Address Request for Additional Attributes in Datadog Logging

[pjhill]

Description

Given the requirement for DevOps SME on this support request, we need someone from DevOps COP to do some discovery.

Acceptance Criteria

• [ ] Discovery write-up is available in this ticket

[rmtolmach]

Pasting some discovery I did when this support request was first opened:

Currently, there’s no key/value explanation of the values (as seen in the first screenshot). I found that the parsing is done by Grok Parser in the log pipeline, but the parsing rules (second screenshot) are read-only in the UI because the Traefik pipeline is installed by an integration. I can’t find anything relevant in the datadog-agent directory in the manifest repo and I don’t see the vsp-infra-traefik repo anymore. Not sure where to edit this.

It would be as simple as adding some parsing rules to step 3 (second screenshot) but that's the read-only part! 😞

Resources:

• Grok parser datadog docs: https://docs.datadoghq.com/logs/log_configuration/processors/?tab=ui#grok-parser
• Traefik pipeline: https://vagov.ddog-gov.com/logs/pipelines?search=%20traefik
  • If you open up Traefik and click the 👁️ emoji for the first step: "Grok Parser: Parsing Traefik logs", you'll see where I got the second screenshot from.