 'messageField' is the name of the JSON field in each Fluent Bit record # carrying the log line text. messageField: log # ----------------------------- Output Options ---------------------------- output: # 'host' specifies the TCP host of Fluent Bit's forward input receiving # processed events from Log10x. # Env var: TENX_FLUENTBIT_OUTPUT_HOST host: $=TenXEnv.get("TENX_FLUENTBIT_OUTPUT_HOST", "127.0.0.1") # 'port' specifies the TCP port of Fluent Bit's forward input. MUST differ # from input.port or the two would collide on the same listener. # Env var: TENX_FLUENTBIT_OUTPUT_PORT port: $=TenXEnv.get("TENX_FLUENTBIT_OUTPUT_PORT", 24225) # 'path' switches the output to a Unix domain socket instead of TCP. # When set, takes precedence over 'host'/'port'. Empty means TCP. # Env var: TENX_FLUENTBIT_OUTPUT_PATH path: $=TenXEnv.get("TENX_FLUENTBIT_OUTPUT_PATH", "") # 'encodeType' is the on-wire format for the Forward record. # - 'delimited': each top-level field of the rendered record becomes its # own Forward record field, preserves the original record's structure. # - 'json': the whole record is wrapped as one stringified field. encodeType: delimited ```
:material-github: This module is defined in [datadogAgent/module.yaml](https://github.com/log-10x/modules/tree/main/pipelines/run/modules/input/forwarder/datadogAgent/module.yaml "datadogAgent/module.yaml"){target="\_blank"}.