Using the pillar, how to monitor logs? about datadog-formula

[KSerrania]

Hi @cirsrejoe,

From what I read here, your objective is to have a /etc/datadog-agent/conf.d/logs.d/conf.yaml file with the following contents:

logs:
  - type: file
    path: "/var/log/syslog"
    service: "system"
  - type: file
    path: "/var/log/auth.log"
    service: "system"

To get this with the formula, you need to do this:

  checks:
    logs:
      config:
        logs:
          - type: file
            path: "/var/log/syslog"
            service: "system"
          - type: file
            path: "/var/log/auth.log"
            service: "system"

Explanation (mostly taken from there):
The outermost logs key indicates that you want to create a check named "logs", which will create the /etc/datadog-agent/conf.d/logs.d directory (note that there is no specific restriction on the name of this check, you could name it system_logs for instance and it would still be able to collect logs for you: only the contents of the check matter).

Then, the config key of the logs check indicates what the contents of the /etc/datadog-agent/conf.d/logs.d/conf.yaml file will be. This is where you put the config file contents (as described above). In the case of logs collection, the config file itself contains the logs key, which is why you have both an inner and an outer logs key if you also named your check "logs".

[KSerrania]

Hello @cirsrejoe, did the above suggestion work for your use case?

[cirsrejoe]

Yes, I just saw this - closing the issue. Thank you!