Logs enabled but the explorer is empty: path, permissions, restart

TL;DR

Did the agent restart after the config change? logs\_enabled: true does nothing until restart. Check read perms on the file and execute perms on every parent directory. Check the agent container env. Check the Logs Agent section of status for backpressure.

When to use

You are seeing this: What you see: metrics flow, datadog-agent status is green, but Logs Explorer / Live Tail shows nothing for the host or service. Use this skill when you run into "Logs enabled but the explorer is empty: path, permissions, restart".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Logs enabled but nothing in the explorer

What you see: metrics flow, datadog-agent status is green, but Logs Explorer / Live Tail shows nothing for the host or service.

Checklist, in order

1. Did the agent restart after the config change? logs_enabled: true does nothing until restart. This is the top cause.
2. File path wrong. The path in the logs section must exist and match. A typo means the agent tails nothing and says nothing.
3. Permissions. The agent runs as its own user (dd-agent). If it cannot read the file, it cannot tail it. Check read perms on the file and execute perms on every parent directory.
4. Wrong source name. source: picks the pipeline. A made-up source still ingests, but parsing looks wrong and the logs may land somewhere you are not looking. Filter Live Tail by host first, not by source.
5. Container log exclude rules. DD_CONTAINER_EXCLUDE or autodiscovery annotations may be filtering the container out. Check the agent container env.
6. Log volume throttling. Absurd volume (debug logging in prod) can get throttled. Check the Logs Agent section of status for backpressure.

Confirm

datadog-agent status, Logs Agent section: it lists every tailed file and recent errors per file. If your file is not listed, the config did not load (restart, yaml indentation). If listed with errors, the error names the problem (permission, missing file).

Trap

Searching the explorer with a bad query and concluding ingestion is broken. Always verify with Live Tail unfiltered on the host first. Nine times out of ten the logs are there and the query was wrong.

The log collection docs: enable with logs_enabled: true in datadog.yaml, configure sources, restart; the Logs Agent section of agent status lists tailed files and errors. Verified against live docs 2026-09-26.