Logs enabled but the explorer is empty: path, permissions, restart

Logs enabled but nothing in the explorer

What you see: metrics flow, datadog-agent status is green, but Logs Explorer / Live Tail shows nothing for the host or service.

Checklist, in order

1. Did the agent restart after the config change? logs_enabled: true does nothing until restart. This is the top cause.
2. File path wrong. The path in the logs section must exist and match. A typo means the agent tails nothing and says nothing.
3. Permissions. The agent runs as its own user (dd-agent). If it cannot read the file, it cannot tail it. Check read perms on the file and execute perms on every parent directory.
4. Wrong source name. source: picks the pipeline. A made-up source still ingests, but parsing looks wrong and the logs may land somewhere you are not looking. Filter Live Tail by host first, not by source.
5. Container log exclude rules. DD_CONTAINER_EXCLUDE or autodiscovery annotations may be filtering the container out. Check the agent container env.
6. Log volume throttling. Absurd volume (debug logging in prod) can get throttled. Check the Logs Agent section of status for backpressure.

Confirm

datadog-agent status, Logs Agent section: it lists every tailed file and recent errors per file. If your file is not listed, the config did not load (restart, yaml indentation). If listed with errors, the error names the problem (permission, missing file).

Trap

Searching the explorer with a bad query and concluding ingestion is broken. Always verify with Live Tail unfiltered on the host first. Nine times out of ten the logs are there and the query was wrong.

The log collection docs: enable with logs_enabled: true in datadog.yaml, configure sources, restart; the Logs Agent section of agent status lists tailed files and errors. Verified against live docs 2026-09-26.