search

serilog-archive / serilog-sinks-datadog

A Serilog sink that writes events to DataDog
Apache License 2.0
8 stars 8 forks source link

Use Event API instead of Statsd #3

Closed mausch closed 6 years ago

mausch commented 8 years ago

Currently this code uses https://github.com/DataDog/dogstatsd-csharp-client which is only a Statsd client. The problem is, this talks to the Statsd server (usually the Datadog agent on the same host) through UDP, which can lose messages and has datagram size issues.

I've created an issue on their repo to fix this by using the Event API endpoint instead of Statsd ( https://github.com/DataDog/dogstatsd-csharp-client/issues/25 ) but they don't seem to be very interested in maintaining their .NET library.

In the meantime, this affects this Serilog integration as well, so logging isn't really reliable with this sink.

mausch commented 8 years ago

The other (related) problem is that Datadog doesn't offer a batch API for events. Each log entry needs its own HTTP request :-/

stefansedich commented 8 years ago

I never treated Datadog as a consistent or reliable view of my logs, I would still use SEQ/Splunk to manage logs as those tools were far better for that purpose.

I found the best use of Datadog was to just send up Errors, so that we could drive Pagerduty/Statuspage alerting and this sink fulfilled that need perfectly.

Not having a batch upload is a bit of a concern for me but I would be happy to see a PR for this that sends up the events using the API, and perhaps see with Datadog to see if a batch upload is in the pipeline.

mausch commented 8 years ago

I'm already using Datadog with monitors linked to Pagerduty for alerting, and yes, in fact Datadog themselves recommended something like Splunk. However they've also recommended a Logstash (or Fluentd) integration, which is about logging and also sends events one at a time. This seems like a contradiction to me, and the lack of a batch event endpoint is baffling to say the least, but that's an issue with Datadog and not with this library.

Regardless of all this, Serilog is a general-purpose logging library, and I'd expect all sinks to be essentially interchangeable for the purpose of writing logs. Silently dropping log entries means this sink is not suitable for general-purpose logging, so at least I'd put a big warning in the README. Otherwise, other people will make the same mistake I did.

nblumhardt commented 6 years ago

Closing this one as stale